Discover jstrosch/graph-maldoc-similar-images Open Source project

Stars
18
Rank 1,208,065 (Top 24 %)
Language
Python
Created almost 4 years ago
Updated almost 3 years ago

jstrosch

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

A script that extracts embedded images from Office Open XML (OOXML) documents and generates image hash similarity graphs that cluster visually similar images together. The script computes the Average Hash of each extracted image, then graphs the images if they meet the similarity threshold. The script can be used as a technique for visually identifying malware campaigns involving documents. To use the script, supply a directory containing OOXML files. If LibreOffice is in your PATH you can optionally convert non-OOXML Word, Excel, PowerPoint and Rich Text File documents to OOXML. The script outputs DOT files that can be exported as images using Graphviz. If Graphviz is in your PATH you can also export to an SVG (preferred) or PNG image.

malware-samples

Malware samples, analysis exercises and other interesting resources.

HTML

1,214

learning-reverse-engineering

This repository contains sample programs written primarily in C and C++ for learning native code reverse engineering.

163

learning-malware-analysis

This repository contains sample programs that mimick behavior found in real-world malware. The goal is to provide source code that can be compiled and used for learning purposes, without having to worry about handling live malware.

161

subparse

Modular malware analysis artifact collection and correlation framework