Repository Index

PyInstaller Extractor

• python
• pyinstaller
• decompile
• reverse-engineering

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

• malware
• deobfuscation
• strings
• flare

Malware Configuration And Payload Extraction

• configs
• debugging-tools
• malware
• malware-analysis

This is the development tree. Production downloads are at:

🔐 A CLI tool to extract server certificates

• certificate
• ssl
• x509
• tls

Extract and aggregate threat intelligence.

• ioc
• indicators-of-compromise
• threatintel
• threat-intelligence

Defanged Indicator of Compromise (IOC) Extractor.

• ioc
• indicators-of-compromise
• library
• ioc-extractor

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

• malware-samples
• wscript
• deobfuscation
• angler

A framework for automated extraction of static and dynamic features from Android applications

• android-malware-detection
• android-analysis

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

$MFT directory tree reconstruction & FILE record info

• mft-browser
• mft
• powershell
• winform

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

• forensics
• hypervisor
• memory-dump
• reverse-engineering

'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files

Open source Windows x64 PE packer and crypter. Compresses and encrypts executables with a custom virtual machine into a self extracting stub.

• compression
• packer
• pe-packer
• pe-compress

Scalable Binary Data Extraction in Hadoop

Detect hidden files and text in images

• steganography
• ctf
• stego
• capture-the-flag

Extract the information needed from the Manifest.plist files to convert it to hashes compatible with hashcat

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

AI-powered platform for OSINT intelligence analysis. Features archive discovery with hypothesis-driven investigation, GLiNER entity extraction, Mapbox geospatial visualization, network analysis, and document processing. Built with FastAPI, Next.js, Weaviate, and DSPy.

• ai-agents
• document-processing
• dspy
• entity-extraction

GxPDF - Enterprise-grade PDF library for Go. Table extraction, text parsing, encryption, document creation.

• go
• golang
• open-source
• pdf

go-fasttld is a high performance effective top level domains (eTLD) extraction module.

• compressed-trie
• idn
• idna
• ipv4