Dorifel (aka Quervar, XDocCrypt) is a worm that is allegedly related to the Citadel trojan. Once executed, it will search for all Microsoft Word documents on your system, including network shares. The initial infector has references to the TV series “Breaking Bad” and the movie “Scarface” The virus body is prepended to the encrypted document and the two are separated by the string:referior[scarface+++] The Netherlands have been particularly affected by this piece of malware for the past several weeks.”]
Source: https://blog.talosintelligence.com/2012/09/dorifel-aka-quervar-xdoccrypt.html