Analyzing the Entropy of Document Hidden Code

Explore the intricacies of document hidden code analysis in this 50-minute conference talk from Circle City Con 2015. Delve into the concept of entropy in the context of document malware, understanding its significance in measuring information and detecting malicious content. Learn about the methodology for processing code in bulk and calculating entropy, with a focus on malicious VBA and malware VBA. Discover techniques for defeating entropy detection and decoding hidden messages, including zero-order, first-order word, and second-order word methods. Examine real-world examples of hidden code and discuss strategies for catching such threats. Gain insights into the importance of English language patterns in code analysis and stay one step ahead of evolving threats in document security.