MalwareAPI-2026 : API sequenece-based Multiclass Malware Dataset

This multiclass API sequence malware dataset is a part of our research on malware analysis. The dataset released by Angelo Oliveira (https://dx.doi.org/10.21227/tqqm-aq14) contains 42,797 malware and 1,079 goodware API call sequences. Using the hash code of each sample from the dataset released by Angelo Oliveira, JSON files are downloaded through VIRUSTOTAL's WEB-API (https://www.virustotal.com/api/v3/files/). The class labels are decided from each of the JSON files. The list of found classes is ['trojan', 'adware', 'downloader', 'hacktool', 'Goodware', 'iobit', 'miner', 'virus', 'pua', 'webcompanion', 'ransomware', 'dropper', 'syncopate', 'vsok', 'candyopen', 'sterjosoftware', 'kingsoft', 'drivernavigator', 'fusioncore/auslogics', 'casino', 'filerepmetagen', 'fugrafa/nsismod', 'registryreviver', 'avanquest', 'taobao', 'tweakbit', 'opencandy', 'msil', 'installcore', 'monitor', 'conduit', 'filerepmalware', 'deceptor/deceptpcclean', 'baidu', 'worm', 'visicom', 'chinad', 'miscx', 'creprote', 'rabio', 'lulusoftware', 'reimage/reimagerepair', 'bandoo/searchsuite', 'reimage', 'nsismod', 'avanquest/speedingupmypc', 'deceptpcclean', 'crack', 'spyware', 'keylogger', 'filerepmalware/misc', 'filereppup/lulusoftware', 'primecasino', 'filetypeassistant', 'xlsxviewer', 'softomate', 'sality', 'techjoydown', 'driverreviver', 'filerepmalware/installcore', 'genericrxfv', 'safecleaner', 'driverupdate', 'processhacker', 'bundleinstaller', 'wronginf', 'toolbar', 'fusioncore/tweakbit', 'ubar', 'advancedsystemrepair/anmalpro', 'msil/tlapia', 'bladabindi', 'complitly', 'tempmon', 'sterjo', 'lionsea/software', 'adskip', 'youxun', 'playtech', 'presenoker', 'ursu', 'vtools', 'kingroot', 'feednotifier', 'auslogics', 'candyopen/puabundler', 'startpage', 'opencandy/candyopen', 'avanquest/filerepmalware', 'qiwmonk', 'reg1staid', 'auslogics/fusioncore', 'bundleinstaller/primecasino', 'pokki', 'zookaware', 'anyplacecontrol', 'driverupdate/slimware', 'utorrent', 'haotukankan', 'freemake', 'yandex', 'drivergenius', 'azden/hd2000ea', 'logicielsespions', 'taobao/filerepmalware', 'toptools', 'tbshell', 'rootgenius', 'bluesprig/iobit']. The finalized multiclass dataset contains 40437 malware API call sequences and 1039 goodware API call sequences. When comparing class labels obtained from VIRUSTOTAL, 2400 samples are discarded after finding a mismatch.