← All detection heuristics · Macro
high
OLE_VBA_BASE64_CELL_URL
What it means
A VBA-bearing BIFF workbook cell decodes from Base64 to an HTTP(S) payload URL.
Why it fires
The scanner walks BIFF SST/cell values and accepts only a successfully decoded, syntactically valid payload URL.
Other Macro heuristics
OLE_VBA_CELL_WMI_PROCESS_CREATE OLE_VBA_EMBEDDED_ARCHIVE_DROPPER OOXML_STAGED_CELL_PAYLOAD OOXML_VBA_BASE64_CELL_URL