AutoCAD compiles AutoLISP into FAS binaries and packages modules into the VLX container. Both are closed formats, poorly documented, and regularly abused in engineering environments where the tooling is neither open nor versioned — and where cloud sandboxing is often prohibited for proprietary CAD data.
The recovery work covers two layers: the FAS4 binary format, with its dual encrypted streams and rolling XOR recovery process, and the VLX VRTLIB-1 container that packages multiple AutoCAD modules. Once recovered, symbols, APIs, strings, paths, and registry references are lifted into a security-oriented intermediate representation, which is what makes behavioral analysis and ATT&CK-mapped evidence possible.
CADscanner builds a reproducible pipeline on top of that representation: automated extraction, AST-level reconstruction, rule-based adjudication, and an LLM ensemble for triage. The system is fast enough for network-edge deployment — under 15 ms per file — and has been integrated into Sangfor’s OT security pipeline.
The evaluation uses a 983-sample benchmark spanning 23 malware families with a family-disjoint protocol, which keeps the classifier from being scored on variants of what it already saw. Family-disjoint local detection reaches 95.8% TPR at 2.2% FPR.
Published as “CADscanner: Automating Malware Analysis for Compiled AutoCAD Scripts in Engineering Environments”, ASE 2026 (Industry Track). Authors: Luxing Yin†, Chang Sun†, Chenghui Liang, et al. († equal contribution) DOI: 10.1145/3832783.3834495
Presented at Black Hat Europe 2026 Briefings. Session