Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files". rule autocad_orphaned_vba_project {     strings: $a = "AC10"              $b = {D0 CF 11 E0 A1 B1 1A E1}              $c = "[Host Extender Info]" ascii       condition: $a at 0 and uint32(0x24) == 0 and $b and $c }   A VirusTotal retrohunt with this rule gave me only... Weiterlesen: Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)