maldoc

Automate Maldoc creation

A script that extracts embedded images from Office Open XML (OOXML) documents and generates image hash similarity graphs that cluster visually similar images together. The script computes the Average Hash of each extracted image, then graphs the images if they meet the similarity threshold. The script can be used as a technique for visually iden…

Manufacturing Truth since 1984

Dockerfile for static maldoc analysis purposes

Static analysis of a malicious RTF document: hidden exploit object, shellcode emulation and the dropper's download chain.

Static triage for Office and PDF files: flags macros, auto-exec, DDE, remote templates and PDF actions without detonation; scored verdict and IOCs.

A write-up about the CyberDefenders Lab Phishy

Guided, safety-hardened desktop GUI for the REMnux maldoc tools (pdfid, pdf-parser, oledump, oletools, peepdf): triage a suspicious PDF or Office file in one place, with explanations and next steps.