{"id":49785,"date":"2016-05-20T17:16:59","date_gmt":"2016-05-21T00:16:59","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=49785"},"modified":"2025-06-02T19:39:15","modified_gmt":"2025-06-03T02:39:15","slug":"malware-mystery-jsnemucod-downloads-legitimate-installer","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/","title":{"rendered":"Malware Mystery: JS\/Nemucod Downloads Legitimate Installer"},"content":{"rendered":"

JS\/Nemucod is the detection name given to a family of malicious JavaScript downloaders that\u00a0have appeared in\u00a0spam campaigns since last year. They usually arrive\u00a0as an email attachment, embedded in a ZIP archive, and pretend to be an invoice, a delivery notice, a resume, anything that may seem harmless and can be used as a social engineering trick.<\/p>\n

Once JS\/Nemucod executes, it silently downloads additional malware to\u00a0the %TEMP% folder of the victim\u2019s machine, before running without the user\u2019s consent.<\/p>\n

The downloaded payloads vary depending on the bad guys choice of the moment. JS\/Nemucod has spread Tescrypt, Fareit, Kovter, Miuref, Dridex, Locky, and Gamarue, to name several.<\/p>\n

In the last couple of days, we received several JS\/Nemucod samples that\u00a0we detect as JS\/Nemucod.hb. This detection is for a variant that uses two layers of basic obfuscation, as pictured below:<\/p>\n

\"Figure
Excerpt from one JS\/Nemucod.hb sample.<\/em><\/figcaption><\/figure>\n

This malicious sample (MD5 = 4B7207D5AB0DF9D6B0C650EBA0E18EE0) starts with a very long obfuscated string containing the malicious code, followed by a part of code used for the deobfuscation of the first layer, and then some junk.<\/p>\n

Once the first layer is removed, the malicious parts of code become more visible, yet they are still obfuscated:<\/p>\n

\"Figure
The same sample without the first layer of obfuscation.<\/em><\/figcaption><\/figure>\n

This is the same sample, now fully deobfuscated:<\/p>\n

\"Figure
JS\/Nemucod.hb fully deobfuscated.<\/em><\/figcaption><\/figure>\n

This sample attempts to download a file from one of three URLs (if the first download fails, it will try the second one, and so on), saves it in the %TEMP% folder with a filename made of five\u00a0digits, followed by the extension .exe, and then silently runs it. The files hosted on these three compromised websites are\u00a0identical Locky malware, with the same MD5 signature (7905f35038e44c285a10cdefda496d7a).<\/p>\n

Nothing surprising so far. However while analyzing a few more samples from this JS\/Nemucod variant, we happened to deobfuscate one that\u00a0contains only one URL, repeated three times, which links to a legitimate, noninfected, Notepad++ installer stored on the Notepad++ official website (MD5 = 3BB72C72B73583C72EAB326D8BDB83E6, a legitimate file), and downloads a legitimate file instead of a malicious sample:<\/p>\n

\"Figure
JS\/Nemucod.hb downloading a Notepad++ file.<\/em><\/figcaption><\/figure>\n

Why would JS\/Nemucod download a legitimate Notepad++ installer?\u00a0That\u2019s the question we asked ourselves.<\/p>\n

After some investigations, we managed to collect six samples detected as JS\/Nemucod.hb and containing the URL linking to the Notepad++ installer.<\/p>\n

Here are their MD5 signatures:<\/h2>\n
    \n
  • 68cffdb643c25fe8f3fd6c79c4423558<\/li>\n
  • 36ef4cbee8945b69fa04cb7e9e3f2657<\/li>\n
  • 15db97414972ca19a88147764bedaa81<\/li>\n
  • eca759dcabec66377ec21fa62d92709e<\/li>\n
  • 754d333f8c06085ebb3e32701a5be584<\/li>\n
  • 037b04cc520ddb37bbfa1e535e39339a<\/li>\n<\/ul>\n

    We tracked down where these samples came from. It seems that all were first submitted to VirusTotal:<\/p>\n

    \"Why-would-JS-VT\"<\/p>\n

    They had more in common. All were submitted:<\/h2>\n
      \n
    • Via Tor, the anonymizing network that makes it hard to trace its communications. Tor is used to remain anonymous, though not necessarily for\u00a0bad intent.<\/li>\n
    • In a short time (about 15 minutes).<\/li>\n
    • In JavaScript format (not embedded in a ZIP archive).<\/li>\n
    • Only once to Virus Total.<\/li>\n
    • With a filename similar to inv_<\/em>[random string].<\/em>js, although each filename was unique: inv_kuxxp4vx2e2.js, inv_zx4ft4opwer.js, inv_j1xcvzy3w2h.js, inv_wpmv1slbrvj.js, inv_lnm4ckkexbz.js, and inv_bpcb1t3n2v4.js.<\/li>\n<\/ul>\n

      The fact that these six samples were submitted to VirusTotal only once and in JavaScript format (not without a ZIP container) suggests they were not found in the wild nor that they were spammed.<\/p>\n

      Moreover, all were submitted in a very short period and via Tor. Could it be that these samples were submitted to VirusTotal by the bad guys themselves? That\u2019s one hypothesis. If that\u2019s the case, for what reason? To confuse the issue? For testing?<\/p>\n

      We compared each sample (especially the parts used to deobfuscate the script) with each other:<\/p>\n

      Sample 1:<\/strong> (MD5) 68cffdb643c25fe8f3fd6c79c4423558<\/p>\n

      \"Why-would-JS-Diff1\"<\/p>\n

      Sample 2:<\/strong> 36ef4cbee8945b69fa04cb7e9e3f2657 (submitted to VirusTotal about two\u00a0minutes later)<\/p>\n

      \"Why-would-JS-Diff2\"<\/p>\n

      Except for the different variable names and the junk variables (which are randomly generated for each malware sample), we do not see any differences. We can confirm that both samples were created using the same generator.<\/p>\n

      Sample 3:<\/strong> 15db97414972ca19a88147764bedaa81 (submitted to VirusTotal about five\u00a0minutes later)<\/p>\n

      \"Why-would-JS-Diff3\"<\/p>\n

      The string \u201clength\u201d was obfuscated in a slightly different way. The part of code used for deobfuscation was duplicated at the end of the script.<\/p>\n

      Sample 4:<\/strong> eca759dcabec66377ec21fa62d92709e (submitted to VirusTotal about two\u00a0minutes later)<\/p>\n

      \"Why-would-JS-Diff4\"<\/p>\n

      The variable q1 now concatenates four strings instead of six.<\/p>\n

      Sample 5:<\/strong> 754d333f8c06085ebb3e32701a5be584 (submitted to VirusTotal about seven\u00a0minutes later)<\/p>\n

      <\/p>\n

      The variable q1 again concatenates six strings.<\/p>\n

      Sample 6:<\/strong> 037b04cc520ddb37bbfa1e535e39339a (submitted to VirusTotal less than two minutes later)<\/p>\n

      \"Why-would-JS-Diff6\"<\/p>\n

      Variable q1 now concatenates four strings. Some characters (C and A) in the obfuscated string \u201ccharAt\u201d are now in uppercase. Moreover, the duplicated part of code added at the end of the script was removed.<\/p>\n

      We noticed that the obfuscations used in various JS\/Nemucod versions\u00a0are modified daily before being spammed, in an attempt to bypass antimalware detection. However, we have never seen so many minor modifications in such a short time, so these six samples must have been submitted to VirusTotal for testing purposes, most likely by the bad guys behind JS\/Nemucod.<\/p>\n

      Why did the malware developers use a real URL downloading a legitimate file for their tests when\u00a0they could have used fakes?<\/p>\n

        \n
      • Most likely to locally test the viability of the generated JavaScript files without infecting themselves: If the legitimate file is downloaded and executes on their machines, then the script is viable.<\/li>\n<\/ul>\n

        Why did they download an installer instead of another (smaller) executable file?<\/p>\n

          \n
        • Perhaps to make sure that the downloaded file will not be truncated when saved on disk.<\/li>\n<\/ul>\n

          Why did they download a Notepad++ installer rather than some other?<\/p>\n

            \n
          • That\u00a0will probably remain a mystery!<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

            JS\/Nemucod is the detection name given to a family of malicious JavaScript downloaders that\u00a0have appeared in\u00a0spam campaigns since last year….<\/p>\n","protected":false},"author":836,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,76,338,180],"coauthors":[925],"class_list":["post-49785","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-cybercrime","tag-endpoint-protection","tag-malware"],"acf":[],"yoast_head":"\nWhy would JS\/Nemucod download a legitimate Notepad++ installer?<\/title>\n<meta name=\"description\" content=\"During our analysis, we noticed that a legitimate Notepad++ installer was downloaded by a few JS\/Nemucod samples. We investigated to understand why.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why would JS\/Nemucod download a legitimate Notepad++ installer?\" \/>\n<meta property=\"og:description\" content=\"During our analysis, we noticed that a legitimate Notepad++ installer was downloaded by a few JS\/Nemucod samples. We investigated to understand why.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-05-21T00:16:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T02:39:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Why-would-JS-Notdec-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"500\" \/>\n\t<meta property=\"og:image:height\" content=\"431\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Elodie Grandjean\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Elodie Grandjean\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/\"},\"author\":{\"name\":\"Elodie Grandjean\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/20ac3af655b4c8e1d0c6770083f5369c\"},\"headline\":\"Malware Mystery: JS\/Nemucod Downloads Legitimate Installer\",\"datePublished\":\"2016-05-21T00:16:59+00:00\",\"dateModified\":\"2025-06-03T02:39:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/\"},\"wordCount\":1064,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Why-would-JS-Notdec-1.png\",\"keywords\":[\"computer security\",\"cybercrime\",\"endpoint protection\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/\",\"name\":\"Why would JS\/Nemucod download a legitimate Notepad++ installer?\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Why-would-JS-Notdec-1.png\",\"datePublished\":\"2016-05-21T00:16:59+00:00\",\"dateModified\":\"2025-06-03T02:39:15+00:00\",\"description\":\"During our analysis, we noticed that a legitimate Notepad++ installer was downloaded by a few JS\/Nemucod samples. We investigated to understand why.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Why-would-JS-Notdec-1.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Why-would-JS-Notdec-1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Malware Mystery: JS\/Nemucod Downloads Legitimate Installer\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/20ac3af655b4c8e1d0c6770083f5369c\",\"name\":\"Elodie Grandjean\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/d7a1561f3fd842ba329265d07bca04a5\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Elodie-Grandjean-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Elodie-Grandjean-96x96.jpg\",\"caption\":\"Elodie Grandjean\"},\"description\":\"Elodie Grandjean joined McAfee Labs in 2005 as a Virus Researcher. She is passionate about reverse engineering and enjoys doing deep technical analyses of malware and threats. When Grandjean is not in front of her computers, she likes reading books about psychology, spending time with her friends, listening to music, and attending concerts.\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/elodie-grandjean\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why would JS\/Nemucod download a legitimate Notepad++ installer?","description":"During our analysis, we noticed that a legitimate Notepad++ installer was downloaded by a few JS\/Nemucod samples. We investigated to understand why.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Why would JS\/Nemucod download a legitimate Notepad++ installer?","og_description":"During our analysis, we noticed that a legitimate Notepad++ installer was downloaded by a few JS\/Nemucod samples. We investigated to understand why.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-05-21T00:16:59+00:00","article_modified_time":"2025-06-03T02:39:15+00:00","og_image":[{"width":500,"height":431,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Why-would-JS-Notdec-1.png","type":"image\/png"}],"author":"Elodie Grandjean","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Elodie Grandjean","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/"},"author":{"name":"Elodie Grandjean","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/20ac3af655b4c8e1d0c6770083f5369c"},"headline":"Malware Mystery: JS\/Nemucod Downloads Legitimate Installer","datePublished":"2016-05-21T00:16:59+00:00","dateModified":"2025-06-03T02:39:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/"},"wordCount":1064,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Why-would-JS-Notdec-1.png","keywords":["computer security","cybercrime","endpoint protection","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/","name":"Why would JS\/Nemucod download a legitimate Notepad++ installer?","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Why-would-JS-Notdec-1.png","datePublished":"2016-05-21T00:16:59+00:00","dateModified":"2025-06-03T02:39:15+00:00","description":"During our analysis, we noticed that a legitimate Notepad++ installer was downloaded by a few JS\/Nemucod samples. We investigated to understand why.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Why-would-JS-Notdec-1.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Why-would-JS-Notdec-1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-mystery-jsnemucod-downloads-legitimate-installer\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Malware Mystery: JS\/Nemucod Downloads Legitimate Installer"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/20ac3af655b4c8e1d0c6770083f5369c","name":"Elodie Grandjean","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/d7a1561f3fd842ba329265d07bca04a5","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Elodie-Grandjean-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Elodie-Grandjean-96x96.jpg","caption":"Elodie Grandjean"},"description":"Elodie Grandjean joined McAfee Labs in 2005 as a Virus Researcher. She is passionate about reverse engineering and enjoys doing deep technical analyses of malware and threats. When Grandjean is not in front of her computers, she likes reading books about psychology, spending time with her friends, listening to music, and attending concerts.","url":"https:\/\/www.mcafee.com\/blogs\/author\/elodie-grandjean\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/836"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=49785"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49785\/revisions"}],"predecessor-version":[{"id":214940,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49785\/revisions\/214940"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=49785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=49785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=49785"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=49785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}