I was asked where one can find VBA project references inside an ole file with VBA code.

Document [MS-OVBA] gives all the details: project references are found inside the dir stream (together with project and modules information), and a "compiled" version of that information (PerformanceCache) can be found inside the _VBA_PROJECT stream.

The content of the dir stream is compressed, and can be viewed like this:

The content of the _VBA_PROJECT stream is not compressed:

I developed a plugin to parse the records of the dir stream (as documented in [MS-OVBA]): plugin_vba_dir.

Since the PerformanceCache data is not documented (and optional), I don't know how to parse it. But you can extract strings from it and infer references.

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com