double-extension-masquerade

A Windows-specific social-engineering technique where a PE executable is given a filename ending in a benign extension followed by the real .exe extension, e.g. Invoice.pdf.exe. Because Windows Explorer hides known extensions by default (and .exe is known), the victim sees only Invoice.pdf and assumes it is a document.

The technique preys on user interface conventions rather than technical vulnerabilities. It requires no exploit, no macro, and no privilege escalation — only a user double-clicking what appears to be a PDF, Word document, image, or archive.

Common Patterns

Observed in

• unclassified-dotnet-chess-engine — 160820242003464366.pdf.exe (chess engine lure) ^[/intel/analyses/7d18d78c5cd6a14d0d70d5454d54b178860dc4b74cd0212c0f9e533368ecaf01.html]
• unclassified-dotnet-crypter-loader — PO1.exe, P.O_.exe, .pdf.exe (Bulgarian "new order" lure) ^[/intel/analyses/bc38233e5cd6a14d0d70d5454d54b178860dc4b74cd0212c0f9e533368ecaf01.html]
• brooter — SALES_INQUIRY.pdf.exe (Russian brute-forcer)
• social-engineering-purchase-order-masquerade — umbrella concept covering PO/RFQ/SALES lures

Detection

File-system / email-gateway: Alert on any attachment or download where the filename contains .pdf.exe, .doc.exe, .zip.exe, .jpg.exe, or similar double-extension patterns. This is high-signal and low-noise in enterprise environments.

Endpoint: Process creation events where Image ends with a known document extension followed by .exe.

Sigma (pseudocode):

title: Double-Extension Masquerade Execution
detection:
  selection:
    Image|endswith:
      - '.pdf.exe'
      - '.doc.exe'
      - '.zip.exe'
      - '.jpg.exe'
      - '.png.exe'
  condition: selection

Mitigation

• Group Policy: enable "Show file extensions" for all users.
• Email gateway: block or quarantine attachments matching *.*.exe patterns.
• User awareness: train finance/procurement staff that "PDF icons" can be executables.

Related

• social-engineering-filename-lure — broader concept
• version-info-masquerade — complementary technique
• T1036.007 — MITRE ATT&CK technique page