The Great OneNote Scramble of 2023

Assemblyline Blog Entry #8

⚠️⚠️⚠️ CAUTION ⚠️⚠️⚠️

This document describes malware analysis in Assemblyline. Malware analysis must be performed in an isolated environment.

In the previous blog post “What other security products WON’T tell you about malicious archives”, we discussed how a malware campaign centred around archives seen in 2022 triggered large improvements to Assemblyline and CAPE Sandbox.

This article will illustrate another, more recent, campaign in 2023 that focused on …

analysis assemblyline attack attack chain batch disk dll dll file download embedded export file function html malware analysis next obfuscated onenote payload run stage