Win32/Coke.22231.A was sent to several anti virus researchers at the
end of May 1999.
Coke works on Windows 95 and 98 (its bugs will not let it work too
long on Windows NT, but it is able to infect files under NT). The
virus infects both Portable Executable applications and Office 97
documents and it is polyrmohic in both cases. Its first polymrophic
decryptor is placed in the code section of the PE applications in 8
pieces similarly to the One_Half virus. Coke is slow polymorphic,
multi-threaded and uses multi-layered polymorphism and encryption in
PE applications.
The virus is able to mass mail itself to several locations. This can
happen when the user sends a mail. The virus hooks a MAPI function and
attaches an infected attachment to all out going mails from the
machine. Additionally the virus sends a mail with an infected
attachemnt each time when the user visites a web page which has a
"mailto" reference. The virus keeps a CRC32 list in a file on the
machine about the addresses it sent itself too. Therefore only one
copy will be posted to each locations.
There is nothing really new in this virus, but the combinations of all
these techniques makes it uniqe and very complex.
