> Concept · version-info-masquerade_

~/packetpursuit $ cat /intel/concepts/version-info-masquerade.md

typeconceptconfidencemediumcreated2026-07-30updated2026-09-08evasiondefense-evasion

version-info-masquerade

Cross-family pattern: malware authors forge Windows VERSIONINFO resource blocks to impersonate a benign software vendor, open-source project, or system component. The forged metadata (FileDescription, ProductName, CompanyName, LegalCopyright, OriginalFilename) survives superficial triage and can mislead both human analysts and automated reputation scoring.

Variants Observed

  • d52f85 sample 78434b53 — Themida-packed PE masquerading as Ubisoft Connect v4.1.9718.720 by "Ubisoft Entertainment", with six PNG icons in .rsrc and forged XML assembly manifest. Actual payload encrypted inside .boot. ^[/intel/analyses/78434b53d284d4537e6d44a9373da8ef86d15c0cd36f32ce695dfd82db7eccfd.html]
  • TransMock clone (f3bc22f6) — .NET PE reuses full TransMock version block (Copyright TransMock 2017, v1.3.0.0) while hosting WinHTTP downloader and encryption classes. See legitimate-library-masquerade. ^[/intel/analyses/f3bc22f69502ed934da8dea7940437e820e1c778016e330a28b1103b6ca247b1.html]
  • Native AOT Chromium masquerade (9a69ad1b) — .NET 9 Native AOT DLL with fabricated company name Crankily LLC, product Sheldrakes Flamencos, and nonsensical FileDescription. Masquerades as a Chromium/Edge ELF component via export table while lacking any real browser functionality. ^[/intel/analyses/9a69ad1b616d4cd2d475b2d4ddf98f3446ea9da715cb1ec7ac263c1f853eeae1.html]
  • Quasar RAT masquerade (62f608d6) — Stock open-source Quasar RAT v1.4.1.0 with fabricated MICROSOFT PUBLISHING / NamCO / Latest_unreleased-v1.3.45 version-info. OriginalFilename and InternalName blanked. On-disk filename borrows XenoRAT branding (Xeno-v1.3.50.exe). ^[/intel/analyses/62f608d61b28702ca4adadd574f3761c79860bd08da402e3129ab19176f7da9a.html]

Detection

  • Compare FileDescription, ProductName, CompanyName against known software catalogues (NIST NVD, vendor download pages, Chocolatey, winget).
  • Cross-check OriginalFilename against the actual SHA-256 of the claimed benign binary.
  • Look for mismatched InternalName vs OriginalFilename vs the actual on-disk filename.
  • Flag version strings that reuse common template values (1.0.0.0, 0.0.0.0) with high-entropy or mismatched binary content.

Related