 I have this small look sample here, now you can see that the extension is rdf, but it's actually not an rdf file, if we do all it done on the file, here you can see it contains an MSO file, so these are all the streams inside, now I have a yarad rule, this one here contains VBE file and this yarad rule will trigger if one of the streams contains a VBE file, a VBE file is a VB script encoded, so an encoded VBS file, so we can try this out, holy dump, option jara contains VBE file and the sample and then we see here that in stream A6 it's actually the values of a form here, this contains a VBE file, well according to the jarad rule it triggered, so let's take a look inside this file, inside this stream, so select A6 like this and here we can indeed see the start of a VBE script that goes till here, we can dump this script like this, this is the script, unreadable of course, but then I have my decode VBE script to decode VBE encoded scripts to VBS like this, this is readable VBS and here you can see the URL