If there are posts in the database that are generating the content, then you will need to clean out that malicious code in the wp-posts table.
BUt I suspect that there is malicious code in the site. It could be anywhere; inside your wp-config.php or wp-settings.php file, for example. Or in the htaccess file. Or in your themes. Or in your plugins.
You could do a fresh install of WP, your theme and plugins used into a new instance of WP. But I would first ensure that all credentials (hosting, FTP, database, WP admin-level users, etc) are changed and have strong passwords (and that there are no unauthorized accounts or access). Ensure that PHP is version 7.3 on your hosting.
If repairing the existing site, I would delete then reinstall all theme and plugin files, and the entire WP core files, except your wp-config.php file (after making sure that is clean). Note that this requires deleting all files first, to remove any malware’d files (or extra files). Then install from files you download from the WP repository (download to local, uncompress, upload via FTP).
I’d also check all of the WP users for any that aren’t supposed to be there. Reset all passwords to strong passwords. Delete any that aren’t there. Create an admin-level user that is not called ‘admin’, then (after logging in with that user), delete the user called ‘admin’.
Lots of work involved in cleaning up a site. It may be that creating a new site might be slightly easier, although that means you will need to re-do all customization and plugin settings. And you will still need to clean your database content before you export and import.
Good luck.