{
	"id": "8e3136ab-d26f-4c04-a67e-bea8bb953d6c",
	"created_at": "2026-04-06T00:15:53.046807Z",
	"updated_at": "2026-04-10T03:21:04.965453Z",
	"deleted_at": null,
	"sha1_hash": "0ab61566c20514b49e6ce98c5ae967cad6a00000",
	"title": "MyDoom (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 28942,
	"plain_text": "MyDoom (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 13:36:43 UTC\r\nWhen executed, the worm opens up Windows' Notepad with garbage data in it. When spreading, the infectious\r\nemail used to distribute the worm copies use variable subjects, bodies and attachment names.\r\nThe worm encrypts most of the strings in it's UPX-packed body with ROT13 method, i.e. the characters are\r\nrotated 13 locations to the right in the abecedary, starting from the beginning if the position is beyond the last\r\nletter.\r\nMydoom also performs a Distributed Denial-of-Service attack on www.sco.com. This attack starts on 1st of\r\nFebruary.\r\nThe worm opens up a backdoor to infected computers. This is done by planting a new SHIMGAPI.DLL file to\r\nsystem32 directory and launching it as a child process of EXPLORER.EXE.\r\nMydoom is programmed to stop spreading on February 12th.\r\n[TLP:WHITE] win_mydoom_auto (20251219 | Detects win.mydoom.)\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom"
	],
	"report_names": [
		"win.mydoom"
	],
	"threat_actors": [],
	"ts_created_at": 1775434553,
	"ts_updated_at": 1775791264,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0ab61566c20514b49e6ce98c5ae967cad6a00000.pdf",
		"text": "https://archive.orkl.eu/0ab61566c20514b49e6ce98c5ae967cad6a00000.txt",
		"img": "https://archive.orkl.eu/0ab61566c20514b49e6ce98c5ae967cad6a00000.jpg"
	}
}