- http://isc.sans.org/diary.php?storyid=1988
Last Updated: 2006-12-30 14:56:55 UTC
"…Variants of the email containing the postcard.exe attachment as previously reported*. These variants may be changing the subject lines, but are definitely changing the executable name. Reported name variants are "greeting card.exe", "greeting postcard.exe" and "GreetingCard.exe"… Unable to independently validate whether or not this variation is now widespread and the AV sites don't seem to be mentioning it yet…"
* http://isc.sans.org/diary.php?storyid=1987
- http://isc.sans.org/diary.php?storyid=1988
Last Updated: 2006-12-30 16:59:04 UTC
"…Update 1655 UTC: Several respondants have confirmed… Known variations are as follows:
postcard.exe
Postcard.exe
greeting card.exe
Greeting Card.exe
greeting postcard.exe
Greeting Postcard.exe
Subject lines appear to be changing with a much larger bank of possibilities. I anticipate AV vendors will begin to ducment this. A list was provided by reader Diego. This is a good start, but most likely partial:
Annual Fun Forecast!
Baby New Year!
Best Wishes For A Happy New Year!
Fun 2007!
Fun Filled New Year!
Happiness And Continued Success!
Happiness And Success!
Happiness In Everything!
Happy 2007!
Happy New Year!
Happy Times And Happy Memories!
May Your Dreams Come True!
New Hopes And New Beginnings!
New Year… Happy Year!
Promises Of Happy Times!
Raising A Toast To Happy Times!
Scale Greater Heights!
Sparkling Happiness And Good Times!
Warm New Year Hug!
Warmest Wishes For New Year!
Welcome 2007!
Wish You Smiles And Good Cheer!
Wishing You Happiness!
Wishing You Happy New Year! …
- http://www.computerworld.com/action/articl…rce=rss_topic85
December 29, 2006
"…In-boxes with the subject "Happy New Year!" The message, currently being spread from 160 e-mail domains, requires users to click on the attached "postcard.exe" file in order to cause damage. The file will install several different malicious code variants, including Tibs, Nwar, Banwarum and Glowa, on the computer. It then executes mass mailings from the infected computer. The worm is already being heavily spammed, VeriSign said. The security company has found one network that is sending out five e-mails per second with the worm… This is a new and largely undetected threat…"
- http://www.techweb.com/article/printableAr…p;site_section=
- http://www.f-secure.com/weblog/archives/ar…6.html#00001063
December 30, 2006
"We're now seeing slightly modified versions of the Happy New Year postcard.exe attachments that were first spotted on Friday. This time the e-mail subjects vary a lot but are always themed around New Year greetings. For example, "Fun Filled New Year", "May Your Dreams Come True!", "Sparkling Happiness And Good Times!", or "Sender Happy 2007!". The attachment name is "greeting card.exe", "Greeting Postcard.exe", or something else along those lines. The attachments have been modified slightly to avoid detection by antivirus programs, but we detect them as Trojan-Downloader.Win32.Tibs.jy. There are also some corrupted attachments floating around: those might not be detected, but they won't work either…"
