It reaches the computer in an e-mail message with extremely variable characteristics.
Netsky.P uses one out of two possible methods, which have different options each:
Sender:
Regardless of the method used,
Netsky.P spoofs the e-mail address from which it is sent. This may cause confusion. For further information, click
here.
Method A:Subject:
Option 1: the worm selects one of the following hard-coded items:
Re: Administration
Re: Bad Request
Re: Delivery Protection
Re: Delivery Server
Re: Encrypted Mail
Re: Error
Re: Extended Mail
Re: Extended Mail System
Re: Failure
Re: Mail Authentification
Re: Mail Server
Re: Message Error
Re: Notify
Re: Protected Mail Delivery
Re: Protected Mail Request
Re: Protected Mail System
Re: Secure delivery
Re: Secure SMTP Message
Re: SMTP Server
Re: Status
Re: Test
Re: Thank you for deliveryOption 2: the subject is a compound of words from some of the following lists:
List 1: Re:,
Re: Re:List 2: approved,
important,
my,
yourList 3: application,
approved,
bill,
corrected,
data,
details,
document,
document_all,
excel document,
file,
hello,
here,
hi,
important,
improved,
information,
letter,
message,
patched,
product,
read it immediately,
screensaver,
text,
thanks!,
website,
word documentFor example:
approved,
Re: my details,
Re: Re: important excel document,
your information, etc.
Message:
Authentication required.
I have attached your document.
I have received your document. The corrected document is attached.
Please confirm the document.
Please read the attached file!
Please read the document.
Please read the important document.
Please see the attached file for details.
Requested file.
See the file.
You have received an extended message. Please read the instructions.
Your details.
Your document is attached to this mail.
Your document is attached.
Your document is attached.
Your document.
Your file is attached.Additionally, the message could include one of the following final texts:
+++ Attachment: No Virus found
+++ MessageLabs AntiVirus - www.messagelabs.com
+++ Attachment: No Virus found
+++ Bitdefender AntiVirus - www.bitdefender.com
+++ Attachment: No Virus found
+++ MC-Afee AntiVirus - www.mcafee.com
+++ Attachment: No Virus found
+++ Kaspersky AntiVirus - www.kaspersky.com
+++ Attachment: No Virus found
+++ Panda AntiVirus - www.pandasoftware.com
++++ Attachment: No Virus found
++++ Norman AntiVirus - www.norman.com
++++ Attachment: No Virus found
++++ F-Secure AntiVirus - www.f-secure.com
++++ Attachment: No Virus found
++++ Norton AntiVirus - www.symantec.de
message
msg
details
data
document
readme
The extension of these files can be EXE, SCR or PIF. In some cases, there is a second extension, which can be DOC or TXT. In those cases, several blank spaces are included between the first and the second extension. Additionally, the attached file could be compressed in a ZIP format.
Method B:
It consists of thirty cases, each of them with several options.
The attached file is variable, and it can have a single or double extension (in this particular case, several blank spaces are included between them). Additionally, the attached file could be compressed in a ZIP format.
Case 1:
Subject: one of the following:
Protected Mail System
Mail Authentication
Message: one of the following:
Encrypted message is available.
Protected message is attached.
Attachments: it has one of the following file names:
DOCUMENT, ENCRYPTED_MSG01, MESSAGE, MSG, PGP_SESS01
Case 2:
Subject: one of the following:
Re: Approved document
Re: Your document
Message: one of the following:
Please read the attached file.
Your document is attached.
Attachments: it has one of the following file names:
ABOUT_YOU, ALL_DOC01, APPROVED, CORRECTED, DOCUMENT, DOCUMENT04, FILE, IMPROVED, MSG, YOUR_DOCUMENT.
Case 3:
Subject: one of the following:
Re: Is that your document?
Is that your password?
Message: one of the following:
Can you confirm it?
I have attached it to this mail.
Attachments: it has one of the following file names:
DOCUMENT, PWD02, DOCUMENT01, PART6, PRIVATE_01
Case 4:
Subject: one of the following:
Mail Delivery (failure)
Error
Message: one of the following:
Binary message is available.
Message has been sent as a binary attachment.
Attachments: it has one of the following file names:
DATA, EMAIL, LETTER, MESSAGE, MSG
Case 5:
Subject: one of the following:
Hello
Hi
Message: one of the following:
Try this game ;-)
I hope the patch works.
Attachments: it has one of the following file names:
APPLICATION, GAME, PATCH3425, SOFTWARE
Case 6:
Subject: one of the following:
Private document
Stolen document
Message: one of the following:
I found this document about you.
I cannot believe that.
Attachments: it has one of the following file names:
ABOUT_YOU, DOCUMENT342, YOUR_DOCUMENT
Case 7:
Subject: one of the following:
Re: Hi
Re: Its me
Message: one of the following:
I have attached your file. Your passwor is jkl44563.
The file is protected with the password ghj001.
Attachments: it has one of the following file names:
DATA20, DOCUMENT, DOCUMENT43, LETTER32, MAILS9, MY_DETAILS, PRIV, YOUR_DOC
For further information about the rest of the cases, click here.Netsky.P searches for e-mail addresses in the files that have the following extensions XML, WSH, JSP, DHTM, CGI, SHTM, MSG, OFT, SHT, DBX, TBB, ADB, DOC, WAB, ASP, UIN, RTF, VBS, HTML, HTM, PL, PHP, TXT and EML.