Classe: Hoax
Un canular est un faux avertissement sur un virus ou un autre élément de code malveillant. Habituellement, un canular prend la forme d'un message électronique avertissant le lecteur d'un nouveau virus dangereux et suggérant que le lecteur transmette le message. Les canulars ne causent aucun dommage en eux-mêmes, mais leur distribution par des utilisateurs bien intentionnés provoque souvent de la peur et de l'incertitude. La plupart des fournisseurs d'antivirus incluent des informations de canular sur leurs sites Web et il est toujours conseillé de vérifier avant de transférer les messages d'avertissement.Plus d'informations
Plateforme: Win32
Win32 est une API sur les systèmes d'exploitation Windows NT (Windows XP, Windows 7, etc.) qui prend en charge l'exécution des applications 32 bits. L'une des plateformes de programmation les plus répandues au monde.Famille: Hoax.Win32.DeceptPCClean
No family descriptionExamples
4804372DB69B6CCE4E0F86710231B653F9A876B022D6EC47FAED024E3A1FF677
3109F71976DC7FB206FDF343A8A9977A
661C0E1D9551DC12BE15A78F5D98A5EB
22B15E82FFD022DAF01F961F4B923C7A
Tactics and Techniques: Mitre*
TA0002
Execution
The adversary is trying to run malicious code.
Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.
Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.
T1204.002
User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs)
While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.
Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs)
While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.