A decrypt sample is a small or partial file an attacker may offer as proof that they can restore encrypted data. In ransomware and extortion cases, it is meant to show a working decryptor or a real ability to reverse encryption, often before any payment or negotiation.
For defenders, a decrypt sample matters because it can influence response decisions, but it is not proof of safe recovery. A partial file may decrypt only a test fragment, a non-critical document, or a file chosen to look convincing. Security teams should verify any sample in a controlled environment, compare it with backups and known-good data, and avoid assuming the attacker has a reliable restoration method. In real attacks, this term appears in victim posts, negotiation messages, and proof-of-decryption claims used to pressure targets.