PyMal is a python based interactive Malware Analysis Framework. It is built on the top of three pure python programes Pefile, Pydbg and Volatility.
The main aim of the project is to combine all the Malware Analysis related tools into a single interface for rapid analysis.
PyMal have several wrapper functions to manipulate Executable as well as running Processes. It also offers some advanced features like
Injected Code Detection
Hook Detection using Passive Image Referencing
For detailed view of the features and working, please check out the demonstration video shown below.
It works on all platforms starting from Windows XP to Windows 8.
Requirements
You must have latest version (v2.6 or higher) of Python on your system.
Installation
Make sure you have Python (v2.6 or higher) installed on your system.
Then follow the simple steps below for quick installation
After download, extract PyMal.zip on your local disk.
Copy the content of 'site-packages' folder into your Python installation 'site-packages' directory
For more details watch the demonstration video shown below.
How to Use?
PyMal is very simple and easy to use.
Here are the simple usage details
After the installation, run the PyMal by clicking on the 'pymal.py' file
This will launch the PyMal shell as shown in the screenshot & video below
All the PyMal functions can be accessed through "pm" object of PyMal class. It also support TAB completion of the commands.
For more details follow the video below
Screenshots
Video Demonstration
Release History
Version 1.0 : 5th June 2013
First public release of PyMal
Disclaimer
PyMal tool is released "as is" without any warranty of any kind,
neither SecurityXploded nor the author is responsible for any damage due
to use or misuse of this tool.
'Passive image referencing' technique is the copyright/patent of author primarily for the solutions of two problems
Unpacking of the malware
Module integrity check (eg: hook detection)
The codes, demonstrations and theories should not be used for any commercial purpose internally or externally.
By downloading the pymal you agree to the above terms and conditions.
