
miniDumpReader
Parses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…

Parses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…

Algorithmic PE de-obfuscator, Shannon entropy radar, and incident triage engine

GUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat…


Python library for parsing CLR/PE metadata in .NET assemblies, exposing streams and hash fingerprints to support malware analysis and threat hunting.

Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles

machofile is a module to parse Mach-O binary files

Technical Analysis of Bibi-Windows Wiper Targeting Israeli Organizations

Windows Analysis and Research Toolkit


Experimental Windows .text section Patch Detector

Library to access the Windows Shell Item format

Binary and Directory tree comparison tool using Fuzzy Hashing

Tool to help guess a files 256 byte XOR key by using frequency analysis

In-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…

Scan for files containing the signature from the `xz` backdoor (CVE-2024-3094)

Script to extract malicious payload and decoy document from CVE-2015-1641 exploit documents

Local Bytecode Scanner for the Log4JShell Vulnerability (CVE-2021-44228)