← All detection heuristics · Macro
critical
OLE_VBA_EMBEDDED_ARCHIVE_DROPPER
What it means
A VBA/UserForm hex or Base64 payload decodes to a ZIP containing executable/script content.
Why it fires
The archive is structurally validated, requires a risky child member, and is recursively carved for static and antivirus analysis.
Other Macro heuristics
OLE_VBA_CELL_WMI_PROCESS_CREATE OOXML_STAGED_CELL_PAYLOAD OOXML_VBA_BASE64_CELL_URL OLE_VBA_BASE64_CELL_URL