After searching with base64dump for encoded strings in this maldoc sample, I decided to add an option to base64dump to check all encodings automatically.
Use option -e with value all to try out all encodings, and report all found strings ordered by increasing length. And with option -u, you can limit the output to unique decoded strings.
zipdump.py -s 5 -d output.docx.vir.zip | base64dump.py -e all -u
Source: Didier Stevens @ February 21, 2017 at 05:00PM