# Malware Sample Sources

## Free Repositories

### MalwareBazaar (bazaar.abuse.ch)
- **Access**: Free, no registration required for downloads
- **API**: REST API, rate-limited
- **Content**: Community-uploaded samples, tagged by family
- **Format**: Password-protected ZIP (password: "infected")
- **Best for**: Recent samples, specific family searches

### Malshare (malshare.com)
- **Access**: Free API key required
- **API**: REST API with daily limits
- **Content**: Daily malware sample uploads
- **Best for**: Daily fresh samples

### VirusTotal (virustotal.com)
- **Access**: Free account for search; premium API for downloads
- **API**: REST API v3
- **Content**: Massive sample database with AV scan results
- **Best for**: Hash lookup, AV detection rates

### vx-underground (vx-underground.org)
- **Access**: Free
- **Content**: Large curated malware collection, APT samples, papers
- **Best for**: Research, APT samples, malware families

### theZoo (github.com/ytisf/theZoo)
- **Access**: Free (GitHub)
- **Content**: Curated live malware for research
- **Best for**: Well-documented samples for learning

## Sandbox Services (with sample access)

| Service | Free Tier | Downloads |
|---------|-----------|-----------|
| CAPE Sandbox | Yes | Yes |
| Any.Run | Limited | Premium |
| Hybrid Analysis | Yes | Yes (API) |
| Triage | Yes | Yes |
| Joe Sandbox | Limited | Premium |

## API Rate Limits

| Source | Free Limit | Notes |
|--------|-----------|-------|
| MalwareBazaar | Reasonable | No strict limit documented |
| VirusTotal | 4 req/min | 500/day free tier |
| Malshare | 2000/day | API key required |
| OTX | Reasonable | Free AlienVault account |