E-Mail Propagation
Nimda sends itself to e-mail addresses found in InBox and Address Book
- MIME-encoded, 56KB attached file named readme.exe
- Second section of file ("audio/x-wav") contains worm
- Long, repetitive subject line
E-mail clients using IE 5.1 or earlier to display HTML will automatically execute the attachment if the message is opened or previewed.