# Malicious Office Macro Detection: Combined Features with Obfuscation and Suspicious Keywords
## 2 Background
### Obfuscation of VBA Macro  
Code obfuscation was proposed as a method to prevent reverse analysis. In legitimate situations, macros are typically obfuscated to protect the intellectual property of the source code. However, in the context of malicious macros, obfuscation is primarily used to hide the malicious commands, making it challenging for antivirus software to identify any suspicious elements. We list six commonly used techniques for obfuscating VBA macros:  
* Random Obfuscation: Randomize the variable names or procedure names in a macro with randomly generated characters. Figure 3 provides an example of random obfuscation. Both the variable names and function parameters have been obfuscated.  
Figure 1: VBA macro examples. (**a**) A procedure of VBA macro used to change font format. (**b**) A snippet of VBA macro used to send an email.  
* Encoding Obfuscation: Encoding obfuscation is similar to encryption and requires decoding operations to restore the original string before it can be used. For instance, we can encode a PowerShell command as a byte array or a Base64 string. PowerShell commands are often targeted for encoding obfuscation. Figure 5 demonstrates the parameter of the \"GetObject\" function being obfuscated using byte arrays and subsequently decoded with a self-defined decoding function called \"FiTuJxQrLu\".
* Embedding Obfuscation: Embedding obfuscation conceals the target string in other parts of the document, such as document attributes, forms, or controls, and even within the content of the document. The macro can then load this content directly into a string variable. This obfuscation can be challenging to recognize because it is a common operation in non-obfuscated macros for processing content. Figure 6 provides an example of embedding obfuscation. The PowerShell command is loaded from a hidden shape within the document.
* Call obfuscation: When dealing with sensitive object methods such as \"Run\", \"ShellExecute\", and \"Create\" in VBA macros, the \"CallByName\" method can be useful for executing a method by specifying its name as a string. By combining it with other forms of string obfuscation, the called method can be further obfuscated. The macro depicted in Figure 7b is the obfuscated version of the code shown in Figure 7a, where the object's called method is obfuscated.  
Figure 4: Split obfuscation examples. (**a**) Example of split obfuscation from a benign macro. (**b**) Example of split obfuscation from a malicious macro.  
Figure 5: Example of encoding obfuscation.  
Figure 3: Example of random obfuscation.  
Figure 6: Example of embedding obfuscation.  
* Logical Obfuscation: The concept of logical obfuscation involves adding dummy code such as procedure calls and branch decisions, which complicates the logic of the macro. In certain cases, attackers conceal a few lines of malicious statements among large amounts of normal macro code, making it problematic to analyze malicious macros. This situation can be likened to searching for a needle in a haystack. Without understanding the program semantics, it is impossible to determine if the code is logically obfuscated.