Malicious Office Add-in (Excel XLL)

An Excel XLL is a DLL add-in that exports Excel XLL interface functions and is loaded by desktop Excel on Windows. Excel calls the XLL's xlAutoOpen callback when it is activated, so the add-in's initialization code runs in that process. If the XLL was active in the last Excel session that ended normally, Excel activates it at the start of the next session, enabling persistence; loading it once alone is execution, not persistence.