There is more to do to clean up a site than export/import posts data. The malware can be anywhere. And it could have gotten into your site via many paths.
Before you export/import posts, you need to ensure that the current posts are not the source of malware. I’d do a whole cleaning of the existing site before an export/import into a brand new site.
From a similar question, I answered this:
I would recommend a de-hacking inspection. If you think your site got hacked, there are several (many) things you must do to ‘de-hack’ it. Including:
- changing all passwords (WP admins, FTP, hosting, database)
- reinstalling WP (via the Updates page) and then reinstalling all themes (from the repository) and plugins manually.
- checking for unknown files (via your hosting File Manager; if you sort by date, invalid ones should stick out because you updated everything).
There are lots of help in the googles (or bings or ducks) on how to de-hack a site. I wrote a set of procedures that I use. It can be done, though, just takes a bit of work. My process is detailed here: https://securitydawg.com/recovering-from-a-hacked-wordpress-site/
(Added: if you do my cleaning process, you may not need to create a new site. I’ve cleaned sites successfully using that process.)
(Although this question is not within scope of this place, hacking questions happen often enough here that the answer might be helpful to you and others.)