Analysis and Correlation of Visual Evidence in Campaigns of Malicious Office Documents

Abstract

Many malware campaigns use Microsoft (MS) Office documents as droppers to download and execute their malicious payload. Such campaigns often use these documents because MS Office is installed in billions of devices and that these files allow the execution of arbitrary VBA code. Recent versions of MS Office prevent the automatic execution of VBA macros, so malware authors try to convince users into enabling the content via images that, e.g. forge system or technical errors.In this work, we leverage these visual elements to construct lightweight malware signatures that can be applied with minimal effort. We test and validate our approach using an extensive database of malware samples and identify correlations between different campaigns that illustrate that some campaigns are either using the same tools or that there is some collaboration between them.

Malware Threat Affecting Financial Organization Analysis Using Machine Learning Approach

“…The aim of this paper is to look at how similar the behaviours of this particular set of malware (Casino et al, 2021) are, despite the fact that they all have distinct and somewhat unknown roots. This higher-level abstraction of malware functionality is represented by the automated categorization of the behaviours present in a malware illustration.…”

The Professionalization of the Hacker Industry

“…As the hacker industry becomes more fully professionalized, it is becoming much more adaptive and flexible, making it harder for intelligence and law enforcement to confront. Hacking organizations such as Russia's Strontium (also commonly known as APT28 or Fancy Bear) 9 and China's APT31 (or Zirconium) 10 continue to perform malicious attacks against IoT devices. As with other kinds of illicit industries that have professionalized -drug dealing and human trafficking, for instance -hacking is and will increasingly be dominated by sophisticated actors who understand themselves as 'businessmen', and who regard law enforcement less as a deterrent than as a regulatory force, that is, as a cost of doing business.…”

“…Some MaaS sites have become so easy to use customers can use simple Web forms to indicate, for example, which site they wish run a denial-of-service (DoS) attack against, or how many spam emails they wish to send [21]. As security researchers have noted malware authors rent or pass the control of the compromised devices to their peers [9]. Moreover, for many malware families, the attribution of malware to an actor is not straightforward, and due to the malware evolution and code exchange in groups, it becomes a very challenging task.…”