OneNote Malware Trends - Password Protected Documents

The abuse of Onenote documents continues and in a very unsurprising twist, the use of password protected Onenote documents has emerged. While not a novel technique, this provided the opportunity to discuss how password-protected documents impacts analysis and allows me to use the tool OneNoteAnalyzer. This will be part 1 of a 2 part series in which we'll analyze the Onenote document in this video, then look at working with memory dumps in the next video to extract the unpacked …

abuse analysis bazaar discuss document documents extract malware memory novel onenote opportunity password redline redline stealer series sha256 stealer tool trends video working