debugactiveprocess/MaldocTrace
Malicious Office document analyzer for defenders, in Go. Emulates VBA and Excel 4.0 macros in a simulated sandbox, rebuilds stomped macros from p-code, detects Equation Editor, CVE-2017-0199 and CVE-2026-21509 exploits, and triages RTF, OneNote, emails and archives into a verdict and IOCs, without running the sample.
GitHub repository with 12 stars and 1 forks.
Language: Go
Topics: blue-team, cybersecurity, cybersecurity-tools, dfir, forensics-tools, golang, incident-response, maldoc, malware-analysis, malware-detection