Spora is back with a new technique that attempts to confuse and bypass antivirus products and email filters. The technique has only been seen in attacks that target a Russian-speaking population, but if it works well, chances are better than average that well see the same trick being used to target users in other countries. Windows treats the files as an HTA file because it recognizes the file extension and ignores the first bytes that declare the file as something else. Windows doesnt show file extensions by default.”]
Source: https://nakedsecurity.sophos.com/2017/06/26/how-spora-ransomware-tries-to-fool-antivirus/