This worm is capable of propagating through email and Internet Relay Chat (IRC).
To spread via email, it sends out copies of itself as attachments to all addresses saved in the Windows address book (WAB) by using MAPI functions. But since MAPI functions are typically available with Microsoft Outlook, it fails to spread using the MAPI routine on machines without Microsoft Outlook installed.
The email message it sends has varying subjects, message bodies, and attachment file names. Below is the screenshot of an email it sends out:
To propagate via IRC, this worm checks if an IRC application is active on the machine and then tries to connect to certain IRC servers. Once connected, it uses a specific list of nick names.
It then displays a particular list of messages and URLs, most of which are malicious and have adult-related contents.