Fraunhofer FKIE Malpedia

Use in your agent

Load Malpedia family metadata into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Access

• No account or key is needed for the public family-metadata endpoint.
• This skill accesses metadata only and never calls sample-information, raw-sample or ZIP-sample endpoints.

Request

curl 'https://malpedia.caad.fkie.fraunhofer.de/api/get/families'

Format

JSON object keyed by family ID; values include UUID, common name, aliases, description, attribution, references, source URLs, notes and update date.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

"""Malpedia public family metadata -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://malpedia.caad.fkie.fraunhofer.de/api/get/families"
r = requests.get(URL, timeout=120)
r.raise_for_status()
payload = r.json()
rows = []
for family_id, item in payload.items():
    rows.append({
        "family_id": family_id,
        "uuid": item.get("uuid"),
        "common_name": item.get("common_name"),
        "updated": item.get("updated"),
        "description": item.get("description"),
        "alt_names": item.get("alt_names", []),
        "attribution": item.get("attribution", []),
        "urls": item.get("urls", []),
    })
df = pd.DataFrame(rows)
df["updated"] = pd.to_datetime(df["updated"], errors="coerce")
df.to_parquet("malpedia_families.parquet", index=False)
print(len(df), "families", "latest family update", df["updated"].max().date().isoformat())

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 3839 families latest family update 2026-10-30

Limits

• Rate limit: Not stated.
• Keyless responses contain only public material; account-visible results can differ.
• The family endpoint is a current snapshot rather than a versioned historical export.

Quirks

• The top-level object is keyed by family ID, so preserve that key explicitly when normalizing rows.
• Aliases, attribution and URLs remain list-valued columns in Parquet, while some descriptions are empty.
• Never substitute any /api/get/sample/... endpoint; raw and ZIP samples are out of scope.

Terms and attribution

• Website content is CC BY-NC-SA 3.0; retain credits, use it non-commercially and share adaptations under the same terms.
• Treat non-public material as TLP:AMBER unless Malpedia designates or agrees otherwise.

Sources

• https://malpedia.caad.fkie.fraunhofer.de/usage/api: “Provide meta data for all families on Malpedia.”
• https://malpedia.caad.fkie.fraunhofer.de/usage/api: “Provide all YARA rules with a version newer than a specific date. Intended for users intending regular automated updates.”
• https://malpedia.caad.fkie.fraunhofer.de/usage/tos: “The whole content of the website is released under Creative Common's CC BY-NC-SA 3.0 license.”
• https://malpedia.caad.fkie.fraunhofer.de/: “More specifically, you will need an account to access all data (malware samples, non-public YARA rules, ...).”