> Concept · Social Engineering — Purchase Order Masquerade_

~/packetpursuit $ cat /intel/concepts/social-engineering-purchase-order-masquerade.md

typeconceptconfidencehighcreated2026-07-01updated2026-07-15social-engineeringmasqueradepurchase-orderinvoicelurephishing

Social Engineering — Purchase Order Masquerade

Description

A social-engineering distribution pattern in which malware is packaged with a filename implying a business document — typically PO, Purchase Order, INQUIRY, QUOTE, RFQ, or SALES — often with a .pdf.exe or _ double-extension masquerade. The lure preys on employees in finance, procurement, or logistics who expect to receive vendor documents via email.

Common Filename Patterns

  • PO-<number>.exe / PO_<number>.exe / P.O_.exe
  • Purchase Order.exe / Purchase_Order.exe
  • INQUIRY.exe / QUOTE-<date>-A-CCC.exe
  • SALES_INQUIRY.pdf.exe (double extension)
  • RFQ-<number>.exe

Notable Examples

  • 763ae850... — RFQ_PROCUREMENT2024.exe (RFQ/procurement masquerade, AutoItSC dropper with Caesar-5 XOR obfuscation). Thirty-fifth confirmed AutoItSC sibling. ^[/intel/analyses/763ae850f760ba69722a94ca74a6b88e2bb1a2185364ab358a360df2945bb5a8.html]
  • 931242f8... — P.O_.exe (purchase order, underscore obfuscation). ^[/intel/analyses/931242f8aab64f678147e83833b39bb35111e4359824f7ab694a74d5a80b8f8f.html]
  • bc38233e... — PO1.exe (minimal purchase-order filename). ^[/intel/analyses/bc38233e18628256407420a857d1a1999974331cac7c5beb4368550d1d15f91d.html]
  • b760c6f2... — PO-000001488.exe (numeric padding for legitimacy). ^[/intel/analyses/b760c6f2383e05037e5a71b4a39e2e333504d37f81d15116a2bed45eac537feb.html]
  • 000d931f... — PO#86637_copy.exe (purchase-order lure, third sibling in Brazilian pizza-shop POS cluster). ^[/intel/analyses/000d931f8f76a4fc9ba255cbc972e03f58d3e49bcdd6008094ac0dc2e4fe25a6.html]
  • 673e6738... — нова_поръчка_pdf.exe (Bulgarian "new order" with .pdf.exe double-extension masquerade). Fourth confirmed sibling. ^[/intel/analyses/673e673800b807ec8ab291b464f62dc81576874956d702e7cfa152af61844421.html]

Detection

  • Filename regex: (?i)(PO|Purchase[._-]?Order|INQUIRY|QUOTE|RFQ|SALES).*\.exe$
  • Combined with .NET or AutoIt compilation timestamps
  • Origin from ZIP attachments in unsolicited email

Related