Invoice #31415 attached: Automated analysis of malicious Microsoft Office documents

• DOI: 10.1016/j.cose.2021.102582
• Publication Date: 2021-12-21T07:06:03Z
• Authors: Vasilios Koutsoko...; Nikolaos Lykousas; Theodoros Apostol...; Gabriele Orazi; Amrita Ghosal; Fran Casino; Mauro Conti; Constantinos Pats...
• Keywords: Leverage (statistics); Invoice; Popularity

Microsoft Office may be by far the most widely used suite for processing documents, spreadsheets, and presentations. Due to its popularity, it is continuously utilised carry out malicious campaigns. Threat actors, exploiting platform's dynamic features, use launch their attacks penetrate millions of hosts in This work explores modern landscape exposing means that malware authors use. We leverage a taxonomy tools weaponise documents explore modus operandi actors. Moreover, we generated publicly shared specially crafted dataset, which relies on incorporating benign containing many features such as VBA macros DDE. The latter crucial fair realistic analysis, an open issue current state art. allows us draw safe conclusions behaviour. More precisely, extract necessary with automated analysis pipeline efficiently accurately classify document or using machine learning F1 score above 0.98, outperforming art detection algorithms.