Skip to content

🦆 Malduck is your ducky companion in malware analysis journeys

License

Notifications You must be signed in to change notification settings

yunzheng/malduck

 
 

Repository files navigation

🦆 Malduck

Malduck is your ducky companion in malware analysis journeys. It is mostly based on Roach project, which derives many concepts from mlib library created by Maciej Kotowicz. The purpose of fork was to make Roach independent from Cuckoo Sandbox project, but still supporting its internal procmem format.

Malduck provides many improvements resulting from CERT.pl codebase, making scripts written for malware analysis purposes much shorter and more powerful.

Improvements

  • Support for (non)memory-mapped PE images without header fix-up.
  • Searching for wildcarded byte sequences
  • Support for x64 disassembly
  • Fixed-precision integer types
  • Many improvements in ProcessMemory

Usage

Installing may be performed by running

pip install malduck

Usage documentation can be found on readthedocs.

Co-financed by the Connecting Europe Facility by of the European Union

About

🦆 Malduck is your ducky companion in malware analysis journeys

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Python 99.5%
  • YARA 0.5%