# decalage2/ViperMonkey

A VBA parser and emulation engine to analyze malicious macros.

Repository: https://github.com/decalage2/ViperMonkey
Canonical: https://ross.abutalabs.com/products/vipermonkey
Language: Python
License Family: other
Topics: vba, emulation, malware-analysis, python, security, macros, parser, pyparsing
Last push: 2024-07-10T06:28:56+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3629, "days_push": 784, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1124, forks 188 (observed 2026-08-28T04:03:40.836328+00:00)

## What it is
ViperMonkey is a VBA parser and emulation engine written in Python for analyzing and deobfuscating malicious macros in Microsoft Office documents. It emulates VBA code execution to reveal the behavior of maldocs without running them in a live Office environment.

## Use cases
- analyze malicious VBA macros in Word documents
- deobfuscate obfuscated Office macros
- extract URLs and payloads from maldocs
- emulate VBA code safely without running Office
- triage suspicious email attachments
- automate macro malware analysis in a sandbox

## When to choose
- you need to understand what a malicious Office macro does without executing it
- you want automated, scriptable VBA emulation for malware triage pipelines
- you need to deobfuscate heavily obfuscated VBA strings and logic

## When to avoid
- you need fast, real-time scanning of large document volumes
- the macro relies on complex Office application features or DLL/ActiveX calls that emulation does not support
- you need a production-grade, commercially supported analysis tool

## Facets
- artifact type: library
- maturity: maintenance
- function: parser, security, reverse-engineering, interpreter
- domain: security, developer-tools, files
- platform: python, windows, cli
- tags: vba, macro-analysis, malware-analysis, emulation, maldoc, office-files, deobfuscation, linux, macos, docker

## Member repositories
- decalage2/ViperMonkey (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:40.836328+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:39:38.408855+00:00, confidence not recorded.
  - readme: https://github.com/decalage2/ViperMonkey (fetched 2026-08-28T04:03:40.836328+00:00, sha a67db518e9e7)
- Data as of 2026-08-30T08:39:29.467469+00:00.