VBA reads an image URL from a worksheet cell

The macro fetches a URL taken from a worksheet cell and passes the downloaded file to an image sink (Pictures.Insert / Shapes.AddPicture). Office parses those bytes with its image loader and never launches them, and the macro contains no Shell/Run/Exec primitive and no executable or script file target. That is the shape of a legitimate application form — a scholarship, HR or registration template that pulls the applicant's photo from a signed URL pasted into a cell — rather than a download-and-execute dropper. It is reported as a capability so the download is still visible, but it does not on its own establish malicious intent. A dropper that inserts a decoy image still carries its launch primitive and is reported as OOXML_VBA_DYNAMIC_CELL_URL_SOURCE.