Analyzing Malicious OneNote Documents

About a week ago, I was asked if I had tools for OneNote files.

I don’t, and I had no time to take a closer look.

But last Thursday night, I had some time to take a look. I looked at this OneNote maldoc sample.

I opened the file in the binary editor I use often (010 Editor):

I expected to see some magic header, a special sequence of byte that would tell me which file type …

binary documents don editor file files header magic maldoc malicious malware analysis onenote special tools