{"id":72251,"date":"2007-07-02T08:57:50","date_gmt":"2007-07-02T08:57:50","guid":{"rendered":"https:\/\/localhost\/wordpress\/?p=72251"},"modified":"2007-07-02T08:57:50","modified_gmt":"2007-07-02T08:57:50","slug":"e-greeting-continues","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/e-greeting-continues\/","title":{"rendered":"E-greeting continues"},"content":{"rendered":"<p>Mails send from egreetings.Com with malicious links is still floating around. The subject of these mails<br \/>\n  is formed using below keywords\n <\/p>\n<p> You&#8217;ve received [a|n] [greeting|] [postcard|ecard] from a   [admirer|class-mate|colleague|family   member|friend|mate|neighbor|neighbour|partner|school friend|school   mate|school-mate|worshipper]!<\/p>\n<p> Here is one of such subject line used &#8221; You&#8217;ve received a greeting card from a class mate!&#8221;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.quickheal.com\/weblog\/uploads\/images\/e-greet-vows.JPG\" alt=\"\" height=\"587\" width=\"650\"><\/p>\n<p>  The website page has javascript that appears to have multiple ways to   exploit a browser. If javascript is not enabled then it provides an   alerantive link to download the mailcious files. Here is what a user   would see:<\/p>\n<p>&#8220;We are currently testing a new browser feature. If you are not able to<\/p>\n<p>  view this ecard, please click here (\/ecard.exe) to view in its original format.&#8221; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.quickheal.com\/weblog\/uploads\/images\/user_ie_mes.JPG\" alt=\"\" height=\"205\" width=\"777\"><\/p>\n<p>  Downloaded program is a Trojan downloader which in turn download other   mailicous files from other remote system. Trojandownloader.Tibs.mq and   Trojandownloader.Small.evy added in database. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mails send from egreetings.Com with malicious links is still floating around. The subject of these mails is formed using below keywords You&#8217;ve received [a|n] [greeting|] [postcard|ecard] from a [admirer|class-mate|colleague|family member|friend|mate|neighbor|neighbour|partner|school friend|school mate|school-mate|worshipper]! Here is one of such subject line used &#8221; You&#8217;ve received a greeting card from a class mate!&#8221; The website page has javascript [&hellip;]<\/p>\n","protected":false},"author":22,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-72251","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72251"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=72251"}],"version-history":[{"count":0,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72251\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=72251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=72251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=72251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}