Analyzing OneNote Malware through Static and Dynamic Analysis: Detection and Mitigation Measures

OneNote is a widely used digital notebook application by individuals and organizations worldwide. In recent months, the attacker has used OneNote malware as a primary source to infect victim PCs. The research into OneNote malware detection and mitigation techniques is limited and needs to be addressed. This paper highlights the background of OneNote malware to be used in literature. The paper uses static and dynamic analysis techniques to investigate OneNote malware. Static analysis involves analyzing OneNote by using strings, Peframe, and Onedump.py whereas dynamic analysis involves monitoring OneNote’s behavior in a VM to detect and analyze any malicious activity using Process Hacker, Procmon, Fiddler, and Wireshark. Both these analyses support the creation of detection and mitigation strategies that are also provided and discussed in this paper.