Version Info Masquerade

Description

The practice of embedding fabricated or nonsensical VS_VERSIONINFO structures in a PE's .rsrc section to masquerade as legitimate software. Common in commodity malware, crypters, and loaders. The fields (CompanyName, ProductName, FileDescription, OriginalFileName, InternalName) are populated with random word-salad strings, future-dated copyright notices, or impersonated legitimate vendor names.

Purpose

• Social engineering: a user inspecting file properties sees a "Microsoft" or benign-looking product name
• Evasion: some EDR products whitelist based on signed/known version-info fingerprints; fabricated info may confuse naive heuristics
• Attribution noise: false company names can mislead incident responders hunting for legitimate software

Static Indicators

• CompanyName / ProductName strings that are random syllable concatenations (e.g., Eparijeq, Okoyurufaletasiz, Agebikujokacozixi)
• OriginalFileName that does not match the on-disk filename
• LegalCopyright dated in the future relative to the PE timestamp
• Absence of authenticode signature despite "professional" version info

Notable Examples

• 931242f8... (P.O_.exe) — Eparijeq / Okoyurufaletasiz / Ilonimuzuyegiz / Atukewogux, copyright © 2027 with a 2024 PE timestamp. ^[sample 931242f8/exiftool.json]
• 07835853... (fortnite hack vip.exe) — Microsoft Code Signing spoofed in ConfuserEx metadata. ^[sample 07835853/exiftool.json]

Detection

• Entropy scoring on CompanyName + ProductName fields (high Shannon entropy = word-salad)
• Mismatch between OriginalFileName and observed filename
• Future-dated copyright vs. PE timestamp

Related

• unclassified-dotnet-crypter-loader
• social-engineering-purchase-order-masquerade