Threat Description

Evaman.A

Details

Aliases:W32/Evaman.A
Category:Malware
Type:Worm
Platform:W32

Summary



Evaman.A is a simple massmailer. It sends itself in emails appearing to be error messages.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



The Evaman.A worm is packed with an unmodified version of UPX. Once extracted its size grows up to 40960 bytes. Once executed it creates a mutex named "MyNameIsEva" to ensure only a single copy of the worm is running.

System Infection

Upon execution Evaman copies itself files to the Windows System Directory:

%SysDir%\wintasks.exe

'Readme.exe' is added to the registry as:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
 "wintasks.exe"= %SysDir%\wintasks.exe

to ensure that the worm will be activated when Windows starts.

Email Propagation

Evaman has its own SMTP engine. When sending email it will create recipient addresses containing usernames form the following list:

Mike
 Jennifer
 David
 Linda
 Susan
 Nancy
 Pamela
 Eric
 Kevin
 Mary
 Jessica
 Patricia
 Barbara
 Karen
 Sarah
 Robert
 John
 Daniel
 Jason
 Joe

The infected emails can have any of the following subjects:

returned mail


 failure delivery


 failed transaction


 server error


 mail failure


 Delivery Status (Failure)

The body of the message will be chosen from the following list:

This is an automatically generated Delivery Status Notification.
 Delivery to last recipient failed.
 Email returned as attachment text file.


 Message from Mail Delivery Server.
 Unable to deliver message to last recipient.
 Email returned as text file.


 Email returned by the server as ASCII Text mail file.
 To read the email download the included attachment.


 Mail Server Notice:
 Last email sent could not reach intented destination.
 Email returned as ASCII text file.


 The last email sent by this account could not reach intended destination.
 Email has been returned as text file attachment.


 Mail Delivery Status Notification:
 Message returned by server. Message returned as text file attachment.

Based on the computer uptime obtained through GetTickCount, with 80% probability the attachment name will be:

A + "." + B

Where A and B are any of a list of words. A can take the values "body", "message", "email". And B any of "scr", "txt.scr" or "html.scr".

With 10% probability the attachment name will be composed in the same form as just described, but the list A is augmented with "text" and "document" and B with "outlook.scrtxt.exe".

This last value "outlook.scrtxt.exe" is, most likely, a mistake of the author, who probably intended to write "outlook.scr" and "txt.exe". If the worm attempts to use the unexisting last string, it might lead to unexpected behavior such as an invalid memory access, therefore leading Windows to terminate the task.



Detection


Detection in F-Secure Anti-Virus was published on July 5th, 2004 in update:
Detection Type: PC
Database: 2004-07-05_02



Description Created: Ero Carrera, July 5th, 2004
Technical Details: Ero Carrera, July 5th, 2004


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Disinfect your PC

F-Secure Anti-Virus will disinfect your PC and remove all harmful files

Learn More