Malware Analysis Python Packages

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

lief

LIEF - Library to Instrument Executable Formats (C++, Python, Rust)

binary-refinery

High Octane Triage Analysis

pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.

assemblyline

Base components for Assemblyline 4 (Datastore, ODM, Filestore, Remote Datatypes, utils function, etc...)

python-flirt

intel x86(-64) code analysis library that reconstructs control flow

assemblyline-core

Core server components for Assemblyline 4 (Alerter, dispatcher, expiry, ingester, scaler, updater, ...)

assemblyline-ui

Web interface and APIs for Assemblyline 4

assemblyline-service-client

Service client that interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4

assemblyline-v4-service

Base service class from Assemblyline 4

pyonenote

A python library to parse OneNote (.one) files

flare-capa

The FLARE team's open-source tool to identify capabilities in executable files.

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

assemblyline-service-server

Service tasking and result publishing API for Assemblyline 4

anyrun-sdk

Simplify integration with ANY.RUN REST API services

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

speakeasy-emulator

Windows kernel and user mode emulation.

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

xlmmacrodeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)

karton-core

Distributed malware processing framework based on Python, Redis and S3.

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

virustotal-python

A Python library to interact with the public VirusTotal v3 and v2 APIs.

ntoseye

WinDbg-like kernel debugger for Windows, from Linux and macOS

python-lancelot

intel x86(-64) code analysis library that reconstructs control flow