Since their appearance in 1994 in the Concept virus, VBA macros remain a preferred choice for malware authors. There are two main attack techniques when it comes to document-based malware: exploits and VBA macros, with the latter applied in the vast majority of threats. Although Microsoft have added multiple security features in an attempt to protect users against malicious macros, such protections are often easily circumvented by simple social engineering techniques. Antivirus companies can no longer rely on static signatures due to the rate at which new macro malware is distributed, and thus are tasked with employing a more proactive approach to threat detection. This paper details the literature on machine learning methods for the detection of VBA macro malware. Further, a machine learning system for the detection of VBA macro malware is proposed and evaluated. A Random Forest classi er achieves a true positive detection rate of 98.9875% with a false positive detection rate of 1.07% over a set of 611 mixed (benign and malicious) malware samples.
The Microsoft O ce suite allows users to leverage a powerful scripting engine
known as Visual Basic for Applications (VBA) in the les it creates. VBA grants
users a great deal of power by exposing the native Windows API [
Up until the mid 2000s, users received little protection from Anti-virus software and their Operating System. This was the case until the release of O ce 2007, which brought with it new security features to protect users from macro malware. In particular, Microsoft disabled the automatic execution of macros by default [5], which thwarted threats that relied solely on the user opening the document. In response to these security features, attackers must now focus on the human element in the chain of compromise. To achieve execution of their malware, the attacker's victim must either take action to explicitly execute the macro, or have an unsafe O ce security con guration. Furthermore, the O ce suite has seen many of its discovered vulnerabilities exploited in the wild by malware [6] [7] [8]. However, a recent study by Proofpoint showed that 99.7% of documents used in attachment-based campaigns relied on social engineering and macros [9], rather than exploits. Thus in this paper exploit-based threats are excluded from further analysis.
Nowadays, macros typically serve as the initial step in the chain of compromise whereby they download a secondary payload upon macro execution [10]. By default, when a user opens a macro-enabled document, they are presented with a warning, and noti ed of the dangers associated with macros. Also presented is an Enable Content button along side the warning that when clicked, executes the embedded macros. Attackers require their victims to click this button to execute their malware, and to ensure this happens, many social engineering methods are deployed at this stage. Common tricks include fake instructions present in the document that falsely inform the user that the document was created in a previous version of O ce, and to view the document they must click Enable Content. Another approach is to display seemingly encrypted text with a note instructing the user to click Enable Content in order to decrypt it.
If the user clicks the Enable Content button, code execution begins at one of many possible entry points. Such entry points are event-triggered subroutines that have the following de nitions [11]: AutoExec
When Word is started or a global template loaded AutoNew
When a new document is created AutoOpen/Document Open
When an existing document is opened AutoClose/Document Close
When a document is closed AutoExit
Upon exiting Word or unloading a global template
The above de nitions de ne the user-triggered events that cause the execution of a corresponding subroutine in the macro source code. The vast majority of macro malware contain at least one of such subroutine simply because they may be triggered with minimal user interaction. Recently, malware authors have been favouring the AutoClose subroutine due to the fact that some sandboxes are not su ciently sophisticated to determine that to detonate the malware's payload, the document must be opened and subsequently closed.
Another prevalent feature of macro malware is obfuscation. Unfortunately, however since some commercial software developers employ obfuscation to protect their source code, the presence of obfuscation alone does prove malicious intent. Rather, O ce o ers little protection to a developer who seeks to keep their VBA application's source code closed and developers thus resort to obfuscation. This paper builds on previous research by including social engineering techniques as a feature in a machine learning classi er. 2
In Symantec's 2017 ISTR annual report on the current state of the threat landscape, it was found that macro-enabled documents and JavaScript downloaders were the most commonly used approach to spreading malware via email [18]. According to the same report, macro-enabled documents were used in mass spam campaigns to spread high pro le malware such as Dridex and textitKotver. In 2015 it was estimated that the nancial damage due to Dridex was over $40 million [22].
In 2015 Symantec published gures on the number of malicious email attachments blocked by their endpoint products. The most common le extension was .doc being blocked in 55.8% of emails with .xls in second place being blocked in 15.0% of emails [19].
Over the rst half of 2017, Sophos reported in [20] that 68% of le types used to deliver malware were Word documents and 16% Excel spreadsheets.
According to a 2015 Cisco blog evaluating the detection rate of VBA macros by Anti-virus products, detection of malicious attachments at the time of email delivery ranges from 0 to 35% with an average detection rate of 8% [21]. In the same blog, it was also stated that malware download sites hosting malicious macros remained alive in some cases for over 29 days.
Considering that VBA macro malware has been around for over 20 years, is responsible for the theft of millions of dollars annually and is not adequately protected against by common security tools like Anti-virus, research into how to better defend potential victims against VBA attacks is clearly warranted.
Peer reviewed research on the topic of macro malware detection is limited. ALDOCX is a machine learning classi er and a structural feature extraction framework implemented by Nisam et al in 2017 [12]. ALDOCX uses features extracted solely from le paths in the ZIP archive structure used by the O ce Open XML variant of O ce les (docx, xlsx, pptx ). These le path based features are fed into an online learning SVM classi er. Nissam et al reported a 93.6% true positive detection rate with a 0.19% false positive rate. There were signi cant shortcomings to this framework however, the rst being that only OOXML-based o ce les are supported and not legacy OLE les which remain the most common format today [13]. Secondly, the training set ultimately favours simply classifying any samples containing macros as malicious, as only 0.16% of their benign training set contained macros and only ZIP le paths were used as features and while these signify the existence of macros they reveal nothing of their contents.
Detection of various security vulnerabilities relating to format speci cation abuse, VBA and other exploitation techniques are discussed by Lagadec in [14]. Lagadecs methods for detection rely on standalone detection tools and not machine learning, and hence fail to generalise to detect previously unseen malware e ciently.
Rudd et al researched whether machine learning techniques that had been previously successful in the classi cation of malicious PE les could be extended to le types typically found in email attachments [13]. They collected 5 million O ce documents from Virustotal Intelligence and using both XGBoost and DNN classi ers were able to achieve a detection rate of 99% using features such as string length, byte entropy and N-gram histograms. They also showed that string length features made the biggest contribution to their classi ers e cacy. 4
Files created by the Microsoft O ce suite typically use one of two formats [15]. O ce versions prior to O ce 2007 exclusively used a binary format known as OLE to store all data needed to represent a document, spreadsheet, etc. OLE les can be identi ed by their le extension, .doc, .xls, .ppt or by their rst eight bytes, D0CF11E0A1B11AE1. Internally, OLE uses a hierarchy of data streams to store various components of the document.
In Fig.2 depicts the streams that make up a typical .doc document le. For example, the WordDocument stream contains all of the document's textual data. Streams under the Macros directory are of most signi cance for malicious VBA detection. Most streams found here contain metadata on the VBA project itself, bar VBA PROJECT which contains the actual VBA source code. The source code in this stream is compressed using the MS-OVBA algorithm [16] and there exist many tools and libraries to aid in its decompression. Here, the oletools library by declage [17] was used to extract the macro source code. Starting in O ce 2007, Microsoft introduced a new format known as O ce Open XML [15]. The OOXML format is essentially a ZIP archive containing an internal hierarchy of directories that in turn contain XML les used to both store both document metadata and actual document contents. Fig. 3 presents the top level structure of a .xlsx spreadsheet.
Of primary interest here is locating the VBA source code. This can be found in le vbaProject.bin as depicted in Fig. 4 5
The aim of this research is to develop a classi er to make a binary classi cation on the behaviour of a macro-enabled document. The two possible classi cations are benign and malicious. Thus it was required to collect known benign and malicious samples to construct a training set. Malicious samples can be collected from various sources online. Here, malicious samples were exclusively collected from the website, malshare.com. This website exposes an API to end-users and maintains good classi cation of samples by YARA rules created by community members. Once samples were downloaded, they were veri ed as malicious by scanning with VirusTotal and any samples not deemed malicious by at least three vendors were discarded. Subsequent manual inspection of each sample was carried out to ensure its malicious nature. Collection of benign samples was more challenging. To create a benign training set, various VBA tutorial websites o ering example macros were consulted. In addition, Google searches for letype:doc and letype:xls with keywords such as VBA and macros, revealed more samples. Again, this set was further validated by scanning each sample on VirusTotal and excluding any sample that deemed malicious by any detector. Subsequent manual inspection of each sample ensured it was indeed benign. From each sample in the training set, all features are extracted and used to train a classi er. Once trained, the model is serialized to a le on disk. This enables the persistence of already trained models, and allows one to swap with ease between classi er models. 6
In previously published literature, features typically selected are ones that arise purely from obfuscation. Thus, high detection rates can be achieved because the vast majority of malicious macros are obfuscated. However such an approach can lead to an increase in false positives. False positives are likely to occur in benign macros where the author has taken measures to obfuscate the source code. To handle such cases, a new approach is proposed here that includes the presence of social engineering tricks as an additional feature as these will almost never occur in a benign obfuscated macro. To automate the detection of such a feature, it was necessary to rst extract images embedded within the document. As mentioned previously, such images contain text that aims to social engineer the user into executing the macro. Generally speaking, commercial and open source tools cannot extract embedded images the reason being that Microsoft does not document how the O ce suite, speci cally Word and Excel, process embedded images. For Powerpoint les, images are stored within a Pictures stream, however this is not the case for Word and Excel.
As a result, an image extractor that does not rely on parsing the OLE header was implemented. Rather, it searches the OLE binary for potential image magic numbers. Once an image magic number is found within the OLE binary, the image header is parsed and the entire image extracted. Next, images are passed through the tesseract Optical Character Recognition library. Text is thus extracted from from these embedded images. A binary feature codes the presence of common phrases found in social engineering images, such as Enable Content and Previous Version. For features that code characteristics of the source code, a small custom VBA parser was implemented. This facilitated the simple incorporation of new source code-related features. Features found to achieve a maximum detection rate after hyper-parameter tuning are documented below: Average Variable Assignment Length: It was found that many obfuscated macros declared abnormally long string variables. This was determined by comparing the average length for both benign and malicious sets. To capture this feature, the average length of string variables in the VBA source was computed. Count of Integer Variables: Another characteristic common to the malicious macro set was that they de ned more integer variables than the benign set. To capture this feature, the count of integer variables in the macro source code divided by the length of the source code was computed.
Count of String Variables: The same nding held for string as for integer variables. To capture this feature, the count of string variables in the macro source code divided by the length of the source code was computed. Macro Keywords: This is a binary feature that encodes the presence of certain keywords that were found to be signi cantly more prevalent amongst the malicious set. These keywords related to event-based subroutines described earlier, namely AutoOpen, AutoClose, DocumentOpen and DocumentClose. Highest Number of Consecutive Mathematical Operations: A subset of the malicious sample set employed anti-analysis techniques by declaring many variables in the following way:
Declaring variables in this fashion is characteristic of obfuscated scripts. This feature was captured by nding the highest number of consecutive mathematical operations carried out across all variables declared in the script. This integer value was then included in the feature vector. Casing Ratio in Variable Declarations: Typically a programmer adopts a naming convention when it comes to variables. They may use lower-case exclusively, upper-case or camel case. In any case, one would expect the ratio of upper-case to lower-case characters in variable names to be either close to zero or signi cantly greater than one. To capture this feature, the latter ratio is computed for each variable in the script and averaged over the whole script.
Count of Variables: Obfuscated scripts tend to declare many more distinct variables in an e ort to make analysis more di cult. To capture this feature, the number of distinct variable declarations in the script divided by the length of the script is computed.
Shannon Entropy: Obfuscated scripts tend to be less readable, using random, non-readable words for variable declarations and subroutine names. As a result, they tend to have higher entropy than non-obfuscated scripts. This value was added to the feature vector.
For each training sample, an N dimensional feature vector is created where N is the number of features used. Feature vectors are represented in a numpy array and passed to a classi er implemented by the scikit-learn Python library. Five di erent classi ers from scikit-learn were investigated: KNeighborsClassi er, DecisionTree, RandomForest and GaussianNB. Each classi er was trained over the training set consisting of 200 known benign samples and 200 known malicious samples. To improve classi er performance, hyper-parameters were rst tuned using a randomised grid search using 10-fold cross validation. This narrowed down the ranges for which hyper-parameters were most performant. Next, another grid search was performed using 10-fold cross validation but de ning more narrow parameter ranges that were close to those determined most e ective by the randomised search. The sklearn.model selection.RandomizedSearchCV and sklearn.model selection.GridSearchCV classes were applied for this purpose. Once the most e ective hyper-parameters had been determined for each classi er, the classi ers' predictive capabilities were evaluated using samples from a separate test set. The test set consisted of 528 known malicious samples and 83 known benign samples. The samples in the test set were not present in the training set. Similar to Rudd et al [13], care was taken to ensure that all samples present in the malicious test set were newer than the newest sample in the malicious training set. The aim here is to evaluate the classi ers by using deployment performance metric. The latter captures the e ectiveness of the classi er after deployment in terms of classifying new and previously unseen malware. This is important because of the evolving nature of obfuscated malware. For example, in any given week a malware campaign will favour one packer/obfuscator, but once anti-virus signatures catch-up, a switch to a new packer/obfuscator evades detection. To evaluate their performance, the True Positive Rate (TPR) was de ned to be the percentage of the test set that was classi ed correctly and the False Positive Rate to be the percentage of the test set that was classi ed incorrectly.
Hyper-parameters, TPR/FPR are shown below. No hyper-parameter tuning was required for GaussianNB as the classi er doesn't accept parameters. KNeighbors DecisionTree RandomForest n neighbors = 20 min samples split = 6 min samples leaf = 2 weights = 'distance' criterion = 'entropy' n estimators = 800 algorithm = 'ball tree' max depth = 100 max features = 'sqrt' fmax depth = 50
GaussianNB
The table below documents my results for TPR and FPR against my test set with the RandomForest classi er being the best performer. The time row shows the average time taken to train the classi er on an i7-4790K CPU @ 4.00GHz.
RandomForest KNeighbors DecisionTree GaussianNB TPR 98.9875% 97.527% 98.225% 97.02% FPR 1.07% 2.46% 1.768% 2.97% time 7m 34s 6m51s 6m51s 6m59 8
Despite the relatively small training set, the observed performance is promising and on a par with other studies. This research suggests that machine learning may provide viable approaches to detecting VBA macro malware. Furthermore, in theory an approach such as that described in this paper can be easily ported to classify other prevalent script-based threats such as JavaScript, VBScript, Powershell and Windows batch les.
In terms of deployment, this approach could serve as either a host-based agent where document les are scanned prior to opening in O ce, or a network-based agent where all document les on the network are inspected prior to reaching their destination. Detection logic could be updated by drawing the persistent model les from a remote location, analogous to how anti-virus products update their signatures. One challenge faced throughout this research was acquiring benign samples. Unlike malicious samples, there were no online resources identi ed that hosted veri ably benign macro-enabled documents. This signi cantly restricted training set size, and as a result impacted overall classi er performance. In an ideal scenario, access to Google's VirusTotal service would enable the ready download of benign samples. However, this service comes with a major annual price tag.
Future work on will be focus on implementing an online learning based solution. Such an approach, would not require re-training against the entire training set each time a new sample is added. This would make the software more suitable for deployment in a corporate network environment, with the ultimate intention of it consuming all O ce samples traversing the network, and updating its classi cation model as it sees them. 2. Zhengchuan Xu, Qing Hu, Chenghong Zhang Why computer talents become computer hackers Communications of the ACM. Volume 56 Issue 4, April 2013. Pages 64-74 3. Vesselin Bontchev Possible macro virus attacks and how to prevent them Computers & Security. Volume 15, Issue 7, 1996, Pages 595-626 4. Sara L.N. RaId, Jens M. Pederse An Updated Taxonomy for Characterizing Hackers According to Their Threat Properties 2012 14th International Conference on Advanced Communication Technology (ICACT) 5. Macro Security for Microsoft O ce https://www.ncsc.gov.uk/guidance/macrosecurity-microsoft-o ce 6. Haifei Li RTF Attack Takes Advantage of Multiple Exploits https://securingtomorrow.mcafee.com/mcafee-labs/rtf-attack-takes-advantageof-multiple-exploits/ 7. Graham Chantry CVE-2012-0158: Anatomy of a proli c exploit https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/CVE2012-0158-An-Anatomy-of-a-Proli c-Exploit.PDF 8. Genwei Jiang, Rahul Mohandas, Jonathan Leathery, Alex Berry, Lennard Galang CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler https://www. reeye.com/blog/threat-research/2017/04/cve-2017-0199-htahandler.html 9. Evan Gaustad Applied Machine Learning: Defeating Modern Malicious Documents https://www.rsaconference.com/writable/presentations/ le upload/ht-w02applied-machine-learning-defeating-modern-malicious-documents.pdf 10. Gabor Szappanos VBA is not dead! https://www.virusbulletin.com/virusbulletin/2014/07/vbanot-dead 11. John Austin Auto Macros https://msdn.microsoft.com/en-us/vba/wordvba/articles/auto-macros 12. Nir Nissim, Aviad Cohen, Yuval Elovici ALDOCX: Detection of Unknown Malicious Microsoft O ce Documents Using Designated Active Learning Methods Based on New Structural Feature Extraction Methodology IEEE Transactions on Information Forensics and Security vol. 12, no. 3, pp. 631-646, March 2017. 13. Ethan M. Rudd, Richard Harang, and Joshua Saxe MEADE: Towards a Malicious
Email Attachment Detection Engine arXiv preprint arXiv:1804.08162, 2018 14. Philippe Lagadec OpenDocument and Open XML security (OpenO ce.org and MS
O ce 2007) Journal in Computer Virology May 2008, Volume 4, Issue 2, pp 115125 15. Zhangjie Fu, Xingming Sun, and Jie Xi Digital Forensics of Microsoft O ce 20072013 Documents to Prevent Covert Communication JOURNAL OF COMMUNICATIONS AND NETWORKS, VOL. 17, NO. 5, OCTOBER 2015 pp 525-533 16. https://msdn.microsoft.com/en-us/library/dd923471(v=o ce.12).aspx 17. https://github.com/decalage2/oletools/wiki 18. https://www.symantec.com/content/dam/symantec/docs/reports/istr-22-2017en.pdf 19. https://www.symantec.com/content/dam/symantec/docs/reports/istr-21-2016government-en.pdf 20. https://nakedsecurity.sophos.com/2017/05/31/wolf-in-sheeps-clothing-a
sophoslabs-investigation-into-delivering-malware-via-vba/ 21. https://blogs.cisco.com/security/attackers-slipping-past-corporate-defenses-withmacros-and-cloud-hosting 22. https://securelist.com/dridex-a-history-of-evolution/78531/