← All detection heuristics · Macro
critical
OOXML_STAGED_CELL_PAYLOAD
What it means
A large binary or script payload is split across a long run of Base64-encoded worksheet cells, often in a hidden sheet and often with a second XOR layer.
Why it fires
The scanner rejoins the cell run in document order, Base64-decodes it, and (when the result is not already recognisable) retries a repeating-key XOR using the short string values held elsewhere in the same workbook — the shape used by loaders that keep the key in a cell. It fires only when the decoded bytes carry executable/container magic or are overwhelmingly printable script, and the recovered payload is carved as an artifact for AV and triage. Spreadsheet cells are a data channel; no legitimate workbook stages megabytes of executable content this way.
Other Macro heuristics
OLE_VBA_CELL_WMI_PROCESS_CREATE OLE_VBA_EMBEDDED_ARCHIVE_DROPPER OOXML_VBA_BASE64_CELL_URL OLE_VBA_BASE64_CELL_URL