Malicious documents that drop VBE scripts (VBScript Encode scripts) are in the wild. Here is an example:
I have a YARA rule to detect VBE scripts:
yara-rules-V0.0.6.zip (https)
MD5: 01CB37759AC30EEA8D2B66226609C73E
SHA256: 1B56C1D7D0E1A8F500674B74F93F3E7DE6B2EFC85259ABE3A57F1DCA458CCFF8
Didier Stevens 