our theme doesn't have any malware as it's passed strong security reviews
You can download theme from themeforest and check it, you will see that there is no such code there.
wp_vcd is well known virus of wordpress. Usually, you can get it when you used any nulled plugins on site early (or use it now). Sometimes, it can be infected server, especially if you use shared hosting.
You can find info about this type of virus in google, the same as info how to clean site from malware