Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
2 IOCs

Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)

SANS Internet Storm Center
SANS Internet Storm Center
Published October 14, 2026Original Report

Excerpt

Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg). In a nutshell: the VBA code is stored inside an OLE file, that is embedded inside the DWG file. You can do a brute-force search for the embedded OLE file, or you can follow a pointer inside the header of the DWG file. I wrote a small Python script ( autocad.py ) for this second case. It looks at a 32-bit pointer at position 0x24 inside the DWG file. This points to a 16-byte long header,…

Read the original report →

Indicators of Compromise

Open the mindmap →

2 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA25609d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8HighScore 56/100First seen
SHA256461ed52aeb75384133a8238b2eb481ae5d505d4961effa622673d65a889c8218MediumScore 53/100First seen

IOC Relationship Graph

Building graph…