Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: DanBot can use a VBA macro to decode its payload prior to installation and execution.