Skip to content

Instantly share code, notes, and snippets.

View n3l5's full-sized avatar

n3l5

39 followers · 27 following
View GitHub Profile
@n3l5
n3l5 / malbazaar_query.ps1
Created May 3, 2021 20:14
PowerShell script to query AbuseCH Malware Bazaar for a give hash or file(path).
[CmdletBinding()]
param (
[Parameter(Mandatory=$False)]
[string]$FileHash,
[Parameter(Mandatory=$False)]
[String]$FilePath
)
#Set up proxy auth
@n3l5
n3l5 / malbazaar_query.py
Created May 3, 2021 20:12
Python script to query AbuseCH Malware Bazaar for a give hash or file(path).
import argparse
import pathlib
from pathlib import Path
import hashlib
import magic
import pefile
import re
import requests
parser = argparse.ArgumentParser(description='Query sample information by Hash or File.')
@n3l5
n3l5 / viper_upload.py
Created December 20, 2020 02:07
Custom script to upload malware sample(s) to a Viper instance with the web API. (mostly useful for bulk uploads) Will tag the sample (if PE) with the imphash, which makes it searchable.
import sys
import os
from os import listdir
from os.path import isfile, join
import hashlib
import magic
import re
import pefile
import requests
@n3l5
n3l5 / MISP-upload-custom.py
Created December 20, 2020 01:53
Custom MISP upload script to add a file(s) as a new event and add as objects; add the file object and the pe info. (but no sections data); additonally will tag it. **heavily borrowed code from the upload.py in the PyMISP samples.
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pymisp import ExpandedPyMISP, MISPEvent, MISPAttribute, MISPObject, MISPT
from pymisp import PyMISP
from pymisp.tools import make_binary_objects
from keys import misp_url, misp_key, misp_verifycert
from pathlib import Path
import hashlib
import magic
import re
@n3l5
n3l5 / disable_ddeauto.reg
Created October 24, 2017 15:16
Disable DDEAUTO for Outlook, Word, and Excel versions 2010, 2013, 2016 (excluding OneNote)
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Options]
"DontUpdateLinks"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Options]
"DontUpdateLinks"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options]
"DontUpdateLinks"=dword:00000001
@n3l5
n3l5 / symSubmit.py
Last active November 11, 2016 17:57
SymSubmit is used to submit a specific .zip file containing suspected malware to Symantec Security Response. Test on Linux only...,change hard coded fields. Utilize it to "programmatically" submit files. Requires selenium, pyvirtualdisplay, chrome webdriver. If you want to submit silently change it to "Display(visable=0, ....."
import time
from pyvirtualdisplay import Display
from selenium import webdriver
from selenium.common.exceptions import TimeoutException
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
display = Display(visible=1,size=(800, 600))
display.start()
driver = webdriver.Chrome()
driver.get("https://submit.symantec.com/websubmit/platinum.cgi")
@n3l5
n3l5 / keybase.md
Created October 4, 2014 03:07

Keybase proof

I hereby claim:

  • I am n3l5 on github.
  • I am mattnels (https://keybase.io/mattnels) on keybase.
  • I have a public key whose fingerprint is 22C0 6D32 A202 FAAF 2D7B EA29 92A6 D630 D2E4 7024

To claim this, I am signing this object: