idiom

IRScripts

Incident Response Scripts

OLEPackagerFormat

OLE Package Format Documentation

hollows_hunter

A process scanner detecting and dumping hollowed PE modules.

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

nucleus

Clone of Nucleus function detector.

Open-Source-YARA-rules

YARA Rules I come across on the internet

ADVobfuscator

Obfuscation library based on C++11/14 and metaprogramming

dirhistory

Remember previous directories in bash and define keyboard shortcuts to change current directory to previous/next entries in history.

fcex

Python script for working with FortiClient quarantine files.

flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool

flare-floss

FireEye Labs Obfuscated String Solver - Automatically extract obfuscated strings from malware.

flare-ida

IDA Pro utilities from FLARE team

frida-extract

Frida.re based RunPE extraction tool

frida-python

Frida python bindings

idapython6to7

libpeconv

A small library for mapping and unmapping PE files.

MalShare-Toolkit

Set of tools for interacting with Malshare

malware_analysis

Various snippets created during malware analysis

MISP

MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)

mlib

Your bag of handy codes for malware researchers

pefile

pefile is a Python module to read and work with PE (Portable Executable) files

phoenix

Cuckoo Sandbox is an automated dynamic malware analysis system

RunPE

Code that allows running another windows PE in the same address space as the host process.

sflock

Sample staging & detonation utility to be used in combination with Cuckoo Sandbox.

signature-base

Signature base for my scanner tools

tnefparse

A TNEF decoding library written in python, without external dependencies

yeti

Your Everyday Threat Intelligence

hansel

IOCs-1

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.