graph-maldoc-similar-images | extracts embedded images from Office Open XML

graph-maldoc-similar-images is a Python library. graph-maldoc-similar-images has no bugs, it has no vulnerabilities and it has low support. However graph-maldoc-similar-images build file is not available. You can download it from GitHub.

A script that extracts embedded images from Office Open XML (OOXML) documents and generates image hash similarity graphs that cluster visually similar images together. The script computes the Average Hash of each extracted image, then graphs the images if they meet the similarity threshold. The script can be used as a technique for visually identifying malware campaigns involving documents. To use the script, supply a directory containing OOXML files. If LibreOffice is in your PATH you can optionally convert non-OOXML Word, Excel, PowerPoint and Rich Text File documents to OOXML. The script outputs DOT files that can be exported as images using Graphviz. If Graphviz is in your PATH you can also export to an SVG (preferred) or PNG image.