With Valentine’s Day coming this week, we have seen a new wave of Nuwar spamming this Monday evening, amounting to more than 20 variants in a couple of hours. Detection for these variants from major AV vendors was near nonexistent, as the Nuwar writer is using a new compiler this time to bypass detection.

When you click on the link in the e-mail, the Web site will display a picture and you will be prompted to download the executable as shown below.

We have seen samples named valentine.exe.
Happy Valentine’s Day!