It reaches the computer in a message with variable characteristics. These messages can be written according to different formats:
Format 1:Sender:
Bagle.AA spoofs the e-mail address from which it is sent. This may cause confusion. For further information, click
here.
Subject: one of the following:
Encrypted document
Fax Message Received
Forum notify
Hidden message
Incoming message
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Fax
Re: Incoming Message
Re: Msg reply
RE: Protected message
RE: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo!
Request response
Site changesMessage: it can be blank, or one of the following:
Attached file tells everything.
Attached file will tell you everything.
For details see the attach.
For more information see the attached file.
Further details are in attach.
Here is the file.
Message is in attach
More info is in attach
Please, have a look at the attached file.
Read the attach.
See attach.
See the attached file for details.
Your file is attached.In addition, if the attached file has a
ZIP extension, it will be protected with a
password. The message will include any of the following texts:
Archive password: %key%
Attached file is protected with the password for security reasons. Password is %key%
For security purposes the attached file is password protected. Password -- %key%
For security reasons attached file is password protected. The password is %key%
In order to read the attach you have to use the following password: %key%
Note: Use password %key%
to open archive.Password - %key%
Password: %key%
where
%key% stands for an image file with a
BMP extension. This file contains the password needed in order to decompress the attached file.
For example, this image could be the following one:
Attachments: it has a variable name and extension:
Possible names:
DETAILS, DOCUMENT, INFO, INFORMATION, MESSAGE, MOREINFO, README.
Possible extensions:
COM, CPL, EXE, HTA, SCR, VBS, ZIP.
If the attached file has a
ZIP extension, besides a copy of the worm with a random name, it will contain another file with a random name and one of the following extensions:
BAT, DLL, DOC, TXT, VXD. This file will have random characters.
Format 2:Sender:
Bagle.AA spoofs the e-mail address from which it is sent. In order to do so, it collects e-mail addresses from the affected computer and changes the recipient's name to any of the following:
ann, annie, christina, christy, jessie, lizie, secretGurl.
Example: if the address is
user@email.com, the spoofed address could be
ann@email.com,
annie@email.com, etc.
Subject: one of the following:
Hello!
Hey!
I just need a friend
I like you
I'm a sad girl...
I'm bored with this life
Let's socialize, my friend!
Let's talk, my friend!
Notify from a known person ;-)Message: it consists of five parts:
(1) Greetings: one of the following:
%recipient%
,Dear %recipient%
,Dear %recipient%
,
Hello %recipient%
,Hello,Hey %recipient%
,Hey %recipient%
,Hey,
HiHi %recipient%
,Hi,
It's me ;-)
It's me ->where
%recipient% is the name of the recipient in the e-mail addresses. This name precedes the character @.
(2) Image: includes a picture in a file with a
JPEG format and one of the following names:
IMAGE12, ME2, ME3, MYPHOTO4, MYPHOTO7, PHOTO. Some of these images are:
(3) Message: one of the following:
Cometime I write a poem, play the gitar. I love a traveling, I like a romantice and I want to meet, comeday, my big love!
Don't you remember me?
I am a beautiful, sexual girl with very big ambitions and dreams. I can make happy anyone man...
I am a honest, kind,loving,with good sense of humor...etc.,looking for true love... or maybe for pen friend.I like cats.
I am a student. I'm studying international relationships. I would like to find an interesting and active man for serious relations. Sitting at home it is not for me. I like to go out to the theater, cinema, and nightclubs.
i am honest, responsible, romantic person. iwould like to find my only love,to find my destiny.
I am kind, fair, careful, gentle also want to create family. I love animal (cats, dogs), the literature, theatre, cinema, music, walks in park .
I am looking for a serious relationship. I am NOT interested in flirt and short-term love adventure.
I am simple girl who are looking for serious relation with responsible and confident man. I am ready to give all my love and carering for a right person who is going to love and respect me
I have recently got demobilize from army and also I am going to act in a higher educational institution
I just want to talk with someone...
I like an active life... and interesting people...
I like reading the books and socializing, let me talk with you...
I like to feel protected, to understand, that near to me the man, which both in sex, and in life knows what to do. It is possible to fall in love with such the man for ever.
I Like You!
I love productive leisure, to travel, communicate with friends.
I love, as the good company, and I dream about romantic appointment at candles with loved. I still believe in love.
I need a friend...
I study at school, I like to spend time cheerfully even if not all so well, I hompe and trust, that all bad when nibud will pass and necessarily nastanet there would be a desire.
I very much love new acquaintances, I love music, meetings with friends. I go on night clubs, except for parties I sometimes visit theatres and I love cinema. In general I only shall be glad to new acquaintance and class dialogue...
I very much love productive leisure, to prepare for new exotic dishes, at leisure to leave with friends on the nature, to float, I like to go for a drive on mountain skiing, to visit excursions, travel. Very easy going.
I'm a young lady of 20 years old i'd like to find my second part!!!
I'm so bored, let me talk with you...
It's time to find a friend!
Kewl :-)
Like me, odore me! ;-)
Ready to accept a new friend? :-)
Searching for the right person,for real man, who will really cares and love me.
You are cool :-)
You are my prince :-)(4) Reference to the attached file: one of the following:
Attached file tells everything.
Attached file will tell you everything.
For details see the attach.
For more information see the attached file.
Further details are in attach.(5) Close: one of the following:
Best wishes,%sender%
Cheers,%sender%
Have a good day, %sender%
Kind regards, %sender%
Sincerely, %sender%
Yours, %sender%
where
%sender% is the name of the recipient, which precedes the character @ in the e-mail address.
Attachments: it has a variable name and extension:
Possible names:
DETAILS, DOCUMENT, INFO, INFORMATION, MESSAGE, MOREINFO, README.
Possible extensions:
COM,
CPL,
EXE,
HTA,
SCR,
VBS,
ZIP.
The icon of this file contains three cherries.