---
title: Tip: bulk-extract every embedded file from a pile of OneNote (.one) lures with onedump.py --jsonoutput | ctxsec
url: https://ctxsec.com/items/tip-onedump-jsonoutput-bulk-extract-onenote-embedded-files
description: ""
status: "official (SANS ISC diary by Didier Stevens, Nov 1)"
published: 2026-11-01
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-onedump-jsonoutput-bulk-extract-onenote-embedded-files.md)

official (SANS ISC diary by Didier Stevens, Nov 1)

2026-11-01

### Tip: bulk-extract every embedded file from a pile of OneNote (.one) lures with onedump.py --jsonoutput

Didier Stevens added a JSON output mode to his **onedump.py** tool, so you no longer have to run it once per embedded file when triaging OneNote attachments. Run `onedump.py --jsonoutput *.one` to analyze many .one files in one go, and pipe it into `myjson-filter.py -W hashvir` to write every embedded file to disk named by the SHA-256 of its content plus `.vir`.

**Why it helps:** the hash-based names dedupe identical payloads across a campaign and give you hashes ready to search in your EDR or threat-intel platform. Do this in an isolated analysis VM, since the extracted files are live malware.

Sources: [SANS ISC diary: OneNote File Extraction (Nov 1)](https://isc.sans.edu/diary/33478)