W97M/Nail will start a new MAPI session and logon as the current user.
It will use a random number to select the message out of four
1. Subject: Good Times
Text: New information on this apparent hoax..
2. Subject: New Developments
Text: I thought you should know about this recent development...
3. Subject: WWIII!
Text: Check out CNN.Com or read this
4. Subject: Market share tipoff...
Text: Please don't share this information with anyone
Next, it will add the name of the user to the end of the message.
After that, the worm will add the message to the outbox and collect
every address from the user's address book. The worm will add all
collected addresses to the receiver of the message and attachs itself
(ActiveDocument) to the message. This way the users who receive the
attachment and open it with Microsoft Word 97 will spread the worm to
the users from their address book.
The worm will also create another message from the collected address
book and a random message from user's inbox. This message will be sent
to an email address (firstname.lastname@example.org) which probably belongs to
the virus writer.
Finally it will send both messages and close the MAPI session.
The virus code contains this comment:
Automated Chain Mail v0.1
[Analysis by Katrin Tocheva and Sami Rautiainen, F-Secure]