OneNote extraction update helps analysts process embedded files in batches
Didier Stevens has added JSON output to onedump.py, allowing analysts to process embedded files from multiple OneNote documents more efficiently.
Didier Stevens has added JSON output to onedump.py to make extracting embedded files from OneNote documents more convenient. His SANS Internet Storm Center diary describes the change as a response to needing to process a set of OneNote files.
Previously, his workflow extracted individual embedded files with repeated tool runs. The new output contains the embedded files found in the input documents and can process multiple OneNote files in a single run.
The resulting JSON can be passed to myjson-filter.py, another tool in Stevens' collection, to write the extracted objects to disk. The documented naming option uses a file's SHA-256 hash with a .vir extension.
The diary links the tools and an overview of other utilities that exchange JSON analysis data. This makes the new feature part of an existing tool workflow rather than a separate application. The author's documentation provides the command examples and available output options.
Sources
- OneNote File Extraction, (Sun, Nov 1st)Supportingisc.sans.edu
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning