This post was originally published on this site

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".

rule autocad_orphaned_vba_project {

    strings: $a = "AC10"

             $b = {D0 CF 11 E0 A1 B1 1A E1}

             $c = "[Host Extender Info]" ascii

 

    condition: $a at 0 and uint32(0x24) == 0 and $b and $c

}

 

A VirusTotal retrohunt with this rule gave me only 2 detections:

09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8

3310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b5bca6

 

Didier Stevens
Senior handler
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.