A Multi-leveled Approach for Detection of Coercive Malicious Documents Employing Optical Character Recognition

Authors of malicious documents often include a graphical asset used to lure the potential victim to 'enable editing' and to 'enable content' to activate the macro's embedded logic. While these graphical lures vary in theme, language, and content, they commonly have similar coercive text. Using Optical Character Recognition to produce text files of the images provides the ability to anchor the images' contents. While attackers have been known to intentionally manipulate images to bypass OCR-based detection, some additional techniques can surface the textual contents. Optical Character Recognition can be utilized to track, pivot, and cluster malicious campaigns, identify new TTPs, and possibly provide attribution against adversaries.