MsnSend.A
Threat LevelDamageDistribution

Effects 

The main objective of MsnSend.A is to spread via MSN Messenger and affect as many computers as possible.

Additionally, it attempts to connect to the website x.pro<blocked>sp.info , in order to send information about the computer to its author, such as its MAC address (Media Access Control), which is a hardware address that uniquely identifies each node of a network.

Infection strategy 

MsnSend.A creates the following files:

• WINLOGON.EXE, in the subfolder DLLCACHE of the Windows system directory. This file is a copy of itself.
• IMAG091307.ZIP, in the Windows directory. This file is a compressed copy of itself.

MsnSend.A creates the following entry in the Windows Registry:

• HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Run
  winlogon = %sysdir%\dllcache\winlogon.exe
  where %sysdir% is the Windows system directory.
  By creating this entry, MsnSend.A ensures that it is run whenever Windows is started.

Means of transmission 

MsnSend.A spreads via the instant messaging program MSN Messenger. In order to do so, it follows the routine below:

• The user receives one of the following instant messages and a compressed file:
  -In English:
  Check out my nice photo album. :D
  wanna see the pics from my vacation? :>
  Nice new photos of me and my friends and stuff and when i was young lol...
  lol remember when you used to have your hair like this
  My friend took nice photos of me.you Should see em loL!
  hey i'm going to add this picture of us to my weblog
  Here are my private pictures for you
  
  -In Spanish:
  ay no ese pelo fue lo mas chistoso...q estabas pensando.
  jajaja yo me recuerdo cuando tuvistes el pelo asi.
  oye ponga esa foto en tu myspace como la foto principal.
  voy a poner esa foto de nosotros en mi blog ya.
  esa foto de tu y yo la voy a poner en myspace.
  hola esas son las fotos
  jaja debes poner esa foto como foto principal en tu myspace o algo :D
  oye voy a agregar esa foto a mi blog ya.
  jaja recuerda cuando tuviste el pelo asi.
  oye voy a poner esa foto de nosotros en mi myspace :>
  
  -In French:
  faut de la reproduction sonore ! regard
  cette vieille image que j'ai trouv
  mes photos chaudes :D
  haha vous devriez rendre ceci votre d
  faut pic sur le myspace ou quelque chose :D
  j'ai fais pour toi ce photo album tu dois le voire :p
  veux tu voir mes image de vacance??
  le lol se rappellent quand vous aviez l'habitude d'avoir vos cheveux comme ceci
  je vais mettre cette image de nous sur mon myspace :>
  
  -In Italian:
  Per favore nessuno lasciare vede le nostre foto.
  Io ricordo quando abbiamo portato questa foto.
  Caricher
  questa foto al mio myspace adesso.
  Qui sono il fotos di ci.
  jaja lei dovrebbe fare quest'il suo pic predefinito sul myspace o qualcosa :Dmetta questi fotos in suo pagina myspace.
  ehi aggiunger
  quest'immagine di noi al mio weblog.
  jaja ricordo quando lei aveva i suoi capelli come questo.
  ehi metter
  quest'immagine di noi sul mio myspace :>
  
  - In German:
  chten den pics von meinen Ferien sehen?!?
  Wimmern! Blick auf diese alte Abbildung, die ich: fand!
  he ich zeige Ihnen diese Abbildung von mir
  berhaupt?
  Haha sollten Sie dieses Ihre R
  ckstellung auf myspace oder etwas pic bilden:D
  he werde ich diese Abbildung von uns meinem weblog hinzuf
  lol erinnern sich, an als Sie pflegten, Ihr Haar so zu haben!
  he werde ich diese Abbildung von uns auf mein myspace setzen!
  
  - In Dutch:
  wil je fotos zien van mijn vakantie!
  wow! moet je eens kijken welke foto ik nu gevonden heb!
  he heb je ooit deze foto laten zien ?
  haha you moet die je standaard foto maken op hyves of myspace!
  hey ik voeg deze foto van ons ff toe op mijn weblog!
  lol ik kan me nog herrinneren toen je haar zoals dit had!
  Hey i zet deze foto van ons even op mijn myspace!
  
  - In Chinese:
  ZHE SHI WO DE LUOZHAO :o QING BU YAO FA GEI BIEREN !!.
  YI ZHANG WO GEN WO PENGYOU ZUI HAO DE ZHAOPIAN :s !!.
  JIESHOU WO DE ZHAO PIAN :> !!.
  KAN WO DE ZHAOPIAN :D.
  NI HE WO !!! .... QING KAN :D.
  kAN BA LI XI ER DUN JIN JIANYU HOU SHI DUO ME QIAOCUI :<.
  
  The following image is an example:
  
  
• The ZIP file contains an executable file that if it is run, a copy of the worm will be downloaded to the computer.
• MsnSend.A sends this message to all the contacts that are active at that moment.

Further Details  

MsnSend.A is 25,600 bytes in size and it is compressed with UPX.