In its current form, the malware generates a pop-up that purports to be from law enforcement and demands that the user pay a fine for illegal activity (most often an alleged viewing or distributing of illegal pornography) conducted on the computer. Lately, it's taken the even more scaremongering tactic of
speaking its message in the language of the victim's country.
In its most recent incarnation,
first reported by Trend Micro, the pop-up notification tries to validate itself by claiming that it's under the aegis of a December 4, 2012 treaty between antivirus vendors and law enforcement to identify cyber criminals. Beneath the message are the logos of companies, such as Symantec, McAfee, Trend Micro, Microsoft, and ZoneAlarm. It's even been
masquerading as the Internet Crime Complaint Center (IC3), a partnership of the FBI and the National White Collar Crime Center that filters complaints about scams such as ransomware to the appropriate authorities.