Method and apparatus for detecting malware via analysis of a screen capture

1. An apparatus for detecting a malicious macro, the apparatus comprising:

a database;

at least one memory;

instructions;

processor circuitry to execute the instructions to:

detect execution of a macro-executing process;

in response to detection of the macro-execution process, capture a cropped portion of a screen buffer as an image, the image including a displayed user interface of the macro-executing process;

analyze the image to determine an image similarity to a stored image in the database, the database to store malicious macro interfaces; and

perform a responsive action in response to the image similarity meeting or exceeding a similarity threshold.

2. The apparatus of claim 1 , wherein the processor circuitry is to analyze the image by obtaining the stored image from a local cache.

3. The apparatus of claim 2 , wherein the local cache is to be synchronized with a central repository of known malicious macro interface images.

4. The apparatus of claim 1 , wherein the similarity threshold is a first similarity threshold, and wherein the processor circuitry is further to:

in response to the image similarity not meeting or exceeding the similarity threshold, perform character recognition to identify text present in the image of the user interface; and

compare the identified text to stored text, wherein the responder is to perform, in response to a second similarity score of the identified text and the stored text meeting or exceeding a second similarity threshold, the responsive action.

5. The apparatus of claim 1 , wherein the processor circuitry is to at least one of:

prevent further input from the user to the macro-executing process;

display an error message to the user; or

transmit an alert to a central monitoring facility.

6. The apparatus of claim 1 , further including an anti-virus package to detect that the macro-executing process is performing a malicious activity and, store the image of the user interface in the database.

7. At least one non-transitory computer readable medium comprising instructions that, when executed, cause at least one processor to at least:

detect execution of a macro-executing process;

in response to detection of the macro-execution process, capture a cropped portion of a screen buffer as an image, the image including a displayed user interface of the macro-executing process;

analyze the image to determine an image similarity to a stored image in a database of malicious macro interfaces; and

perform a responsive action in response to the image similarity meeting or exceeding a similarity threshold.

8. The at least one non-transitory computer readable medium of claim 7 , wherein the instructions, when executed, cause the at least one processor to analyze the image by obtaining the stored image from a local cache.

9. The at least one non-transitory computer readable medium of claim 8 , wherein the instructions, when executed, cause the at least one processor to synchronize the local cache with a central repository of known malicious macro interface images.

10. The at least one non-transitory computer readable medium of claim 7 , wherein the similarity threshold is a first similarity threshold, and the instructions, when executed, cause the at least one processor to, in response to the image similarity not meeting or exceeding the similarity threshold:

perform character recognition to identify text present in the image of the user interface;

compare the identified text to stored text; and

perform, in response to a second similarity score of the identified text and the stored text meeting or exceeding a second similarity threshold, the responsive action.

11. The at least one non-transitory computer readable medium of claim 7 , wherein the instructions, when executed, cause the at least one processor to, in response to the comparison of the image similarity score to the image similarity threshold, performing at least one of:

prevent further input from the user to the macro-executing process;

display an error message to the user; or

transmit an alert to a central monitoring facility.

12. The at least one non-transitory computer readable medium of claim 7 , wherein the instructions, when executed, cause the at least one processor to:

detect, with an anti-virus package, that the macro-executing process is performing a malicious activity; and

in response to detecting that the macro-executing process is performing the malicious activity, store the image of the user interface.

13. A method for detecting a malicious macro, the method comprising:

detecting execution of a macro-executing process;

in response to detection of the macro-execution process, capturing a cropped portion of a screen buffer as an image, the image including a displayed user interface of the macro-executing process;

analyzing the image to determine an image similarity to a stored image in a database of malicious macro interfaces; and

performing a responsive action in response to the image similarity meeting or exceeding a similarity threshold.

14. The method of claim 13 , wherein the analyzing of the image includes obtaining the stored image from a local cache.

15. The method of claim 14 , further including synchronizing the local cache with a central repository of known malicious macro interface images.

16. The method of claim 13 , wherein the similarity threshold is a first similarity threshold, and further including, in response to the image similarity not meeting or exceeding the similarity threshold:

performing character recognition to identify text present in the image of the user interface;

comparing the identified text to stored text; and

performing, in response to a second similarity score of the identified text and the stored text meeting or exceeding a second similarity threshold, the responsive action.

17. The method of claim 13 , further including, in response to the comparison of the image similarity score to the image similarity threshold, performing at least one of:

preventing further input from the user to the macro-executing process;

displaying an error message to the user; or

transmitting an alert to a central monitoring facility.

18. The method of claim 13 , further including:

detecting, with an anti-virus package, that the macro-executing process is performing a malicious activity; and

in response to detecting that the macro-executing process is performing the malicious activity, storing the image of the user interface.