VBA downloader URL read from worksheet cell

OOXML_VBA_CELL_URL_DROPPER

← All detection heuristics · Office Macros

critical OOXML_VBA_CELL_URL_DROPPER

What it means

OOXML VBA reads a worksheet cell into a URL variable and downloads it.

Why it fires

Some Excel macro droppers keep the payload URL outside the VBA source and read it from a worksheet cell at runtime. Literal macro URL extraction misses these because the URL is stored in sheet XML or sharedStrings.xml. This detector follows the Range("A1").Value assignment into Microsoft.XMLHTTP.Open or URLDownloadToFile and surfaces the resolved cell URL as an IOC.

Other Office Macros heuristics

OLE_VBA_XOR_DECODED_SHELL OLE_VBA_DOCUMENT_BODY_DROP_EXEC OLE_VBA_SPLIT_KEYWORD_OBFUSCATION OLE_VBA_AUTOEXEC_NORMAL_TEMPLATE_VIRUS OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER OLE_RAW_MACRO_NATIVE_MEMORY_CALLBACK_LOADER OLE_VBA_REACHABLE_HTTP_DROP_EXEC OLE_VBA_HTTP_DROP_EXEC OLE_VBA_HTTP_RESPONSE_COMMAND_EXEC OLE_VBA_CELL_GETOBJECT_EXEC OLE_VBA_XLM_CALL_INJECTION OLE_VBA_NATIVE_MEMORY_CALLBACK_LOADER OLE_VBA_BITSTRANSFER_DROPPER OLE_VBA_USERFORM_CMD_DROPPER OOXML_VBA_DEFINED_NAME_NETWORK_CONSUMED OOXML_VBA_DYNAMIC_CELL_URL_SOURCE OLE_VBA_HOSTS_FILE_HIJACK OLE_VBA_KEYLOGGER_SPYWARE OOXML_VBA_CELL_IMAGE_SOURCE OLE_VBA_BARE_IPV4_LITERAL