Ransomware.Petya samples appear to be clean legitimate binaries

The two binaries in malware/Binaries/Ransomware.Petya/Ransomware.Petya.zip (MD5: e8fb95ebb7e0db4c68a32947a74b5ff9) don't appear to contain any Petya ransomware code.

26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin (226KB)

• Contains PDB path: GoogleCrashHandler_unsigned.pdb
• Strings reference Breakpad, MiniDumpWriteDump
• Appears to be a legitimate Google Crash Handler binary

4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.bin (788KB)

• Contains strings referencing CUpdateManager, SunJavaUpdateCheckerMutex, jucheck/UpdateManager.cpp
• PDB-style path: d:/re/workspace/8-2-build-windows-i586-cygwin/jdk8u73/6086/install/src/windows/au/jucheck/
• Appears to be a legitimate Java Update Checker (jucheck.exe)

Neither binary contains any MBR overwrite logic, Salsa20 encryption, disk access via \.\PhysicalDrive, fake CHKDSK screens, or other indicators of Petya. No "PhysicalDrive", "chkdsk", or crypto-related strings are present.

These were likely bundled alongside the actual Petya dropper as part of the original infection package (Petya spread as a fake job application archive) but are not themselves malicious. The actual Petya MBR bootkit payload is missing from this zip.