{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/3"}],"enrichment":{"capability":"Malduck provides cryptographic, compression, and memory-analysis utilities for malware research, including AES, Blowfish, ChaCha20, Serpent, aPLib decompression, and tools to parse PE/ELF binaries and memory dumps.","skillfed_tags":["malware-analysis","reverse-engineering","cryptography"],"use_cases":["Decrypt and analyze malware communications encrypted with AES, Blowfish, or ChaCha20.","Decompress packed malware samples using aPLib or LZNT1 algorithms.","Extract configuration data from memory dumps or PE files using the Extractor framework with YARA rules.","Parse and inspect PE and ELF binaries and memory dumps with a unified memory-model API.","Implement custom malware family signatures and extraction logic for automated analysis pipelines."],"what_it_does":"Malduck is a Python library for malware analysis that bundles cryptographic primitives (AES, Blowfish, ChaCha20, Serpent), compression algorithms (aPLib, gzip, LZNT1), and memory-model abstractions to work uniformly across PE executables, ELF binaries, raw memory dumps, and IDA output. It originated as a fork of the Roach project to decouple it from Cuckoo Sandbox while retaining support for Cuckoo's procmem format.\n\nThe library is designed to reduce boilerplate in malware research scripts by providing fixed-width integer types, string utilities, hashing functions, and a modular extraction engine for config recovery. You work with memory or binary objects using the same API regardless of source format, and can define custom extractors using YARA rules and pattern matching to identify and parse malware families.","worth_installing":"Yes, if you are doing malware analysis or reverse engineering and need a compact toolkit for cryptography, decompression, and memory parsing. The copyleft license is acceptable for research and internal tools but problematic for closed-source products. Maintenance is aging (last release over a year ago), so expect to maintain patches yourself if critical issues arise, but the codebase is stable and no known vulnerabilities are recorded."},"id":"malduck","links":{"html":"https://skillfed.io/packages/malduck","md":"https://skillfed.io/packages/malduck.md","pypi":"https://pypi.org/project/malduck/"},"maintenance":{"status":"aging"},"meta":{"latest_release":"2024-05-10","license_spdx":null,"license_treatment":"copyleft","name":"malduck","python_support":"supports_current","summary":"Malduck is your ducky companion in malware analysis journeys"},"popularity":{"monthly_downloads":88995,"position":13688,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"4.4.1"}