AplS/Simpsons-A is the first AppleScript worm. AplS/Simpsons-A uses the scripting functionality of Outlook Express or Entourage to send itself via email to contacts in an infected user's address books. To mask its activity the worm points Internet Explorer 5 to http://www.snpp.com/episodeguide.html, a website with information about the TV comedy show "The Simpsons". The worm arrives as an email with two attachments and the following text:
"Hundreds of Simpsons episodes were just secretly produced and sent out on the internet, if this message gets to you, the episodes are enclosed on the attachment program, which will only run on a Macintosh. You must have system 9.0 or 9.1 to watch the hilarious episodes, in high quality. Just download and open it.
From, <name of the sender>"
The attached files are 'Secret Simpsons Episodes!' and 'Simpsons Episodes'. The first file is a MIME copy of the email and the second file contains the viral script. Once run it will place itself in the Startup Items folder in order to automatically run.