CyberHawk Threat Intel — IOC Scanner, Live IOC Feed (3.6M+ indicators),
Infostealer Intelligence, Threat Map, MISP Feeds, GitHub Arsenal, Courses and more.
Free to join.
Register Free →
Recently, I had to extract embedded files from a set of OneNote files (extension .one).
My onedump.py tool can extract individual files, so I would have to run this many times. To avoid this, I added a new feature to my onedump.py tool: producing JSON data. Several of my tools already have such a feature: they produce JSON data with the content of their analysis results.
onedump's option --jsonoutput produces JSON output with the content of each embedded file found inside the OneNote file. And it can do this for many .one files in one go:
onedump.py --jsonoutput *.one
To write these files to disk you can use my myjson-filter.py tool, like this:
onedump.py --jsonoutput *.one | myjson-filter.py -W hashvir
This will write all the embedded files to disk, their name will be the sha256 hash of their content plus extension .vir (hashvir).
Didier Stevens
Senior handler
blog.DidierStevens.com
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Accelerate Your Security Operations
CyberHawk Threat Intel is a complete Cyber Intelligence Platform — one place for every tool
a security professional needs. Built by
Rudra Verma,
Senior Security Architect and Researcher, CyberHawk Consultancy.
IOC Scanner — scan any domain, IP, hash, URL
Live IOC Feed — 3.6M+ indicators, filterable
Infostealer Intelligence — live compromised creds
Live Threat Map — real-time global attack vectors
MISP Threat Feeds — CIRCL, Feodo, Botvrij, more
GitHub Arsenal — curated security tools and scripts
Security Blog — CVE advisories and threat research
Video Courses — cybersecurity training and education
SOPs and Playbooks — SecOps procedures
Analyst Library — references and toolkits
Scan Reports — historical threat intelligence
Cyber News — this feed, aggregated in-platform
