hello everyone today we're taking a look
at the Maya macro virus now
unfortunately with this virus we really
can't hope to top the amazingness that
was the memes troan from a couple weeks
ago so consider this more of a return to
form to the classic malware videos that
I've made before so this is actually an
email worm macrovirus hybrid similar to
Melissa so we're going to go and receive
an infected email in our
inbox and we got two of them for some
reason but anyway subject is high and
it's Daniel and it would fill in the uh
user's name from the computer in the
subject basically get a message saying
this is the new net story it's great and
then the attached macrovirus itself so
we'll go ahead and run this and as we
can see it is trying to massmail itself
through Outlook we'll say sure go for
it and wait for this to go ahead and
finish up so we can say yes just a
Outlook precaution here and if we look
in our outbox now we have two Conta s
here and we should see yep it is
emailing them to both so both of these
contacts including wi are now getting
the new net story it's great so go ahead
and look at what this worm has done we
go a and look on our computer here we
can see it has created a new folder
called Maya with a hello. text we look
at it tells us it's the first worm
written by this author and its name is
Maya how special the virus in addition
to spreading through email also attempts
to spam itself to every channel you join
using MRC we have a dummy MRC folder
here but it is automatically tried to
overwrite the script. inii file and when
we look at it every time you join
doesn't try to send to yourself but it
tries to send the maya. dooc file that
it dropped to the windows directory to
everybody in the channel so just another
way of trying to spread itself one quick
little payload with this virus AC
activates on the fifth of every month
when an infected document is closed go
ahead and look at our infected file here
in the windows
directory there it is and we will say no
to the emails once again but on the
5ifth of the month whenever an infected
file is closed in word get a message box
telling us it is coded by Pedic
copyright
2001 finally there's just one last thing
to look at before we take a look at the
final and sort of annoying payload
basically in the summary of this
file that I dropped it tells us that
it's w macro 97 Maya written by Pedic
once again monster for the company mayia
B to grow and to my best girlfriend how
sweet cuz you know your girlfriend
always wants a virus in your email last
thing to take a look at here is that
this worm actively tries to discourage
you from looking at its code in the
Visual Basic editor so it's constantly
looking to see if you're going to launch
this editor and if you do tells you
carry osity is bad with her small size
Maya is always always there press okay
you can still view it so I mean here's
the code go nuts pause the video rewrite
it if you want I don't really
care but we can see at the end here it
writes a registry
key that disables your mouse so we'll go
ahead and restart and see what that does
if we don't mess up the code on our own
so we've booted back into windows and uh
now my mouse is completely stuck in the
top left corner of the screen and I
cannot move it so hopefully you're
pretty proficient with your keyboard
control escape to launch the start menu
go into reg edit and we will remove that
key that the virus
dropped so
basically
Microsoft Windows current version
run so here we can see May attack run
dll 32 Mouse disable if we delete this
and then
restart our Mouse will be back to normal
so not D I just killed the VM by
accident um oops but thankfully the
video was pretty much done anyway so
that is about it for the
Maya macro virus I apologize if I seemed
pretty scatterbrain during this video I
didn't really have a strong uh outline
of how I wanted to record this going
into it and I'll see you next week
thanks for
watching so send and receive and we
don't get anything why not why aren't we
getting the email