## 2 Background and Literature Review
### Limitations of Traditional Detection Methods  
The previous two sections have introduced common techniques for detecting malware, ranging from simple and more static execution, such as comparing the signature with known threats, to more sophisticated document and runtime behaviour analysis. Past experience has shown this to be a fairly efficient way of detecting malicious programs and documents for the time being, but as knowledge, creativity and adaptation change, so does the sophistication of malware. Polymorphic and metamorphic malware are becoming more dangerous as threat actors realise that the traditional'spray and pray' method of targeting many organisations at once is becoming less effective due to the ease of detection, not to mention the fact that today's Advanced Persistence Threats (APTs) or nation-state actors are more likely to have political and economic motivations. The article by TechTarget [23] describes that polymorphic malware consists of an encrypted virus body and a decryption routine. During the infection process, the mutation engine generates a new decrypter with a new matching decrypted body, as shown in Figure 7. Metamorphic malware does not have a decryption key; instead, it changes all the code, for example, by permuting, shrinking, or expanding it, making the new iteration different from all previous versions of the malware. The YARA rules explained in Section 2.1 are mostly publicly available, so everyone can benefit from their configuration, which is the right approach. However, this also means that threat actors have access to this information and can build their new evolution of malware to evade those rules. Figure 7: Process of polymorphic malware infection [24]. The difficulty for automatic static analysis tools to detect the maliciousness of an Office document becomes particularly acute if it is sent encrypted. Microsoft provides a brief guide on how to \"protect\" a document with a password, which can be accessed on their support site [25]. Figure 8 illustrates the resulting (encrypted) file structure, which is distinct from the usual (plain) file structure shown in Figure 9.  
It is evident that no genuine information of value is being conveyed in this instance. Naturally, the maldoc must also be decrypted in order to perpetrate malicious actions. In this regard, the email in which the document is delivered may also contain a note indicating that the document has been encrypted with a password, which is _xyz_. This strategy may appear futile, but it effectively circumvents the initial stage of detection, allowing the perpetrator to proceed directly to the intended target. While signatures can still help in this case, since it is possible to create signatures for encrypted files, rotating the encryption key for each email sent largely eliminates this possibility. The general static analysis is also negatively affected by the encryption of a document, as it is not possible to extract static information of data without opening the document. This is due to the fact that there is currently no method of decrypting an Office document without opening it, after which the document can then be decrypted. In the case of manual dynamic analysis, encrypting a maldoc should not present a significant challenge, as the password must be provided in plain text for the target to be opened. This illustrates that contemporary iterations of maldocs are equipped with the capacity to circumvent detection, rendering their subsequent identification as malware a challenging endeavour. The ongoing struggle between the offender and the opposing party, in which the latter is always in a position of relative advantage due to its ability to act first, is a futile  
Figure 8: ZIP file structure after encrypting an Office document with a password. Figure 9: Exemplary OOXML file structure [3]. attempt to gain an advantage. In order to resolve this dilemma, a different approach is required.