Tools: re-search.py, base64dump.py

Sample: 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745

Tools: xor-kpa.py

Tools: pecheck.py, zipdump.py, strings.py

Sample: 84c82835a5d21bbcf75a61706d8ab549

Blog post: Malicious Documents: The Matryoshka Edition

Tools: pdf tools, oledump.py, re-search.py

Sample: 98a727a32fee7115d9599b4df9b6b433

Blog post: Bash Bunny PDF Dropper

Tools: make-pdf tools

Tools: rtfdump, oledump

Metasploit module: nixawk

Tools: rtfdump, oledump