VBA p-code auto-exec with execution tokens

Some malicious Office documents keep executable VBA in compiled p-code or cache streams while source extraction fails or returns empty output. The detector reports on the combination of two tokens co-occurring in the same compiled stream: an auto-execution entry point (Auto_Open / Document_Open / Workbook_Open / Auto_Close) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token on its own is flagged — for example CreateObject is benign by itself; it is the pairing with an auto-run entry point that is the macro-malware indicator, even when decoded source is unavailable.