FRISK Software International

Summary of W32/Sobig.B@mm
Alias:Palyh, Mankx
Discovered: 19 May 2003
Definition files: 19 May 2003
Risk Level: Medium
Infection Method:Mass mailing and network shares
Jump to:
Brief description
Technical description

Brief Description
W32/Sobig.B@mm is a mass mailer that can copy itself over local network. It is UPX packed and is written in Visual C++.

Technical Description
The first thing the worm does after it has been executed is to copy itself to the windows directory under the following name

It creates the following registry keys to ensure that each time the computer is restarted the worm is executed.
"System Tray = %WindowsDir%\msccn32.exe"

"System Tray = %WindowsDir%\msccn32.exe"

The worm enumerates all the network drives and if the following folders are on the network drive it copies itself there.
Windows\All Users\Start Menu\Programs\StartUp
Documents and Settings\All Users\Start Menu\Programs\Startup

The worm searches the local drive for files with the following endings and harvests from them email addresses.

It uses its own SMTP engine to send the emails and composes the messages from the following objects. In the from field there is always

Then the subject is chosen from the following list.
Your details
Approved (Ref: 38446-263)
Re: Approved (Ref: 3394-65467)
Your password
Re: My details
Cool screensaver
Re: Movie
Re: My application

Message body is always:
All information is in the attached file.

And the attached file name is chosen from the following list:

The worm attempts to download four files from the internet. Currently the domain owner has closed these links so the worm is unable to do so.

Analysis / Description: Ragnar Gisli & Sigurdur A. Stefnisson FRISK Software international

Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:


perComp Verlag
(in German)