---
id: malduck
version: "4.4.1"
license: GPLv3
license_treatment: copyleft
maintenance: aging
---

# malduck — Malduck is your ducky companion in malware analysis journeys

License: copyleft · Maintenance: aging · Downloads: 89.0K/mo

## What it is and what it does

Malduck is a Python library for malware analysis that bundles cryptographic primitives (AES, Blowfish, ChaCha20, Serpent), compression algorithms (aPLib, gzip, LZNT1), and memory-model abstractions to work uniformly across PE executables, ELF binaries, raw memory dumps, and IDA output. It originated as a fork of the Roach project to decouple it from Cuckoo Sandbox while retaining support for Cuckoo's procmem format.

The library is designed to reduce boilerplate in malware research scripts by providing fixed-width integer types, string utilities, hashing functions, and a modular extraction engine for config recovery. You work with memory or binary objects using the same API regardless of source format, and can define custom extractors using YARA rules and pattern matching to identify and parse malware families.

Use it for:

- Decrypt and analyze malware communications encrypted with AES, Blowfish, or ChaCha20.
- Decompress packed malware samples using aPLib or LZNT1 algorithms.
- Extract configuration data from memory dumps or PE files using the Extractor framework with YARA rules.
- Parse and inspect PE and ELF binaries and memory dumps with a unified memory-model API.
- Implement custom malware family signatures and extraction logic for automated analysis pipelines.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Malduck provides cryptographic, compression, and memory-analysis utilities for malware research, including AES, Blowfish, ChaCha20, Serpent, aPLib decompression, and tools to parse PE/ELF binaries and memory dumps.

Yes, if you are doing malware analysis or reverse engineering and need a compact toolkit for cryptography, decompression, and memory parsing. The copyleft license is acceptable for research and internal tools but problematic for closed-source products. Maintenance is aging (last release over a year ago), so expect to maintain patches yourself if critical issues arise, but the codebase is stable and no known vulnerabilities are recorded.

## Install

pip install malduck
uv add malduck
poetry add malduck

## Installing malduck

Before you install: Low install friction with a pure-Python wheel. Maintenance is aging—last release was 2024-05-10, over a year ago—but the repository remains active with recent commits and no archived status.

License in practice: GPLv3 copyleft license requires that any derivative work or distribution must also be licensed under GPLv3 and provide source code; suitable for internal malware research but restrictive for closed-source commercial tools.

Quickstart:

pip install malduck

from malduck import aes

key = b'A'*16
iv = b'B'*16
plaintext = b'data'*16
ciphertext = aes.cbc.encrypt(key, iv, plaintext)

Requires Python 3.8 or later; yara-python and pycryptodomex are compiled dependencies that may require build tools on some systems.

Verify before relying:

- Whether yara-python and other binary dependencies install smoothly on Windows and macOS without additional setup.
- Current maintenance cadence and likelihood of future updates beyond the 2024-05-10 release.

## Package facts

- License: GPLv3 (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 89.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

malware analysis toolkit, cryptography utilities, binary memory analysis, PE ELF parsing, compression decompression, config extraction malware, yara integration analysis, malware-analysis, reverse-engineering, cryptography

[View on SkillFed](https://skillfed.io/packages/malduck) · [View on PyPI](https://pypi.org/project/malduck/)