<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>OneNote &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/onenote/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Wed, 24 May 2023 08:09:37 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>OneNote &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>Obfuscated Batch Scripts in OneNote Document</title>
		<link>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/</link>
					<comments>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 24 May 2023 08:09:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[OneNote]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2696</guid>

					<description><![CDATA[This malicious OneNote document contains two obfuscated batch scripts and we&#8217;ll be using our commercial Simple Batch Emulator package to understand what they do. SHA256: 46149F56028829246628FFAFC58DF81A4B0FF1C87ED6466492E25AD2F23C0A13 We open the first batch script and decode its data to text with the action &#8220;Conversion -> Bytes to text&#8221; (Ctrl+R). This is the batch script and as we &#8230; <a href="https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/" class="more-link">Continue reading<span class="screen-reader-text"> "Obfuscated Batch Scripts in OneNote Document"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2696</post-id>	</item>
		<item>
		<title>OneNote Malware With ISO File</title>
		<link>https://blog.cerbero.io/onenote-malware-with-iso-file/</link>
					<comments>https://blog.cerbero.io/onenote-malware-with-iso-file/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 09 May 2023 09:56:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[ISO]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2675</guid>

					<description><![CDATA[We recently stumbled upon this tweet by @Cryptolaemus1 about a malicious OneNote document with an embedded ISO file. Because of our recently released ISO Format package, we thought it would be interesting to analyze this malware sample with Cerbero Suite. SHA256: 2B0B2A15F00C6EED533C70E89001248A0F2BA6FAE5102E1443D7451A59023516 The unidentified embedded object in the OneNote document is an ISO file. We &#8230; <a href="https://blog.cerbero.io/onenote-malware-with-iso-file/" class="more-link">Continue reading<span class="screen-reader-text"> "OneNote Malware With ISO File"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/onenote-malware-with-iso-file/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2675</post-id>	</item>
		<item>
		<title>RedLine Stealer Dropper</title>
		<link>https://blog.cerbero.io/redline-stealer-dropper/</link>
					<comments>https://blog.cerbero.io/redline-stealer-dropper/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 07 Mar 2023 11:53:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[Dropper]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2542</guid>

					<description><![CDATA[An interesting sample containing a number of different obfuscation techniques. In this article we analyze the dropper in detail and reach the final stage. SHA256: 0B93B5287841CEF2C6B2F2C3221C59FFD61BF772CD0D8B2BDAB9DADEB570C7A6 The first file we encounter is a OneNote document. If the &#8220;OneNote Format&#8221; package is installed, all files are automatically extracted. Among the extracted files there are two unidentified &#8230; <a href="https://blog.cerbero.io/redline-stealer-dropper/" class="more-link">Continue reading<span class="screen-reader-text"> "RedLine Stealer Dropper"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/redline-stealer-dropper/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2542</post-id>	</item>
		<item>
		<title>Video: Blitz 45 Seconds OneNote Malware Analysis</title>
		<link>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/</link>
					<comments>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Fri, 03 Feb 2023 13:29:36 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[VBS]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2522</guid>

					<description><![CDATA[The malicious OneNote sample analyzed in this video contains an executable. The executable contains a CAB archive in a resource entry. The CAB archive contains a VBS script which can directly be inspected in Cerbero Suite. SHA256: F408EF3FA89546483BA63F58BE3F27A98795655EB4B9B6217CBE302A5BA9D5F7]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2522</post-id>	</item>
	</channel>
</rss>
