Malwrologist

XLMMacroDeobfuscator. Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)

batch_deobfuscator. Deobfuscate batch scripts obfuscated using string substitution and escape character techniques.

pyOneNote. A python library to parse OneNote (.one) files

MalwareCMDMonitor. Shows command lines used by latest instances analyzed on Hybrid-Analysis

base64_substring. Generate a Yara rule to find base64-encoded files containg a specific keyword

yaradbg-frontend. JavaScript

ClipboardWatcher. Monitor the textual data pasted into Windows clipboard

OfficeForensicTools. A set of tools for collecting forensic information

yaradbg-backend. Python

PySameSame. This is a python version of samesame repo to generate homograph strings

xlrd2. xlrd2 is a variant of xlrd that is actively maintained

pyxlsb2. an Excel 2007+ Binary Workbook (xlsb) parser for Python

WinNativeIO. Using Undocumented NTDLL Functions to Read/Write/Delete File

MDIExtractor. Python

IoCMiner. A Framework to Automatically Extract Indicators of Compromise (IoCs) from Twitter

npp-langs-4-sec. Notepad++ Syntax Highlighting for Languages Used by Cyber Security Professionals

PhishCanary. Given a TLD zone file, PhishCanary extracts International Domain Names (IDNs) that are homoglyphs of specified target domain names.

yaradbg-issues.

msoffcrypto-tool. Python tool and library for decrypting MS Office files with passwords or other keys

yaradbg-container. A docker config file to run yaradbg in a container

oletools. oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

TLDExtractor. Accurately extract TLD, effective TLD, 2LD, 3LD, ... from a given domain name; by utilizing the Public Suffix List maintained by Mozilla Foundation

Getting-Started-Terraform. Exercise files for my Pluralsight course

xlrd. Please use openpyxl where you can...

pyxlsb. Excel 2007+ Binary Workbook (xlsb) reader for Python

winsmsd. Windows (ShadowMove) Socket Duplication

document-samples. HTML