Skip to content
NewA calmer, faster ZeroHour
Toolsinfo

YARA rule detects orphaned VBA projects inside DWG files

Original title: Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)

SANS Internet Storm Center ()1 min read4 · 2 reads
Read at isc.sans.edu
AI summary · x-ai/grok-4.7Summaries by Vani AI

A VirusTotal retrohunt with the rule returned only two matching samples.

Didier Stevens published a YARA rule on the SANS Internet Storm Center diary for orphaned VBA projects inside DWG files. The rule requires an AC10 header at offset 0, a zero dword at 0x24, an OLE compound-file signature, and the string "[Host Extender Info]". A VirusTotal retrohunt returned two hashes and no further context.

Key facts
  • The rule is named autocad_orphaned_vba_project.
  • It checks for AC10 at byte 0 and uint32(0x24) equal to 0.
  • It also requires an OLE header and "[Host Extender Info]".
  • The retrohunt listed two SHA-256 hashes.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
yaradwgautocadvbadetection
Products
DWG
Organizations
VirusTotal

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha25609d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8usTotal retrohunt with this rule gave me only 2 detections: 09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8 3310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b
sha2563310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b5bca607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8 3310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b5bca6 Didier Stevens Senior handler blog.DidierStevens.com (c) SA

From the original article

1 min read at isc.sans.edu

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".

SANS Internet Storm Center

isc.sans.edu

Read the full article at SANS Internet Storm Center

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.