## 3 Preparation Step: Data Collection from the Office Document for Malware Analysis
### Data Extraction--Office2 JSON  
In order to enable a large language model to comprehend the OOXML file, a Python script was developed which puts the content of the underlying files into a JavaScript Object Notation (JSON) file. The script can be found in the latest version on GitHub [13]. This format was selected due to its ability to compactly and logically store all content as name:value pairs, ensuring optimal structure. Additionally, its independence from programming languages and ease of information extraction and addition make it a widely used format. The script essentially converts the Office document into a ZIP archive by simply changing the file extension to.zip. Subsequently, the ZIP archive will be extracted, resulting in a regular folder. Thereafter, the script iterates through the underlying XML and RELS files, writing the content into a newly created JSON file. Moreover, a significant amount of crucial information pertaining to the potential malicious intent of the file is concealed within the vbaProject.bin file. A popular tool for extracting information from Microsoft Office files is called oletools, which is open source and can be found on GitHub [19]. The most commonly used field is that of malware analysis and forensics, and the tool comes with a number of useful implementations. These include the ability to output the actual VBA code and to provide an overview of the macro commands used, along with a brief description of their function. Regarding large language models, the additional context provides a more precise understanding of the data, reducing the potential for ambiguity and enabling the AI to make more accurate assessments. In the event that the script encounters an image file type, such as.png or.jpg, an empty value is inserted. Should the file type remain unknown, it is probable that the file is an embedded object; consequently, an additional warning is generated, indicating that suspicion should be raised. The data extraction script Office2 JSON is written in Python v3.11.0 and follows the PEP 8 coding convention [39]. The usage is fairly simple:  
* Clone the repository to a machine. * pip install -r requirements.txt
* Open a terminal session in that directory. * python Office2 JSON *PathToOfficeFile*  
Upon executing the aforementioned command, a.json file will be generated in the specified file directory. Figure 12 illustrates the extraction of a.xlsm sample. In the lower quarter of the figure, within the vbaProject.bin section, the results of the OLEVBA command, which is part of the oletools repository, are displayed. The analysis identifies suspicious macro behaviour and provides a description for it, which is also processed by the LLM. It should be noted that this method of extraction is only applicable to Office Open XML documents (OOXML), which are ZIP archives, and not to Object Linking and Embedding documents (OLE), which are of the compound file format. For simplicity, if the file extension consists of three characters, such as.xls,.xlt,.doc or.dot, it is likely to be of the older OLE format used in Office 97-2003. Conversely, if the extension contains four characters, such as.xlsx,.xlsm,.doc or.dotx, it is most probably an OOXML file. It is possible to convert OLE files to OOXML files by simply saving them as an OOXML file. Binary files, such as.xlsb, are also supported, given that they also contain.xml and.rels files. However, the textual extraction of the.bin files is not possible. In terms of speed, the extraction of smaller documents (20 KB file size) takes approximately 0.5 s, resulting in a JSON file with roughly 50,000 characters. Conversely, the extraction of the largest document tested (464 KB file size) took 5.5 s, resulting in a JSON file with 2,400,000 characters. It is important to note that the file size does not necessarily correlate with the resulting number of characters. For instance, images, which occupy arelatively large amount of disk storage, are represented by an empty string in the extraction.