OneNote Malware Trends - Analyzing Emotet Abuse

The OneNote abuse continues! In this video, we'll look at the recent wave of OneNote malware trends being utilized by Emotet - one of the most prolific malware distributors out there. We'll use Onedump by Didier Stevens to investigate the document, extract the primary script and deobfucate the code.

Sample SHA256: ce6af4e3a1ccade377d8decce80e5b11468a98948387b74f2d3dee162050c355

00:00 Introduction
00:17 Too Long, Didn't Watch (TLDW)
00:55 Starting Analysis with OneNote Structure
02:16 Dumping the VBScript
04:19 Finding the String Obfuscation
05:25 Deobfuscating Strings
05:58 Identifying …

abuse analysis code didier didier stevens document dumping emotet extract introduction malware onenote script sha256 trends vbscript video watch