agentsclimarketplace

Analyzing malicious onenote and html smuggling

Skill meltedinhex/analyst-ai-pack/skills/analyzing-malicious-onenote-and-html-smuggling

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-onenote-and-html-smuggling

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes two modern delivery techniques: malicious OneNote (.one) attachments with embedded payloads behind fake buttons, and HTML smuggling pages that reconstruct payloads in the browser from embedded blobs. Activates for requests to analyze a malicious OneNote file, detect HTML smuggling, or extract a smuggled/embedded payload.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.1 KB, as published. Nobody here has run it

Analyzing Malicious OneNote and HTML Smuggling

When to Use

  • You have a OneNote (.one) attachment suspected of hiding an embedded executable/script behind a "click to view" lure.
  • You have an HTML/SVG page that reconstructs and auto-downloads a payload from an embedded blob (HTML smuggling).
  • You need to extract the hidden payload without triggering the lure.

Do not use OneNote or a browser to open these files for analysis — that is exactly the delivery mechanism. Carve the embedded data statically.

Prerequisites

  • A static carver (Python) for embedded file signatures; the sample handled inertly.

Safety & Handling

  • Never open the .one in OneNote or the HTML in a browser.
  • Defang URLs and store carved payloads password-protected.

Workflow

Step 1: For OneNote — carve embedded files

OneNote stores attached files in the document. Scan for embedded file signatures (MZ, script headers, archives) and the FileDataStoreObject GUIDs, and carve them out.

python scripts/analyst.py carve sample.one

Step 2: For HTML smuggling — find the embedded blob

Look for large base64/Blob/Uint8Array constructions, data: URIs, and a JS routine that builds a Blob and triggers a download (msSaveOrOpenBlob, anchor download, createObjectURL).

Step 3: Reconstruct the payload statically

Decode the embedded base64/byte array (and any XOR/char-code layer) to recover the payload as data — without executing the page.

Step 4: Analyze and extract IOCs

Hash carved payloads, identify their type, defang any URLs, and route executables/scripts to the appropriate analysis workflow.

Validation

  • Embedded payloads are carved/reconstructed from the inert file, not by opening it.
  • The recovered payload's type is identified and hashed.
  • The lure/trigger mechanism (fake button, Blob download) is documented.

Pitfalls

  • Opening the OneNote/HTML to "see" the lure and executing the payload.
  • Decoding only the first layer when the blob is additionally XOR/char-code encoded.
  • Missing multiple embedded objects in a single OneNote page.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.