P-Code Based Classification to Detect Malicious VBA Macro
Simon Huneault-LeBlanc, Chamseddine Talhi · 2020
VBA macro malware has seen a resurgence of use in recent years by malicious actors as a vector to perpetrate cyber attacks. Anti-virus and analysis tools use heuristics of the VBA source code in an effort to detect such attacks. Although efficient, anti-virus and analysis tools are not able to detect macro malware based on VBA opcode (p-code). This gap requires further research in using p-code for macro malware detection. In this paper, we discuss the extraction of p-code within macro based documents and present the classification of benign and malicious p-code using five learning classifiers. Our method selects 12 specific p-code features and use them to train the classifiers. Our approach obtained a high accuracy (98.8%) and is promising for macro malware detection in real-world applications. We have discussed the challenges our approach could face and their potential solutions. To promote future studies in this field, we have made our dataset available to the community.