W32.Blackmal.E@mm – Kama Sutra Worm – Category 2 Threat

W32.Blackmal.E@mm – Kama Sutra Worm – Category 2 Threat

W32.Blackmal.E@mm is a mass-mailing worm that is also referred to as the “Kama Sutra worm” due to the content contained in some of the e-mails it sends out. The worm attempts to spread through network shares and lower security settings. On the third day of every month it attempts to rewrite files with certain extensions with custom text.
Also Known As

CME-24, Win32.Blackmal.F [Computer Associates]
Email-Worm.Win32.Nyxem.e [F-Secure]
Email-Worm.Win32.Nyxem.e [Kaspersky]
W32/MyWife.d@MM [McAfee]
W32/MyWife.d@MM!M24 [McAfee]
Win32/Mywife.E@mm [Microsoft]
W32/Small.KI@mm [Norman]
Tearec.A [Panda Software]
W32/Nyxem-D [Sophos]
WORM_GREW.{A, B} [Trend Micro]

Contains Subject As
*Hot Movie*
A Great Video
Fw:
Fw: DSC-00465.jpg
Fw: Funny
Fw: Picturs
Fw: Real show
Fw: SeX.mpg
Fw: Sexy
Fwd: Crazy illegal Sex!
Fwd: image.jpg
Fwd: Photo
give me a kiss
Miss Lebanon 2006
My photos
Part 1 of 6 Video clipe
Photos
Re:
School girl fantasies gone bad

Message body:
Note: forwarded message attached. You Must View This Videoclip!
>> forwarded message
Re: Sex Video
i just any one see my photos.
It’s Free
The Best Videoclip Ever
Hot XXX Yahoo Groups
Fuckin Kama Sutra pics
ready to be FUCKED
forwarded message attached.
VIDEOS! FREE! (US$ 0,00)
What?
i send the file.
Helloi attached the details.
Thank you
the file i send the details
hello,
Please see the file.
how are you?
i send the details.

Attachment:
007.pif
392315089702606E-02,.scR
677.pif
Adults_9,zip.sCR
Arab sex DSC-00465.jpg
ATT01.zip.sCR
Attachments[001],B64.sCr
Clipe,zip.sCr
document.pif
DSC-00465.Pif
DSC-00465.pIf
eBook.pdf
eBook.PIF
image04.pif
New Video,zip
New_Document_file.pif
photo.pif
Photos,zip.sCR
School.pif
SeX,zip.scR
Sex.mim
Video_part.mim
WinZip,zip.scR
WinZip.BHX
WinZip.zip.sCR
Word XP.zip.sCR
Word.zip.sCR
04.pif
DSC-00465.Pif
DSC-00465.pIf
image04.pif

The attachment may be an executable file or a MIME file that contains an executable file. Those attachments that are MIME files may have the following file names:

3.92315089702606E02.UUE
Attachments[001].B64
Attachments00.HQX
Attachments001.BHX
eBook.Uu
Original Message.B64
Sex.mim
SeX.mim
Video_part.mim
WinZip.BHX
Word_Document.hqx
Word_Document.uu

These files may also have one the following file names:

392315089702606E-02
Clipe
Miss
Photos
Sweet_09

These file names will be combined with one of the following extensions:

.b64
.BHx
.HQX
.mim
.uu
.UUE
.XxE

If the attachment is a MIME file, it may contain a file with one of the following file names:

392315089702606E-02,UUE[BLANK SPACES].scr
Adults_9,zip[BLANK SPACES].scr
ATT01.zip[BLANK SPACES].scr
Atta[001],zip[BLANK SPACES].scr
Attachments,zip[BLANK SPACES].scr
Attachments[001],B64[BLANK SPACES].scr
Clipe,zip[BLANK SPACES].scr
New Video,zip[BLANK SPACES].scr
Photos,zip[BLANK SPACES].scr
SeX,zip[BLANK SPACES].scr
WinZip,zip[BLANK SPACES].scr
WinZip.zip[BLANK SPACES].scr
Word XP.zip[BLANK SPACES].scr
Word.zip[BLANK SPACES].scr