When the virus is in memory, it hooks INT 21h to infect any executable file and OVL files that are being read or used. Like the original Jerusalem, infected files occasionally become corrupted.
Sunday is less easily identified than the original Jerusalem, in part because of corrected errors and in part because its payload is poorly written and fails to execute.
The executable files increase by size. The COM format would increase by a set amount, while those in EXE format increase by somewhere between that amount and 9 or 10 bytes less. Unlike the original Jerusalem, files will not be infected many times.
Infected files will contain the string:
Today is SunDay! Why do you work so hard? All work and no play make you a dull boy! Come on! Let's go out and have some fun!
The capitalization of "Sunday" is reported variously as "Sunday" or "SunDay", and may depend on the variant.
Because of an error in coding, the virus fails to execute its payload, intended to set off on Sundays of every year other than 1989. This is to print the previously indicated text on the screen and then delete all files run while the virus is memory resident, as the original Jerusalem did every Friday the 13th.