← All detection heuristics · Office / Embedded content
critical
OFFICE_PACKAGE_AUTOCAD_AUTOLISP_BUNDLE
What it means
An Office OLE Package archive places reserved AutoCAD startup code beside DWG drawings.
Why it fires
AutoCAD can load reserved acad/acaddoc FAS, LSP, or VLX startup files from a drawing's working environment. Bundling one of those executable files beside DWG drawings is a documented AutoCAD malware delivery and propagation pattern. Detection uses archive member names and therefore still works when a newer RAR compression method prevents payload decompression.