CanaryTokenScanner

CanaryTokenScanner is a static analysis tool designed to detect embedded suspicious URLs, including CanaryTokens and HoneyTokens, within Microsoft Office documents, PDFs, and ZIP files. It efficiently performs in-memory scans without requiring the documents to be opened or making network requests, and it features improved performance and reduced false positives by ignoring common schema domains. The tool outputs findings directly, indicating whether a file contains potentially malicious URLs.