sircam virus attachments

the sircam virus is the virus which sends out mail messages that look like:

Hi! How are you?

I send you this file in order to have your advice

See you later. Thanks

along with the message it sends an attachment, which contains the virus plus a random file from the victim's computer.

sircam chooses the email recipient by looking in the victim's web cache. so folks who have their email address on busy web pages tend to get a lot of sircam messages.

i've been curious what the documents looked like, they're a peek into random people everywhere. so i set about extracting the documents. here's some of the results of that effort.

-dean