AutoNew macro

AutoNew runs automatically when a NEW document is created from a Word template. Template-infecting macro viruses spread through it: the virus writes itself into Normal.dot, and every document created afterwards is infected on creation. Rated LOW because it is a capability/context marker, not evidence of malice: it says the macro runs without the user pressing anything. Benign templates use these triggers legitimately, so a real dropper still convicts on its Shell/download/LOLBin signal — this trigger is never the sole malicious signal.