Fake File Extensions: How Hackers Disguise Malware

Understanding File Extension Deception

It is possible to misrepresent the true nature of a file through manipulation of its extension. A file seemingly designated as an .mp3 audio file, for instance, could in reality be a malicious executable program.

This deception is often achieved by exploiting vulnerabilities in how operating systems interpret file names and extensions.

Exploiting Unicode Characters

Malicious actors can leverage specific Unicode characters to visually alter the display of file extensions. This technique involves reversing the order of characters, effectively masking the true file type.

By employing this method, a dangerous file can appear innocuous to an unsuspecting user.

Hidden File Extensions in Windows

Windows operating systems, by default, conceal file extensions. This setting, while intended to simplify the user experience, can inadvertently create security risks.

For example, a file named "picture.jpg.exe" might be displayed simply as "picture.jpg," leading users to believe it's a harmless JPEG image when it is, in fact, an executable.

The Risk to Novice Users

Users unfamiliar with file extension visibility settings are particularly vulnerable to this type of deception.

The concealment of the true extension can lead to accidental execution of malicious software.

Protecting Yourself

• Always ensure file extensions are visible in your operating system settings.
• Exercise caution when opening files from untrusted sources.
• Be wary of files with double extensions (e.g., .jpg.exe).

Remaining vigilant and understanding these techniques are crucial steps in protecting against file extension-based attacks.

Concealing File Extensions Using the “Unitrix” Technique

Even if you consistently configure Windows to display file extensions and remain vigilant about them, vulnerabilities related to file extensions can still exist. Malicious actors employ alternative methods to obscure the true file type.

This technique, identified as the “Unitrix” exploit by Avast following its use in the Unitrix malware campaign, leverages a specific Unicode character to invert the order of characters within a filename. This effectively conceals the genuine, potentially dangerous file extension amidst the filename, presenting a benign-appearing extension at the end.

The Unicode character in question is U+202E, known as Right-to-Left Override. It compels programs to render text in reverse sequence. While possessing legitimate applications, its inclusion within filenames is arguably unnecessary and creates a security risk.

The core principle involves crafting a filename like “Important Document uploaded by [U+202e]pdf.exe”. The special character dictates that Windows displays the filename’s concluding portion in reverse.

Consequently, the filename appears as “Important Document uploaded by exe.pdf” to the user. However, the file is, in reality, an executable (.exe) and will run when opened, despite the misleading ".pdf" extension.

Understanding the Deception

This method relies on visual trickery to mislead users. The reversed portion of the filename creates the illusion of a safe file type.

• The U+202E character is the key to the exploit.
• It alters the display order of characters.
• Users are tricked into executing malicious files.

This example originated from a software cracking forum, highlighting the importance of caution when downloading files from untrusted sources. Always scrutinize filenames carefully.

Remaining aware of this technique and consistently verifying file extensions can significantly reduce the risk of falling victim to such attacks.

Windows Conceals File Extensions as a Standard Setting

A significant number of computer users are cautioned against executing .exe files obtained from the internet, due to the potential risk of malware. Conversely, many recognize certain file types, such as JPEG images denoted by the .jpg extension, as generally safe to open with a double-click.

However, a critical security feature is often overlooked: Windows, by default, conceals file extensions. Consequently, a file appearing as image.jpg could, in reality, be image.jpg.exe. Double-clicking this disguised file would then initiate the execution of the potentially harmful .exe program.

User Account Control (UAC) can offer a degree of protection in such scenarios; malware may still inflict some damage without administrative privileges, but a full system compromise is less likely. Nevertheless, the risk remains substantial.

The situation is further complicated by the ability of malicious actors to assign custom icons to executable files. A file named image.jpg.exe, displaying the conventional image icon, would visually resemble a benign image under Windows’ default configuration.

The Illusion of Safety

Although Windows indicates that such a file is an application upon closer inspection, this detail is frequently missed by users. This deceptive practice allows attackers to effectively camouflage malicious software.