<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Email-Based Malware

## olevba — Office Macro Analysis
```bash
olevba document.docx
olevba --json document.docx
olevba --decode document.docx
```

## file / strings — File Triage
```bash
file suspicious_attachment
strings -n 8 suspicious_attachment | grep -iE 'http|shell|cmd'
sha256sum suspicious_attachment
```

## yara — Pattern Matching
```bash
yara -r malware_rules.yar /path/to/attachments/
```

## clamscan — AV Scanning
```bash
clamscan -r /path/to/attachments/
freshclam
```
