Author, as appears in the article.: Koutsokostas, V; Lykousas, N; Apostolopoulos, T; Orazi, G; Ghosal, A; Casino, F; Conti, M; Patsakis, C
Department: Enginyeria Informàtica i Matemàtiques
URV's Author/s: Casino Cembellín, Francisco José
Keywords: Lolbas Macro malware Malware Office documents Powershell
Abstract: Microsoft Office may be by far the most widely used suite for processing documents, spreadsheets, and presentations. Due to its popularity, it is continuously utilised to carry out malicious campaigns. Threat actors, exploiting the platform's dynamic features, use it to launch their attacks and penetrate millions of hosts in their campaigns.This work explores the modern landscape of malicious Microsoft Office documents, exposing the means that malware authors use. We leverage a taxonomy of the tools used to weaponise Microsoft Office documents and explore the modus operandi of malicious actors. Moreover, we generated and publicly shared a specially crafted dataset, which relies on incorporating benign and malicious documents containing many dynamic features such as VBA macros and DDE. The latter is crucial for a fair and realistic analysis, an open issue in the current state of the art. This allows us to draw safe conclusions on the malicious features and behaviour. More precisely, we extract the necessary features with an automated analysis pipeline to efficiently and accurately classify a document as benign or malicious using machine learning with an F-1 score above 0.98, outperforming the current state of the art detection algorithms. (C) 2021 The Authors. Published by Elsevier Ltd.
Thematic Areas: Administração pública e de empresas, ciências contábeis e turismo Ciência da computação Ciências agrárias i Ciencias sociales Computer science (all) Computer science (miscellaneous) Computer science, information systems Engenharias iv General computer science Law
licence for use: https://creativecommons.org/licenses/by/3.0/es/
Author's mail: franciscojose.casino@urv.cat
Author identifier: 0000-0003-4296-2876
Record's date: 2024-10-12
Papper version: info:eu-repo/semantics/publishedVersion
Link to the original source: https://www.sciencedirect.com/science/article/pii/S0167404821004053?via%3Dihub
Papper original source: Computers & Security. 114
APA: Koutsokostas, V; Lykousas, N; Apostolopoulos, T; Orazi, G; Ghosal, A; Casino, F; Conti, M; Patsakis, C (2022). Invoice #31415 attached: Automated analysis of malicious Microsoft Office documents. Computers & Security, 114(), -. DOI: 10.1016/j.cose.2021.102582
Licence document URL: https://repositori.urv.cat/ca/proteccio-de-dades/
Article's DOI: 10.1016/j.cose.2021.102582
Entity: Universitat Rovira i Virgili
Journal publication year: 2022
Publication Type: Journal Publications