MOD²SAD: enhancing malicious office document detection through semantic-aware deobfuscation

Area of Science:

• Cybersecurity
• Malware Analysis
• Software Engineering

Background:

• Advanced Persistent Threats (APTs) increasingly use semantic obfuscation in malicious Office macros.
• Obfuscated macros evade traditional static and dynamic analysis techniques.
• Existing methods struggle with code logic opacity and fragmentation.

Purpose of the Study:

• To propose a static analysis framework for semantic-aware code reconstruction of obfuscated malicious macros.
• To extract hidden Indicators of Compromise (IoCs) by recovering underlying execution logic.
• To enhance the detection accuracy of sophisticated malware threats.

Main Methods:

• Developed a static analysis framework centered on semantic-aware code reconstruction.
• Introduced an Obfuscation Awareness and Splitting Approach to handle context limitations and fragmentation.
• Utilized a generative semantic engine and hybrid feature extraction for threat characterization.

Main Results:

• Achieved an average precision of 74.57% in IoC extraction, outperforming conventional static analysis.
• Integrated framework with machine learning classifiers reached a maximum detection accuracy of 98.89%.
• Demonstrated effectiveness and robustness in detecting obfuscated malicious macros.

Conclusions:

• The semantic deobfuscation framework offers a scalable solution for enterprise defense against sophisticated malware.
• The approach successfully recovers hidden logic and extracts critical IoCs from obfuscated macros.
• Semantic-aware reconstruction is crucial for advancing malware detection capabilities.