A Static Multi-Class Malicious Office Document Detection Method Via Multi-Feature Fusion

Microsoft Office documents have become hackers' preferred tool to construct malicious documents. However, current research on detecting malicious Office documents has not covered all document formats and various types of malicious attacks. To address this issue, this paper proposes a Static Multi-class Malicious Office document Detection Method (SM
²
0DM) for multiple versions of Office documents. The focus of this research is to design a unified static feature representation method for multiple versions of Office documents via multi-feature fusion, including VBA (Visual Basic for Applications) code keywords, DDE (Dynamic Data Exchange) instructions, embedded files, OLE (Object Linking and Embedding) objects, external links, and other relevant features. In addition, this research identifies eight new types of malicious features and embedding locations. Then, this paper proposes a multi-class detection method for malicious Office documents that can detect five common types of malicious documents. Through analyzing 20,000 samples provided by Topsec Technologies Group, the proposed SM
²
ODM achieves high accuracy in multi-classification detection and identifies 185 malicious Office samples that common antivirus software failed to detect.