Macro-encryption-based malicious document detection method and apparatus, and medium

Abstract

The embodiment of the invention discloses a macro-encryption-based malicious document detection method and apparatus, and a medium. According to a preset document analysis rule, an initial file of macro encryption is modified into a target file of a custom password; by modifying the password of the initial file, the macro code of the target file can be accessed by using the custom password to obtain the plaintext macro code of the target file. whether the plaintext macro code matches a preset code distribution rule or not is judged. if the plaintext macro code matches the preset code distribution rule, it shows that the macro code is maliciously modified, the initial file corresponding to the macro code is damaged, the reliability of the initial file cannot be guaranteed, and the initial file can be marked as a malicious file in order to avoid the system security problem caused by operating the initial file. According to the technical scheme, the plaintext macro code can be automatically obtained for macro decryption of the document, so that the security analysis of the document is realized, namely, the security detection of the macro encrypted document is realized.

Description

technical field [0001] The present invention relates to the technical field of file encryption, in particular to a macro-encrypted malicious document detection method, device and computer-readable storage medium. Background technique [0002] With the development of technology, especially the continuous improvement of phishing attack technology, malicious attackers usually implant malicious documents with macros in phishing attacks to lure victims to open the documents and trigger phishing attacks. Existing solutions can only directly analyze plaintext macro codes. In order to avoid sandbox detection and manual reverse analysis, malicious files will set passwords for macro codes. [0003] The macros of Office documents can be encrypted. In the case of unknown passwords, third parties cannot access the macro codes of Office documents, and cannot obtain the plaintext content of the macro codes, so that Office documents cannot be analyzed, resulting in the inability to complet...

AI Technical Summary

Problems solved by technology

[0003] The macros of Office documents can be encrypted. In the case of unknown passwords, third parties cannot access the macro codes of Office documents, and cannot obtain the plaintext content of the macro codes, so that Office documents cannot be analyzed, resulting in the inability to complete the security of macro-encrypted documents. sex test

Images