How to determine if an endpoint API is malicious?

Hey everyone! I'm new to the Malware Analysis game, and just analyzing my first sample on my own. It's a potentially malicious Microsoft Office document file.

I pulled some VBA macro code out, and there's no obfuscation in it. The document has an AutoOpen and I know to be on the lookout for those. What the AutoOpen does is sends the hostname and username to an API that is hosted in AWS.

However, the rest of the VBA macro code …

analysis api aws code document endpoint file game hey link lookout macro malicious malware malware analysis microsoft microsoft office obfuscation office own pulled rest username vba vba macro