diff --git a/2-4-initial-access-malware/corpus_builder/macro.vbs b/2-4-initial-access-malware/corpus_builder/macro.vbs
new file mode 100644
index 0000000..59c9efc
--- /dev/null
+++ b/2-4-initial-access-malware/corpus_builder/macro.vbs
@@ -0,0 +1,3 @@
+Sub GreetUser()
+    MsgBox "Hello from PowerShell!", vbInformation, "Greeting"
+End Sub