The examples seem the same - what is the distinction?
To get a list of the granular markings on an object, pass the object and a list of selectors to get_markings:
In [20]:
malware.get_markings('name')
Out[20]:
['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']
You can also call get_markings() as a method on the STIX object.
In [14]:
malware.get_markings('name')
Out[14]:
['marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9']