Maldump

What Maldump does

Using this tool

Maldump supports malware analysis. In this guide, you will use it to list antivirus quarantine entries and export their files or metadata from a training Windows volume. Follow the steps below and keep the output with your notes.

Tool guide at a glance

Investigation task

List antivirus quarantine entries and export their files or metadata from a training Windows volume.

Starting material

A Windows training volume containing known antivirus quarantine entries, mounted read only when examining an image.

What to record

Quarantine metadata and any exported files, with the source volume, antivirus product, tool version and export hashes recorded.

Evidence and safety

Restored quarantine files may contain malware. Keep exports isolated and do not execute them. Record the input identifier, tool version, relevant commands or settings, time and time zone, output location, and any errors or limitations as you work.

Choose your journey

01Understand the evidenceLearn the malware analysis concepts and limitations.Complete when you can explain what the evidence can and cannot show.Beginner · No tool required 02Follow the Maldump guideFollow the steps and screenshots below.Complete when the documented workflow produces its expected output.Guided · SUSA workstation · Time varies 03Interactive labPractise the tool workflow in a safe browser simulation.Complete when the guided result is supported by the case evidence.Beginner · Browser only 04Full LabUse your own training data, keep the output and explain what you found.Complete when another analyst can reproduce and verify the outcome.Intermediate · Isolated lab

How the labs complement this guide

The Interactive Lab uses example records to practise investigation decisions. It does not run the installed tool or establish how that version behaves. The Full Lab uses your own training environment and evidence. Obtain or create the required input before starting; a case name in an exercise is not a download.

Accessing Maldump in SUSA

Maldump lists and extracts antivirus quarantine files from a live Windows system or a mounted Windows volume. It can also export quarantine metadata to CSV. It does not dump process memory.

Choose an installation method

The upstream project offers release binaries and a pip installation. The PDM steps below are an alternative for working from the source repository, not a prerequisite for every installation. Check the upstream README for the requirements of your chosen version.

Install PDM (source checkout)

PDM is a modern Python package and dependency manager supporting the latest PEP standards.

Use a disposable analysis environment

This command downloads and immediately executes an internet hosted installation script. Run it only in an authorised, disposable build or analysis VM, never on original evidence or a production endpoint. Review the script at the official PDM project before execution, take a VM snapshot and record the installed version.

Open an administrator PowerShell prompt and run the following command:

powershell -ExecutionPolicy ByPass -c "irm https://pdm-project.org/install.ps1 | iex"

Install Visual Studio Build Tools for C++

Download Visual Studio Build Tools for C++.

Open the downloaded executable and click Yes to install.

Click Continue.

Select Desktop development with C++ and click Install.

Once the installation is complete, click OK and restart Windows.

Install Maldump

Open an administrator Command Prompt and run the following command to install Maldump:

pip install maldump

Alternatively, navigate to C:\Tools and run the following commands to install Maldump:

git clone https://github.com/NUKIB/maldump
cd maldump
pdm install
pdm run python -m maldump

Testing Maldump

List quarantine files located on disk C

maldump C:\

Dump quarantine files from disk C into archive quarantine.tar

maldump C:\ --quar

Export quarantine metadata from disk C into quarantine.csv

maldump C:\ --meta

The quarantine.csv file can be opened in Timeline Explorer and it contains quarantine metadata.