How to Detect a File Extension Spoof: Practical File Forensics

Extension spoofing is a social engineering technique where a dangerous executable file is manipulated to look like an innocent document or image. Because default Windows settings hide known file extensions, users frequently click on files believing them to be safe PDFs or JPGs.

Attackers commonly employ three deceptive strategies:

• 1. Double Extensions (e.g. `report.pdf.exe`): On default Windows setups where "Hide extensions for known file types" is enabled, Windows hides the trailing `.exe` and displays the filename as `report.pdf`. Clicking it runs the binary.
• 2. Right-to-Left Override (RLO / Unicode U+202E): An invisible Unicode character flips the text direction of succeeding characters. A file named `invoice_[U+202E]cod.exe` is visually rendered by operating systems as `invoice_exe.doc`.
• 3. Custom Icon Injection: Compiling an executable with the official Adobe Acrobat red PDF icon or Microsoft Word blue icon to trick visual inspection.

To verify whether a downloaded file is genuine without executing it:

• Step 1: Never double-click an untrusted file.
• Step 2: Drop the file into the AnyFileX File Analyzer.
• Step 3: Check the "Extension Mismatch" diagnostic indicator.
• Step 4: Verify that the magic bytes match the claimed format (e.g. `25 50 44 46` for PDF vs `4D 5A` for Executable).
• Step 5: Review the computed SHA-256 cryptographic hash against known vendor checksums.