Detecting Macro less and Anti-evasive Malware in Malspam Word Attachments Using Anergy Scoring Methodology

Abstract

E-mails have become an inevitable part of everyone's internet lives today. Be it business, commercial, be it entertainment, e-mails are the crux of marketing and communication e-mail is the primary entry point for many malware-based attacks. Malspam is another form of e-mail delivered with malicious attachments. Macro-based malware is very common these days where the threat actor plans a malicious script that executes or downloads the actual malware when the document is opened. This is more towards a Microsoft Office document. In this paper, we are discussing a technique where the threat actors went un-detected for months by anti-virus vendors and how we ended up detecting the malicious elements inside a Microsoft Office document. This paper also proposes a solution using Anergy Scoring Methodology to flag a good Microsoft Office document vs a bad Microsoft Office Document in a swift and convincing manner.