It reaches the computer in a message with variable characteristics:
Sender:
Bagle.AB spoofs the e-mail address from which it is sent. This may cause confusion. For further information, click
here.
Subject: one of the following:
Changes..
Encrypted document
Fax Message Received
Forum notify
Hidden message
Incoming message
New changes
Notification
Protected message
Re: Document
Re: Hello
Re: Hi
Re: Incoming Message
RE: Incoming Msg
RE: Message Notify
Re: Msg reply
RE: Protected message
RE: Text message
Re: Thank you!
Re: Thanks :)
Re: Yahoo!
Site changes*
Message: it is usually blank. However, if the attached file has a
ZIP extension, it will be protected by a
password, and it will include any of the following texts:
Archive password: %key%
Attached file is protected with the password for security reasons. Password is %key%
For security purposes the attached file is password protected. Password -- %key%
For security reasons attached file is password protected. The password is %key%
In order to read the attach you have to use the following password: %key%
Note: Use password %key%
to open archive.Password - %key%
Password: %key%
where
%key% stands for an image file with a
BMP extension. This file contains the password needed in order to decompress the attached file.
For example, this image could be the following one:
Attachments: it has variable name and extension:
Possible names:
ALIVE_CONDOM, COUNTER_STRIKE, DETAILS, DETAILS, DOCUMENT, HALF_LIVE, I_SEARCH_FOR_YOU, INFO, INFORMATION, JOKE, LOVES_MONEY, MANUFACTURE, MESSAGE, MOREINFO, NERVOUS_ILLNESSES, README, SMOKE, TEXT_DOCUMENT, THE_MESSAGE, THE_MESSAGE, TOY, YOU_ARE_DISMISSED, YOU_WILL_ANSWER_TO_ME, YOUR_COMPLAINT, YOUR_MONEY.
Possible extensions:
COM, CPL, EXE, HTA, SCR, VBS, ZIP.
If the attached file has a
ZIP extension, besides a copy of the worm with a random name, it will contain another file with a random name and one of the following extensions:
BAT, DLL, DOC, TXT, VXD. This file will have random characters.