Malcat is currently in beta phase. It means that while the core of the software is finished and polished, it has not been tested extensively by its user base and documentation is somewhat sparse. The good news is that Malcat is on sale during this period.
Malcat Lite
The Lite Edition is completey free and contains most of Malcat's features, with a few limitations:
- Hexadecimal/structure editor
- 50+ file formats
- Navigate through embedded objects
- Identify strings and symbols
- Decrypt/decompress data in-place
- Constants and FLIRT scanner
- Yara scanner + editor
- Python scripting
- x86/x64 disassembly
- Python headless mode
- Sleigh decompiler
- Script decompiler
- Diff engine
- Anomaly scanner
- Threat intelligence
- Kesakode access
- Professional use
- Support
Full & Professional
The full version of Malcat comes with all features, free updates for one year and allows installation on up to five machines for one user:
- Hexadecimal/structure editor
- 50+ file formats
- Navigate through embedded objects
- Identify strings and symbols
- Decrypt/decompress data in-place
- Constants and FLIRT scanner
- Yara scanner + editor
- Python scripting
- x86/x64, .NET, python, VB and NSIS disassembly
- Python headless mode
- Sleigh decompiler (x86/x64)
- Script decompiler (AutoIT, VBA, MSI tables, Excel macros)
- Diff engine
- Anomaly scanner
- Threat intelligence
- Kesakode access: 40 or 80 PRO requests per month
- Use in a professional environment PRO
- Support PRO
Installation notes
Malcat comes as a portable ZIP archive that you may decompress wherever you want. Since there is no installer, you may want to add the executable to your PATH or create a shortcut yourself.
Windows
Malcat can run on Windows 10 64bits. It should also run fine on Windows 7 64bits (with the latest updates installed) and Windows 11 64bits, but no testing is performed for these platforms. If you have a doubt, test with the lite edition first. Note that you will need to have the VS2015 64bits redistributables installed on your system. You can download them on the Microsoft Download Center if needed.
On Windows, Malcat comes bundled with a python 3 interpreter. You may chose to use your python system installation instead, but you will have to make sure to have the same version installed (python 3.8 x64).
Linux
Malcat has been built for some of the most widely spread Linux distributions out there. After unzipping the archive, you will need to install the following packages from your distribution repository:
- GTK 3
- Python 3
- A few python packages (see
INSTALL.txt)
If your distribution is not listed there, you can still try one of the portable packages depending on your python version:
- Python 3.12 -> Ubuntu 24.04
- Python 3.11 -> Ubuntu 23.04
- Python 3.10 -> Ubuntu 22.04
- Python 3.9 -> Debian 11
- Python 3.8 -> Ubuntu 20.04
- Python 3.7 -> Debian 10
- Python 3.6 -> Ubuntu 18.04
And if it still does not work (and there is enough demand) we may consider distributing the application as a Flatpak packet, but you may have to endure slower cold starts and subpar desktop theme support.
Also a quick note regarding HiDPI: Linux HiDPI support is terrible. And Malcat uses wxWidgets, which somehow makes things harder since some controls are native, and some are not. We have tried to make Malcat compatible with most HiDPI settings, but a few controls may be too small/big, in particular if you have fractional scaling. If you have a doubt, test with the lite edition first.
MacOS
There is no MacOS version of Malcat. While there is no technical constraint that forbids Malcat from being compiled for this platform, we have no experience developing for MacOS. In the very unlikely event that the sales go very very well and we can afford one of these shiny computers, who knows, but don't hold your breath.
Install the python module (headless scripting)
Paid users may analyse files without the GUI by directly importing the malcat module from their script (aka headless mode). The module is located inside the <malcat install dir>/bin directory. In order to use the module, you have to make sure that it can be seen and imported by the python interpreter. There are three ways to achieve this:
- Put your script inside
<malcat install dir>/bin - Add
<malcat install dir>/bintosys.pathbefore importing the Malcat module - Install the module into your (virtual) environment using the script
<malcat install dir>/install_api.py
The later option is the preferred way, as it makes Malcat available to your scripts from everywhere. The script <malcat install dir>/install_api.py let you install the API in either your root python environment, your user environment or the current virtual environment.
*: Additional taxes may be added in some regions and are calculated automatically during checkout by our payment provider.