content: Yeah but a copy is an exact copy with the same signature. The Russians can't say "aha the imperialist scum did such and such a hack because the file they left behind is THIS" + "We found THIS on an imperialist scum server" and say that it proves the imperialist scum alone could have done the hack. The Russians have it too... they could have acquired it, done the hack with it, and then pointed the finger.  The more people get copies of it the less credible it is to say any user of it must be the originator, in fact it stops being very believeable if anyone outside the originatior has a copy of it.