---
title: Tip for malware analysts: a VBA project found inside a DWG file may be orphaned and could never have run | ctxsec
url: https://ctxsec.com/items/tip-dwg-orphaned-vba
description: ""
status: "tip (SANS ISC), last updated Oct 18, 2026"
published: 2026-10-18
updated: 2026-10-18
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-dwg-orphaned-vba.md)

tip (SANS ISC)

2026-10-18 · updated

Oct 18, 2026

### Tip for malware analysts: a VBA project found inside a DWG file may be orphaned and could never have run

Didier Stevens (SANS ISC, Oct 14) found DWG files where the header pointer at offset 0x24 is zero but a brute-force search still finds an embedded OLE file with a VBA project. AutoCAD doesn't see orphaned VBA, so that code can't have executed when the drawing was opened (and AutoCAD needs a separate VBA install anyway). When oledump.py finds VBA in a DWG, also check the 0x24 pointer (or run his autocad.py with cut-bytes.py) before you treat the file as the infection vector. Update Oct 18: Stevens published the YARA rule he used (ISC diary 33434): `$a = "AC10"` at offset 0, `uint32(0x24) == 0`, the OLE header bytes `D0 CF 11 E0 A1 B1 1A E1`, and the ASCII string `[Host Extender Info]`. A VirusTotal retrohunt with it returned only 2 files: 09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8 and 3310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b5bca6.

Sources: [SANS ISC diary 33420](https://isc.sans.edu/diary/33420) · [SANS ISC diary 33434 (YARA rule)](https://isc.sans.edu/diary/33434)