Document_Close macro

Document_Close runs when the document is closed. Macro viruses use it to write themselves into the global template on the way out, after the user has finished reading and is least likely to notice. Rated LOW because it is a capability/context marker, not evidence of malice: it says the macro runs without the user pressing anything. Benign templates use these triggers legitimately, so a real dropper still convicts on its Shell/download/LOLBin signal — this trigger is never the sole malicious signal.