Kamikaze contains two different codes:
- Infection code
- Scrambled code
When an infected file is run, the virus overwrites first two uninfected files with the infection code in the current directory, and overwrites itself with the scrambled code, making it impossible to run again. If there is no more files to infect in current directory, it will search for subdirectories for further infection.
Additionally, the virus does not infect files smaller than the virus itself.
This virus uses file head overwriting technique for infection so that files overwritten by the virus is not possible to recover.
Trashed files may not be able to spread the virus due to the loss of execution ability, but they should be replaced with clean copies as soon as possible.
The virus contains an invisible payload that overwrites itself and infect other files, it triggers when an infected program is run.
The first two bytes of every EXE file are either "MZ" or "ZM", which is the identifier. The virus uses the text string "kamikaze" to overwrite the first 8 bytes of the infected file, thus to trash the file. The system will no longer recognize the trashed file properly and it would crash when that file is executed.
This virus does not stay memory resident after execution.
Every infected program contains the following text string at the beginning of the file:
Even if the user manages to recover the first two byte of a trashed file to "MZ", it would still fail to execute as it tries to use a large amount of memory, making the system to show the message without hanging the system:
Program too big to fit in memory
About the alias
It is believed that the name of the virus is referring to the term "神風" (カミカゼ, divine wind) in Japanese. The Kamikaze team is special attack unit from the Empire of Japan in World War II, who performs suicide attacks against Allied naval vessels.