double-extension-masquerade
Abuse of Windows Explorer's "Hide extensions for known file types" default to present a malicious PE as a benign file type. The attacker appends a fake extension before the real one — e.g., Payment_Proof.pdf.exe or Invoice.docx.exe — so the victim sees Payment_Proof.pdf or Invoice.docx while the OS executes a PE.
Fingerprint
- Filename contains a dot before
.exe,.scr,.com,.pif, or.bat - The pre-dot extension is a document or benign executable type:
.pdf,.docx,.bat,.jpg,.png,.txt,.zip - Often paired with social-engineering lures (banking, invoice, shipping, HR)
Variants Observed
.bat.exe—Investec_-_Proof_of_payment_from_Phluid.bat.exe(f9a1fc01). Victim sees.bat; Windows executes PE. ^[/intel/analyses/f9a1fc01119ed1cc7a5464cc4df2d3f0dea09f8227c6ba101c77c73f6c379214.html].pdf.exe—SALES_INQUIRY.pdf.exe(b04aa5d0). Victim sees.pdf; Windows executes a Delphi brute-forcer tool. ^[/intel/analyses/b04aa5d0ede5653b20f6db6d6df0020e396dfe8688f2c4712cff6dccce2002d4.html]
Related Techniques
- version-info-masquerade — complementary: fake VersionInfo metadata to reinforce legitimacy in Properties dialog.
- social-engineering-filename-lure — the naming psychology that makes the double extension effective.