malduck

What it is and what it does

Malduck is a Python library for malware analysis that bundles cryptographic primitives (AES, Blowfish, ChaCha20, Serpent), compression algorithms (aPLib, gzip, LZNT1), and memory-model abstractions to work uniformly across PE executables, ELF binaries, raw memory dumps, and IDA output. It originated as a fork of the Roach project to decouple it from Cuckoo Sandbox while retaining support for Cuckoo's procmem format.

The library is designed to reduce boilerplate in malware research scripts by providing fixed-width integer types, string utilities, hashing functions, and a modular extraction engine for config recovery. You work with memory or binary objects using the same API regardless of source format, and can define custom extractors using YARA rules and pattern matching to identify and parse malware families.

Use it for:

• Decrypt and analyze malware communications encrypted with AES, Blowfish, or ChaCha20.
• Decompress packed malware samples using aPLib or LZNT1 algorithms.
• Extract configuration data from memory dumps or PE files using the Extractor framework with YARA rules.
• Parse and inspect PE and ELF binaries and memory dumps with a unified memory-model API.
• Implement custom malware family signatures and extraction logic for automated analysis pipelines.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Malduck provides cryptographic, compression, and memory-analysis utilities for malware research, including AES, Blowfish, ChaCha20, Serpent, aPLib decompression, and tools to parse PE/ELF binaries and memory dumps.

Yes, if you are doing malware analysis or reverse engineering and need a compact toolkit for cryptography, decompression, and memory parsing. The copyleft license is acceptable for research and internal tools but problematic for closed-source products. Maintenance is aging (last release over a year ago), so expect to maintain patches yourself if critical issues arise, but the codebase is stable and no known vulnerabilities are recorded.

Install

malduck on PyPI

pip install malduck

uv add malduck

poetry add malduck

Installing malduck

Before you install

Low install friction with a pure-Python wheel. Maintenance is aging—last release was 2024-05-10, over a year ago—but the repository remains active with recent commits and no archived status.

License in practice

GPLv3 copyleft license requires that any derivative work or distribution must also be licensed under GPLv3 and provide source code; suitable for internal malware research but restrictive for closed-source commercial tools.

Quickstart

pip install malduck

from malduck import aes

key = b'A'*16
iv = b'B'*16
plaintext = b'data'*16
ciphertext = aes.cbc.encrypt(key, iv, plaintext)

Requires Python 3.8 or later; yara-python and pycryptodomex are compiled dependencies that may require build tools on some systems.

Verify before relying

• Whether yara-python and other binary dependencies install smoothly on Windows and macOS without additional setup.
• Current maintenance cadence and likelihood of future updates beyond the 2024-05-10 release.

Package facts

Evidence: malduck-4.4.1-py3-none-any.whl

Tags

More Security packages