decalage2/ViperMonkey

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1124 stars · 188 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ViperMonkey is a VBA parser and emulation engine written in Python for analyzing and deobfuscating malicious macros in Microsoft Office documents. It emulates VBA code execution to reveal the behavior of maldocs without running them in a live Office environment.

Use cases

• analyze malicious VBA macros in Word documents
• deobfuscate obfuscated Office macros
• extract URLs and payloads from maldocs
• emulate VBA code safely without running Office
• triage suspicious email attachments
• automate macro malware analysis in a sandbox

When to choose

• you need to understand what a malicious Office macro does without executing it
• you want automated, scriptable VBA emulation for malware triage pipelines
• you need to deobfuscate heavily obfuscated VBA strings and logic

When to avoid

• you need fast, real-time scanning of large document volumes
• the macro relies on complex Office application features or DLL/ActiveX calls that emulation does not support
• you need a production-grade, commercially supported analysis tool

Facets

library · maturity maintenance

parser security reverse-engineering interpreter security developer-tools files python windows cli vba macro-analysis malware-analysis emulation maldoc office-files deobfuscation linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="decalage2/ViperMonkey")