n3l5’s gists

n3l5 / malbazaar_query.ps1

Created May 3, 2021 20:14

PowerShell script to query AbuseCH Malware Bazaar for a give hash or file(path).

	[CmdletBinding()]
	param (
	[Parameter(Mandatory=$False)]
	[string]$FileHash,

	[Parameter(Mandatory=$False)]
	[String]$FilePath
	)

	#Set up proxy auth

n3l5 / malbazaar_query.py

Created May 3, 2021 20:12

Python script to query AbuseCH Malware Bazaar for a give hash or file(path).

	import argparse
	import pathlib
	from pathlib import Path
	import hashlib
	import magic
	import pefile
	import re
	import requests

	parser = argparse.ArgumentParser(description='Query sample information by Hash or File.')

n3l5 / viper_upload.py

Created December 20, 2020 02:07

Custom script to upload malware sample(s) to a Viper instance with the web API. (mostly useful for bulk uploads) Will tag the sample (if PE) with the imphash, which makes it searchable.

	import sys
	import os
	from os import listdir
	from os.path import isfile, join
	import hashlib
	import magic
	import re
	import pefile
	import requests

n3l5 / MISP-upload-custom.py

Created December 20, 2020 01:53

Custom MISP upload script to add a file(s) as a new event and add as objects; add the file object and the pe info. (but no sections data); additonally will tag it. **heavily borrowed code from the upload.py in the PyMISP samples.

	#!/usr/bin/env python
	# -- coding: utf-8 --
	from pymisp import ExpandedPyMISP, MISPEvent, MISPAttribute, MISPObject, MISPT
	from pymisp import PyMISP
	from pymisp.tools import make_binary_objects
	from keys import misp_url, misp_key, misp_verifycert
	from pathlib import Path
	import hashlib
	import magic
	import re

n3l5 / disable_ddeauto.reg

Created October 24, 2017 15:16

Disable DDEAUTO for Outlook, Word, and Excel versions 2010, 2013, 2016 (excluding OneNote)

	Windows Registry Editor Version 5.00

	[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Options]
	"DontUpdateLinks"=dword:00000001

	[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Options]
	"DontUpdateLinks"=dword:00000001

	[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options]
	"DontUpdateLinks"=dword:00000001

n3l5 / symSubmit.py

Last active November 11, 2016 17:57

SymSubmit is used to submit a specific .zip file containing suspected malware to Symantec Security Response. Test on Linux only...,change hard coded fields. Utilize it to "programmatically" submit files. Requires selenium, pyvirtualdisplay, chrome webdriver. If you want to submit silently change it to "Display(visable=0, ....."

	import time
	from pyvirtualdisplay import Display
	from selenium import webdriver
	from selenium.common.exceptions import TimeoutException
	from selenium.webdriver.support.ui import WebDriverWait
	from selenium.webdriver.support import expected_conditions as EC
	display = Display(visible=1,size=(800, 600))
	display.start()
	driver = webdriver.Chrome()
	driver.get("https://submit.symantec.com/websubmit/platinum.cgi")

n3l5 / keybase.md

Created October 4, 2014 03:07

Keybase proof

I hereby claim:

I am n3l5 on github.
I am mattnels (https://keybase.io/mattnels) on keybase.
I have a public key whose fingerprint is 22C0 6D32 A202 FAAF 2D7B EA29 92A6 D630 D2E4 7024

To claim this, I am signing this object: