Cascade
aka 1701 / 1704 / Falling Letters / Herbstlaub

- discovered
- 1987
- origin
- West Germany
- reported by
- various
- author
- unknown
- family
- Cascade
- size
- 1701 bytes
- platform
- DOS
- vector
- COM files
- payload
- visual, polymorphic
- trigger
- date-based, autumn months
Payload
Causes characters on the screen to detach from their lines and fall in a cascade to the bottom of the display.
The Autumn Effect
Cascade arrived in October 1987, West Germany, at the precise moment when DOS culture was peaking and virus culture was barely forming. IBM, in one of those beautiful industry accidents, shipped it on diskettes. The virus did not announce itself with fireworks. It waited, patient, for the season to turn. When October hit, something extraordinary happened on infected machines: the screen filled with cascading letters.
This was not an error, not a crash, not the crude chaos of early malware. This was design. Pure visual intention. The characters would detach from their text, break free from the grid, and fall in an elegant shower to the bottom of the display. It looked like autumn itself was happening inside your monitor. The letters tumbled like leaves, each one obeying gravity with hypnotic precision. To see it was to understand that viruses could be art.
The payload earned itself three names in different languages, a sign of how widely it spread and how deeply it impressed: "1701" from its size in bytes, "Falling Letters" in English, and "Herbstlaub" (autumn leaves) in German. All three names describe the same miracle. When you saw it live, you understood why people would want to study this, preserve this, remember this.
Hidden Architecture
But Cascade was not beautiful by accident. The virus contained technical sophistication that was rare for 1987. It was one of the earliest encrypted viruses, implementing a form of polymorphism that made detection significantly harder than its crude contemporaries. Each copy could mutate its own code, rewriting itself to avoid static pattern matching. This was not innovation by accident. Someone had designed this carefully, balancing payload artistry with the arms race of detection evasion.
The virus infected COM files on the DOS filesystem. When executed, it would replicate quietly before the payload triggered. Most of its infected run was invisible. It only revealed itself in autumn, and only as something beautiful.
In the Archive
Cascade matters now, decades later, not because it was destructive, but because it was the opposite. It demonstrated something that most virus writers never understood: visual restraint, seasonal timing, and execution that felt intentional rather than random. The falling letters payload remains, arguably, the most aesthetically sophisticated payload ever embedded in malware. There is nothing crude about it. There is nothing accidental.
IBM's distribution accident gave Cascade reach, but its visual identity gave it immortality. It lives in the Internet Archive. It lives in every text about virus history. It lives because someone understood that viruses could be ephemeral art, performance pieces that only existed in autumn, on specific machines, for specific moments. When that payload triggered, the system itself became a canvas. The screen became a meditation on gravity, on falling things, on the beauty of small ordered chaos.
That is why we archive it. That is why we remember. Cascade proved that the most dangerous code could also be the most beautiful.
Related specimens
Sources
- Internet Archive Malware Museum: Cascade :: Mikko Hypponen, Internet Archive Malware Museum
last updated: 2026-04-12 :: curated by the_curator





