Valentine系

• 14日05時前後から,バレンタインに便乗したワームと思しきメールが増え始める.
• 件名にはValentineがつくものが多く,添付ファイル名はナントカpostcard.exeが多いらしい.
• NUWAR系のなにか(?)
• リンク
  • http://www.trendmicro.co.jp/vinfo/virusencyclo/default5.asp?VName=WORM%5FNUWAR%2ECQ&VSect=T
  • http://www.symantec.com/security_response/writeup.jsp?docid=2006-122917-0740-99&tabid=2
  • http://www.symantec.com/region/jp/avcenter/venc/data/jp-w32.mixor.q@mm.html#technicaldetails
• MIMEパート冒頭部分

--------------050001090103020100040300
Content-Type: application/x-msdownload;
 name="postcard.exe"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
 filename="postcard.exe"

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAyAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
ZGUuDQ0KJAAAAAAAAACH6u6yw4uA4cOLgOHDi4DhAITd4ciLgOHDi4HhkYuA4eRN/eHCi4Dh5E3u
4cuLgOHkTfjhwouA4VJpY2jDi4DhAAAAAAAAAABQRQAATAEFAFgX0kUAAAAAAAAAAOAAAgELAQgA
ABYAAABWFQAAAAAARx4AAAAQAAAAMAAAAABAAAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAFQAA
BAAAAAAAAAIAAAQAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAAC9FQAoAAAAAAAAAAAA