value:  The author of GravityRAT submitted samples to VirusTotal for testing showing that the author modified the code to try to hide the DDE object in a different part of the document. 
name: Obfuscated Files or Information: Indicator Removal From Tools