MrPhisher: Decoding a Macro

Analysing a macro-enabled Word attachment (.docm) from a simulated phishing email, on a lab machine with no outbound internet access. Objective: extract the flag, but where could it be? The Scenario a