A Python toolset for malware analysis using function-level fuzzy hashing to catalog and compare malicious binaries.
Malfunction is an open-source malware analysis toolset that uses function-level fuzzy hashing to catalog and compare malicious binaries. It automates static analysis by extracting function signatures from known malware and benign software, then generates reports on unknown files by matching them against a database. This helps security researchers identify and classify malware more efficiently.
Security researchers, malware analysts, and reverse engineers who need to automate static malware analysis and compare binaries at a granular function level.
Developers choose Malfunction for its specialized focus on function-level analysis using fuzzy hashing, which provides more detailed comparisons than whole-file hashing. Its integration with Radare2 ensures accurate function extraction, and the Python-based toolset is extensible for custom analysis workflows.
Malware Analysis Tool using Function Level Fuzzy Hashing
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Extracts and analyzes individual functions within binaries using Radare2, enabling detailed comparison beyond whole-file hashing for more precise malware identification.
Employs fuzzy hashing to detect similarities between malware samples with minor variations, aiding in classification and tracking of evolved threats.
Learns function signatures from known malware and benign software into a SQLite database, allowing automated reporting on unknown binaries against stored signatures.
Leverages Radare2 for accurate function location and disassembly, ensuring reliable extraction and compatibility with a established reverse engineering framework.
Requires manual installation of specific, old dependency versions like libsqlite3 3.8.10.2 and APSW 3.8.10.1, with steps only documented for Ubuntu 14.04, making setup cumbersome.
Explicitly stated to only work on Linux-based systems, excluding users on Windows or macOS and reducing accessibility for diverse analysis environments.
Based on a 2015 presentation with no clear updates in the README, indicating it may be unmaintained and could have compatibility problems with modern systems or dependencies.