Malware Analysis Python Packages

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

lief

LIEF - Library to Instrument Executable Formats (C++, Python, Rust)

assemblyline-ui

Web interface and APIs for Assemblyline 4

assemblyline-service-client

Service client that interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4

assemblyline-service-server

Service tasking and result publishing API for Assemblyline 4

assemblyline-core

Core server components for Assemblyline 4 (Alerter, dispatcher, expiry, ingester, scaler, updater, ...)

assemblyline

Base components for Assemblyline 4 (Datastore, ODM, Filestore, Remote Datatypes, utils function, etc...)

python-flirt

intel x86(-64) code analysis library that reconstructs control flow

binary-refinery

High Octane Triage Analysis

flare-capa

The FLARE team's open-source tool to identify capabilities in executable files.

assemblyline-v4-service

Base service class from Assemblyline 4

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

pyonenote

A python library to parse OneNote (.one) files

speakeasy-emulator

Windows kernel and user mode emulation.

xlmmacrodeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)

anyrun-sdk

Simplify integration with ANY.RUN REST API services

pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

quark-engine

An Obfuscation-Neglect Android Malware Scoring System

python-lancelot

Intel x86(-64) code analysis library that reconstructs control flow

icicle-emu

Python bindings for the Icicle emulator.

karton-core

Distributed malware processing framework based on Python, Redis and S3.

assemblyline-client

Python client for Assemblyline 3 and 4 / Client python pour AssemblyLine 3 and 4

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery