Threat Description

IM-Worm:​W32/Pykse.A

Details

Aliases:IM-Worm.Win32.Pykse.a, Worm.IM.Picse.A
Category:Malware
Type:IM-Worm
Platform:W32

Summary



A type of worm that spreads on vulnerable Instant Messaging (IM) networks.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



IM-Worm:W32/Pykse.A is an instant messaging worm that uses the APIR for the Instant Messaging application Skype to send messages with malicious URL links.When IM-Worm:W32/Pykse.A is executed, it will show a picture of a lightly dressed woman as below:

Note: the image has been blurred.

For related details, the F-Secure Weblog has a post on the matter.

Installation

When executed, the worm drops the following files:

  • %sysdir%\Invisible002.dll - contains most of malicious code
  • %sysdir%\system32\Skype.exe

It adds the following auto start registry entry to enable its automatic execution upon boot up:

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run SkypeStartup = "%sysdir%\Skype.exe"
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SkypeStartup = "%sysdir%\Skype.exe"

It also adds the .DLL component as a BHO (Browser Helper Object) so that once the Internet browser is loaded, the malware is also loaded simultaneously.IM-Worm:W32/Pykse.A creates the following key, to save some of its installation details:

  • HKCU\Software\SkypeWorm\cfg

It creates the following mutexes to signify each malicious routine. No duplicate mutex could be created to ensure that only these three mutexes are present in the memory at one particular time:

  • Skype Worm spreader mutex - Spreading routine
  • Skype Worm server mutex1 - Other routines
  • aaa111226 - Iexplore.exe injection

Propagation

IM-Worm:W32/Pykse.A spreads via Skype by sending a message with a malware link to all online friends in Skype' contact list using Skype API.The message is randomly chosen from the following list:

It sets the Skype user's status to DND (Do not Disturb) so that the user cannot be actively notified of incoming calls or messages.It visits the following non-malicious links:

  • http://aras.lookingat.us/index.htm
  • http://asilas.my-php.net/index.html
  • http://bobodada.3-hosting.net/index.html
  • http://bobos45.bebto.com/index.html
  • http://gogo442.hatesit.com/index.html
  • http://jackdaniels.110mb.com/index.html
  • http://timboss.1majorhost.com/index.html
  • http://zozole.php0h.com/index.html

Moreover the following site is also visited, which probably acts as a counter for the number of infected machines:

  • http://aras.allfreehost.net/c[REMOVED]nt.php


Detection


F-Secure Anti-Virus detects this malware with the following updates:
Detection Type: PC
Database: 2007-04-16_01




SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More