Dalvik opcodes

http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html

VBA Stomping - Advanced Maldoc Techniques

https://medium.com/walmartlabs/vba-stomping-advanced-maldoc-techniques-612c484ab278

Ghidra Extension to integrate BinDiff for function matching

https://github.com/ubfx/BinDiffHelper

DynamoRIO

DynamoRIO is a runtime code manipulation system that supports code transformations on any part of a program, while it executes. DynamoRIO exports an interface for building dynamic tools for a wide variety of uses: program analysis and understanding, profiling, instrumentation, optimization, translation, etc.

https://github.com/DynamoRIO/dynamorio

emerald
Import DynamoRIO drcov code coverage data into Ghidra

https://github.com/reb311ion/emerald

sysmon-modular

a sysmon configuration repository for everybody to customise

https://github.com/olafhartong/sysmon-modular

sysmon-config

a sysmon configuration file for everybody to fork

https://github.com/SwiftOnSecurity/sysmon-config

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

https://github.com/yampelo/beagle

capa detects capabilities in executable files. You run it against a PE file or shellcode and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

https://github.com/fireeye/capa

Take a look into the depths of
Windows kernels and
reveal more than 60000
undocumented structures

https://www.vergiliusproject.com/

PE Tree
Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro to dump in-memory PE files and reconstruct imports.

https://github.com/blackberry/pe_tree

Latest malware news and threat information exchange forum. Malware analysis, indicators, reports and educational resources.

https://malware.news/

Threat Research
Reversing Malware Command and Control: From Sockets to COM

https://www.fireeye.com/blog/threat-research/2010/08/reversing-malware-command-control-sockets.html

New Ursnif Variant Spreading by Word Document

https://www.fortinet.com/blog/threat-research/ursnif-variant-spreading-word-document

Hunting COM Objects

https://malware.news/t/hunting-com-objects/30207

Observing COM within Malicious Code

https://blog.malwarebytes.com/threat-analysis/2014/02/observing-com-within-malicious-code/