Pandora is an analysis framework to discover if a file is suspicious
github.com
github.com
But what does it do exactly?
The readme contains a lot of install instructions but very little explanation what the purpose of the tool actually is. It uses libreoffice.. so... office documents that are.. suspicious? Whatever that means.
If you head over to the public instance, you discover a file upload and nothing else. "Drop suspicious file here".. okay?
Then there's a button labelled "advanced" which shows toggles for different modules. These do provide a tiny bit of insight regarding the purpose of the tool but it's still very much unclear.
This is sad because I'm sure it's a great project. I just have absolutely no clue what it does.
Would it be possible to extend the readme with a "Why would I use this?" section explaining the purpose of the tool with some basic example use-cases?
You will need to be subscribed to those services that are not free and have API keys for each one.
There are some modules that also analyse the MSOffice XML format for bad code, that check OLE (don't know what is OLE? https://threatpost.com/like-macros-before-it-attackers-shift...) and macro deobfuscators.
CIRCL is the Luxembourg CERT, more or less.
... _if_ I understood its purpose correctly that is.