First hint to this one is that 'malum' means 'evil'. This challenge was related to [evil bits](https://en.wikipedia.org/wiki/Evil_bit) in the IP header. When filtering out all IP PDUs with the evil bit set (`(ip.flags.rb eq 1) && ip`), we see that there's no obvious pattern to which PDUs have it or not.
The solution was to treat the packet number with evil bit as a '1' in a binary string. So since packet 2, 6, and 7 had the bit set, this turned into 0b01000110 (Bit set at position 2, 6 and 7)), where we start to count from packet #1 and set the bit to '1' if there is a packet with evil bit at that position, or '0' if not. So we export all the packets into a file and extract their index.
Final code is just to build the bitstrings:```pythonnums = []for line in open("packetlist").readlines()[1:]:    nums.append(int(line.split(',')[0].replace('"','')))
tmp = ""final = ""for i in xrange(1,29*8):    if i in nums:        tmp += '1'    else:        tmp += '0'    if len(tmp) == 8:        final += chr(int(tmp,2))        tmp = ''print(final)
`F#{d0_y0u_kn0w_y0ur_fl4g5?}`