analyzing-malicious-onenote-and-html-smuggling

Name: analyzing-malicious-onenote-and-html-smuggling
Author: meltedinhex

18stars5forks

How to install analyzing-malicious-onenote-and-html-smuggling?

meltedinhex/analyst-ai-pack/analyzing-malicious-onenote-and-html-smuggling

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-onenote-and-html-smuggling

Installs into the current project.

Summary

Analyzes two modern delivery techniques: malicious OneNote (.one) attachments with

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious OneNote and HTML Smuggling
2
3	## When to Use
4
5	- You have a OneNote (`.one`) attachment suspected of hiding an embedded executable/script behind a
6	"click to view" lure.
7	- You have an HTML/SVG page that reconstructs and auto-downloads a payload from an embedded blob
8	(HTML smuggling).
9	- You need to extract the hidden payload without triggering the lure.
10
11	Do not use OneNote or a browser to open these files for analysis — that is exactly the
12	delivery mechanism. Carve the embedded data statically.
13
14	## Prerequisites
15
16	- A static carver (Python) for embedded file signatures; the sample handled inertly.
17
18	## Safety & Handling
19
20	- Never open the `.one` in OneNote or the HTML in a browser.
21	- Defang URLs and store carved payloads password-protected.
22
23	## Workflow
24
25	### Step 1: For OneNote — carve embedded files
26
27	OneNote stores attached files in the document. Scan for embedded file signatures (`MZ`, script
28	headers, archives) and the `FileDataStoreObject` GUIDs, and carve them out.
29
30	```bash
31	python scripts/analyst.py carve sample.one
32	```
33
34	### Step 2: For HTML smuggling — find the embedded blob
35
36	Look for large base64/`Blob`/`Uint8Array` constructions, `data:` URIs, and a JS routine that
37	builds a Blob and triggers a download (`msSaveOrOpenBlob`, anchor `download`, `createObjectURL`).
38
39	### Step 3: Reconstruct the payload statically
40
41	Decode the embedded base64/byte array (and any XOR/char-code layer) to recover the payload as
42	data — without executing the page.
43
44	### Step 4: Analyze and extract IOCs
45
46	Hash carved payloads, identify their type, defang any URLs, and route executables/scripts to the
47	appropriate analysis workflow.
48
49	## Validation
50
51	- Embedded payloads are carved/reconstructed from the inert file, not by opening it.
52	- The recovered payload's type is identified and hashed.
53	- The lure/trigger mechanism (fake button, Blob download) is documented.
54
55	## Pitfalls
56
57	- Opening the OneNote/HTML to "see" the lure and executing the payload.
58	- Decoding only the first layer when the blob is additionally XOR/char-code encoded.
59	- Missing multiple embedded objects in a single OneNote page.
60
61	## References
62
63	- See [`references/api-reference.md`](references/api-reference.md) for the carver/decoder.
64	- ATT&CK T1027.006 and MS-ONESTORE (linked in frontmatter).

People who liked this also viewed

6 picks

Type

analyzing-malicious-onenote-and-html-smuggling

18stars5forks

View on GitHub

How to install analyzing-malicious-onenote-and-html-smuggling?

meltedinhex/analyst-ai-pack/analyzing-malicious-onenote-and-html-smuggling

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-onenote-and-html-smuggling

Installs into the current project.

Summary

Analyzes two modern delivery techniques: malicious OneNote (.one) attachments with

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious OneNote and HTML Smuggling
2
3	## When to Use
4
5	- You have a OneNote (`.one`) attachment suspected of hiding an embedded executable/script behind a
6	"click to view" lure.
7	- You have an HTML/SVG page that reconstructs and auto-downloads a payload from an embedded blob
8	(HTML smuggling).
9	- You need to extract the hidden payload without triggering the lure.
10
11	Do not use OneNote or a browser to open these files for analysis — that is exactly the
12	delivery mechanism. Carve the embedded data statically.
13
14	## Prerequisites
15
16	- A static carver (Python) for embedded file signatures; the sample handled inertly.
17
18	## Safety & Handling
19
20	- Never open the `.one` in OneNote or the HTML in a browser.
21	- Defang URLs and store carved payloads password-protected.
22
23	## Workflow
24
25	### Step 1: For OneNote — carve embedded files
26
27	OneNote stores attached files in the document. Scan for embedded file signatures (`MZ`, script
28	headers, archives) and the `FileDataStoreObject` GUIDs, and carve them out.
29
30	```bash
31	python scripts/analyst.py carve sample.one
32	```
33
34	### Step 2: For HTML smuggling — find the embedded blob
35
36	Look for large base64/`Blob`/`Uint8Array` constructions, `data:` URIs, and a JS routine that
37	builds a Blob and triggers a download (`msSaveOrOpenBlob`, anchor `download`, `createObjectURL`).
38
39	### Step 3: Reconstruct the payload statically
40
41	Decode the embedded base64/byte array (and any XOR/char-code layer) to recover the payload as
42	data — without executing the page.
43
44	### Step 4: Analyze and extract IOCs
45
46	Hash carved payloads, identify their type, defang any URLs, and route executables/scripts to the
47	appropriate analysis workflow.
48
49	## Validation
50
51	- Embedded payloads are carved/reconstructed from the inert file, not by opening it.
52	- The recovered payload's type is identified and hashed.
53	- The lure/trigger mechanism (fake button, Blob download) is documented.
54
55	## Pitfalls
56
57	- Opening the OneNote/HTML to "see" the lure and executing the payload.
58	- Decoding only the first layer when the blob is additionally XOR/char-code encoded.
59	- Missing multiple embedded objects in a single OneNote page.
60
61	## References
62
63	- See [`references/api-reference.md`](references/api-reference.md) for the carver/decoder.
64	- ATT&CK T1027.006 and MS-ONESTORE (linked in frontmatter).

People who liked this also viewed

6 picks

Type