Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
SANS finds AutoCAD DWG files with orphaned VBA projects that AutoCAD cannot execute.
Didier Stevens reports AutoCAD DWG samples whose embedded-OLE pointer is zero, yet a brute-force search still finds an OLE file containing a VBA project. Because AutoCAD does not recognize these orphaned projects, the VBA cannot execute when the drawing is opened, and VBA support itself requires a separate install. He notes an AutoLISP dictionary-removal command that may clear the pointer without deleting the embedded OLE data, so analysts should verify the pointer before assessing risk.
- DWG files can contain OLE VBA projects while the header pointer is zero.
- AutoCAD does not see orphaned projects, so that VBA cannot run.
- VBA for AutoCAD is a separate install from the default product.
- Analysts should confirm the pointer before treating embedded VBA as executable.
- Vendors
- Autodesk
- Products
- AutoCAD
- Organizations
- SANS Internet Storm Center
From the original article
2 min read at isc.sans.edu
Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (. dwg).
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.