Summary

We got several reports about Wallon worm on May 11th, 2004. The worm sends HTML-based messages via e-mail. These messages contain links that use Yahoo redirection service to direct users' web browsers to the website where there's a script that downloads and runs additional worm's components.

Additional Details

Wallon is an email worm that does not send itself as an attachment. Instead it sends a link in a HTML message. The link is made to look like a link to Yahoo pages, and once user clicks on the link, it uses the Yahoo redirection service to open another web page that downloads "terra.html". The "terra.html" contains an encypted link to another "count.html" page. This page uses the object data vulnerability to downloand and run the "sys.chm" file. The "sys.chm" file uses the XMLHTTP/ADODB to download a binary file called "sys.exe". This file overwrites the Windows Media Player file "wmplayer.exe".

The downloaded "sys.exe" binary will be executed whenever a user opens Windows Media Player either directly or via a web page.

The SYS.EXE file is a downloader. It downloads a file called NOT.EXE and puts it as ALPHA.EXE into the root folder of C: drive. Then this file is activated. Additionally the downloader changes startup search pages of Internet Explorer to point to the following website: www.google.com.super-fast-search.apsua.com

The main worm's file ALPHA.EXE is a PE executable about 150 kilobytes long packed with ASPack file compressor.

When the worm's file is run, it checks the value of the following Registry key:

 [HKCU\SOFTWARE\Microsoft\Internet Explorer\Main]
 "Wh" = ?

If the value is equal to 'Yes', the worm waits for 5 hours and then opens the pixpox.com website with the default web browser. Then the worm keeps opening that website every 10 minutes and does it 10 times.

If that Registry key doesn't exist, the worm creates it. Then it reads user's SMTP settings from the Registry, locates and opens a WAB (Windows Address Book) file and sends e-mail messages to all found addresses. E-mails sent by the worm look like that:



The link contains the domain name of a recipient.

The worm doesn't send e-mails to addresses that contain any of the following substrings:

 microsoft
 support
 software
 webmaster
 postmaster
 admin
 +

Additionally the worm sends an empty message to the 1@600pics.cjb.net address. This may be done to collect e-mail addresses of people whose computers are infected by the worm.

If user's Address Book is empty, an error messagebox is shown. On our test system it looked like that:

Detection

Detection for the main Wallon worm component was published on May 7th, 2004 in the following F-Secure Anti-Virus updates:

[FSAV_Database_Version]
Version=2004-05-07_01

Detection for additional Wallon worm components was published on May 11th, 2004 in the following F-Secure Anti-Virus updates:

[FSAV_Database_Version]
Version=2004-05-11_04

Technical Details: Alexey Podrezov, Sami Rautiainen and Katrin Tocheva, May 11th, 2004;