DissectMalware

XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)

batch_deobfuscator

Deobfuscate batch scripts obfuscated using string substitution and escape character techniques.

pyOneNote

A python library to parse OneNote (.one) files

MalwareCMDMonitor

Shows command lines used by latest instances analyzed on Hybrid-Analysis

yaradbg-frontend

ClipboardWatcher

Monitor the textual data pasted into Windows clipboard

OfficeForensicTools

A set of tools for collecting forensic information

PySameSame

This is a python version of samesame repo to generate homograph strings

xlrd2

xlrd2 is a variant of xlrd that is actively maintained

yaradbg-backend

WinNativeIO

Using Undocumented NTDLL Functions to Read/Write/Delete File

pyxlsb2

an Excel 2007+ Binary Workbook (xlsb) parser for Python

MDIExtractor

npp-langs-4-sec

Notepad++ Syntax Highlighting for Languages Used by Cyber Security Professionals

IoCMiner

A Framework to Automatically Extract Indicators of Compromise (IoCs) from Twitter

PhishCanary

Given a TLD zone file, PhishCanary extracts International Domain Names (IDNs) that are homoglyphs of specified target domain names.

yaradbg-issues

msoffcrypto-tool

Python tool and library for decrypting MS Office files with passwords or other keys

yaradbg-container

A docker config file to run yaradbg in a container

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

document-samples

Getting-Started-Terraform

Exercise files for my Pluralsight course

pyxlsb

Excel 2007+ Binary Workbook (xlsb) reader for Python

winsmsd

Windows (ShadowMove) Socket Duplication

xlrd

Please use openpyxl where you can...

CSS-Exchange

Exchange Server support tools and scripts

dotnet-computevirtualization

Sample class library for interfacing with Windows host compute service.

ms-identity-b2c-javascript-spa

Vanilla JavaScript single-page application calling a web API protected by Azure AD B2C

pyrh

Python Framework to make trades with the unofficial Robinhood API

sublime-platform

Open, adaptable email security platform.