Embedded AutoCAD drawings bundled with auto-loading AutoLISP code

OFFICE_PACKAGE_AUTOCAD_AUTOLISP_BUNDLE

← All detection heuristics · Office / Embedded content

critical OFFICE_PACKAGE_AUTOCAD_AUTOLISP_BUNDLE

What it means

An Office OLE Package archive places reserved AutoCAD startup code beside DWG drawings.

Why it fires

AutoCAD can load reserved acad/acaddoc FAS, LSP, or VLX startup files from a drawing's working environment. Bundling one of those executable files beside DWG drawings is a documented AutoCAD malware delivery and propagation pattern. Detection uses archive member names and therefore still works when a newer RAR compression method prevents payload decompression.

References