Malware Analysis Python Packages

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

lief

LIEF - Library to Instrument Executable Formats (C++, Python, Rust)

binary-refinery

High Octane Triage Analysis

python-flirt

intel x86(-64) code analysis library that reconstructs control flow

assemblyline-ui

Web interface and APIs for Assemblyline 4

assemblyline-v4-service

Base service class from Assemblyline 4

assemblyline

Base components for Assemblyline 4 (Datastore, ODM, Filestore, Remote Datatypes, utils function, etc...)

assemblyline-core

Core server components for Assemblyline 4 (Alerter, dispatcher, expiry, ingester, scaler, updater, ...)

assemblyline-service-client

Service client that interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4

assemblyline-service-server

Service tasking and result publishing API for Assemblyline 4

speakeasy-emulator

Windows kernel and user mode emulation.

flare-capa

The FLARE team's open-source tool to identify capabilities in executable files.

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

pyonenote

A python library to parse OneNote (.one) files

anyrun-sdk

Simplify integration with ANY.RUN REST API services

xlmmacrodeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)

pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

quark-engine

An Obfuscation-Neglect Android Malware Scoring System

karton-core

Distributed malware processing framework based on Python, Redis and S3.

assemblyline-client

Python client for Assemblyline 3 and 4 / Client python pour AssemblyLine 3 and 4

mwcp

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

icicle-emu

Python bindings for the Icicle emulator.

peid

Python implementation of the Packed Executable iDentifier (PEiD)