0 comment(s)

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".

rule autocad_orphaned_vba_project {strings: $a = "AC10"$b = {D0 CF 11 E0 A1 B1 1A E1}$c = "[Host Extender Info]" asciicondition: $a at 0 and uint32(0x24) == 0 and $b and $c}

A VirusTotal retrohunt with this rule gave me only 2 detections:

Didier Stevens Senior handlerblog.DidierStevens.com

Keywords:

0 comment(s)

×

Diary Archives