Embedded PE reassembled from base64 VBA string fragments

The VBA macro stores a base64-encoded Windows executable split across many string variables and reassembles it at run time — typically writing it to %TEMP% with ADODB.Stream (often via embedded JScript glue using MSXML2.DOMDocument.nodeTypedValue) and executing it. The payload is embedded in the document, not downloaded, and never appears as a contiguous executable on disk, so URL recovery and the raw embedded-EXE scan both miss it. The analyzer concatenates the macro's base64 runs, decodes at each base64 phase alignment, and confirms a valid PE (MZ + DOS stub + PE header, or process-injection imports). A benign macro does not carry an executable across its string literals, so the match is near-zero-FP; the reassembled PE is carved for full extracted-file (ClamAV + static triage) analysis.