Benign Download

Trojan.BAT.Catbat.a

Shell command execution capabilityReferences or resolves Windows Startup folder

SHA-25662086f689ef6d9d7d7a00b8d37ad526ee590d2d942f007547b86dc9f485dbda7

Evidence

English function-word token "and" lines 1–14

1rem This simple non-destructive virus written by trouble1
2rem Batch files can never be replaced. There is a place and use
3rem for them.
4rem cat.bat
5rem for XP
⋯9 lines

Windows Script Host executable reference lines 18–32

18:34…   (il),-''  (li),'  ((!.-'
19echo Wscript.Sleep 3000> sleep.vbs
20start /w wscript.exe sleep.vbs
21cls
22echo.
23echo.
24echo.
25echo.
26echo.
27echo                            Vbs script timer was created to
28echo                              give the messages a pause.                               
29start /w wscript.exe sleep.vbs
30cls
31echo.
32e …

English function-word token "that" lines 73–81

73:54… ple who say
74echo                               that Batch is for newbies.
75start /w wscript.exe sleep.vbs
76cls
⋯5 lines

English function-word token "this" lines 110–112

110:3… ho                                Should I Make this virus 
111echo                              run everytime windows starts?
112echo                   …

Windows Start Menu Startup directory reference lines 112–121

112:80…                  
113copy %0 "c:/Documents and Settings\All Users\Start Menu\Programs\Startup
114start /w wscript.exe sleep.vbs
115cls
⋯6 lines