Office Macros detection heuristics

Auto-exec VBA XOR-decodes a Shell command critical OLE_VBA_XOR_DECODED_SHELL

A character-array XOR decoder reconstructs data that flows to Shell.

Auto-exec VBA drops and launches the document body critical OLE_VBA_DOCUMENT_BODY_DROP_EXEC

VBA copies ActiveDocument text to disk and launches the staged path through COM.

Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION

VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell) appearing in no single literal.

Macro virus persists through AUTOEXEC.BAT and Normal.dot critical OLE_VBA_AUTOEXEC_NORMAL_TEMPLATE_VIRUS

VBA rewrites AUTOEXEC.BAT to replace the global Normal.dot template.

Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder and feeds them to a COM-instantiation or execution sink.

Raw OLE macro native-memory callback shellcode loader critical OLE_RAW_MACRO_NATIVE_MEMORY_CALLBACK_LOADER

Raw OLE/VBA project text exposes an auto-exec entry plus native memory allocation, process-memory write/copy, and callback/timer execution APIs.

VBA downloader URL read from worksheet cell critical OOXML_VBA_CELL_URL_DROPPER

OOXML VBA reads a worksheet cell into a URL variable and downloads it.

VBA downloads and launches an executable across helpers critical OLE_VBA_REACHABLE_HTTP_DROP_EXEC

An auto-running macro passes an executable destination to an HTTP SaveToFile helper and launches the same variable.

VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile) — a download-drop dropper even when the COM ProgIDs are built dynamically.

VBA executes command text received over HTTP critical OLE_VBA_HTTP_RESPONSE_COMMAND_EXEC

An auto-running VBA macro passes an HTTP text response directly to WScript.Shell.Run or Exec.

VBA executes content staged in worksheet cells critical OLE_VBA_CELL_GETOBJECT_EXEC

VBA passes a worksheet cell/comment reference to GetObject and drives an Exec/Open/Run sink.

VBA injects an Excel-4 macro CALL to a download/exec API critical OLE_VBA_XLM_CALL_INJECTION

VBA writes Excel-4 (XLM) =CALL() formulas targeting urlmon URLDownloadToFile / Shell32 ShellExecute and runs them.

VBA native-memory callback shellcode loader critical OLE_VBA_NATIVE_MEMORY_CALLBACK_LOADER

VBA auto-exec macro combines native memory allocation, process-memory write/copy, and callback/timer execution APIs.

VBA stages a PowerShell/LOLBin download-and-run command critical OLE_VBA_BITSTRANSFER_DROPPER

VBA assembles a PowerShell/LOLBin download primitive (Start-BitsTransfer, Invoke-WebRequest, Net.WebClient, bitsadmin, certutil) that fetches a remote payload and then executes it.

VBA writes UserForm/control payload to a command file critical OLE_VBA_USERFORM_CMD_DROPPER

VBA reads payload content from a UserForm/control property, writes it to disk, and launches it as a script or executable.

VBA consumes a network-valued Excel defined name high OOXML_VBA_DEFINED_NAME_NETWORK_CONSUMED

VBA resolves a URL-bearing defined name and contains a network or execution sink.

VBA downloader reads URL from worksheet cell high OOXML_VBA_DYNAMIC_CELL_URL_SOURCE

OOXML VBA reads a worksheet cell as the URL for a download API, but the stored cell does not contain an extractable URI.

VBA macro writes hosts-file redirect entries high OLE_VBA_HOSTS_FILE_HIJACK

VBA macro opens the Windows hosts file for writing and appends 'address hostname' redirect entries.

VBA polls global keyboard state (keylogger) high OLE_VBA_KEYLOGGER_SPYWARE

VBA declares/calls a Win32 keystroke-monitoring API (GetAsyncKeyState, SetWindowsHookEx, GetKeyboardState) to capture keystrokes system-wide.

VBA reads an image URL from a worksheet cell low OOXML_VBA_CELL_IMAGE_SOURCE

OOXML VBA downloads a URL held in a worksheet cell and inserts the result as a picture, with no launch primitive anywhere in the macro.

Bare IPv4 host in VBA macro info OLE_VBA_BARE_IPV4_LITERAL

VBA macro source contains a globally routable IPv4 address written as a bare dotted quad.