Jason

Could you please consider adding malchive? Thanks :) https://github.com/MITRECND/malchive

Detection failure of embedded RAR files created with RAR 5.0 archive format

1

Hello, It seems that I cannot successfully detect embedded RAR files created using the RAR 5.0 archiver version. After a brief review of rar.py, I believe this is because of...

Newer versions of oletools contain an rtfobj API implementation that was incompatible with the previous implementation from FSF. The crux of the issue being the new value added here: `for...

Hello, Microsoft has introduced the attribute [CETCOMPAT](https://docs.microsoft.com/en-us/cpp/build/reference/cetcompat?view=msvc-160&viewFallbackFrom=vs-2019) to mark compatibility with [Shadow Stack](https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf) (page 10 if interested). Traditionally one would expect this to be captured in `DllCharacteristics`, but I believe...