Recently, we have been receiving samples that use “decoys” to imitate what is to be expected from running a normal file. In this blog post, we will analyze one such sample that Fortinet detects as W32/Kryptik.CWXI!tr.
more here.....http://blog.fortinet.com/post/downloaders-and-decoys
more here.....http://blog.fortinet.com/post/downloaders-and-decoys