Filename extension illusion

The filename below was recieved in a malicious email. It appears to have a .jpg extension but windows will run it as an application. The trick appears to be using left to right then right to left characters so the last 7 characters are "jpg.exe" backwards. I suspect this will dupe a lot of windows users.



Actual name: photo_W71765413082011_Coll*gpj.exe

Appears as:

photo_W71765413082011_Collexe.jpg

To simulate your example, I have tried to rename one of my file to your file's first name
"photo_W71765413082011_Coll*gpj.exe"

But windows has given the error

A file name can not contain any of the following characters:
\ /:*?"<>|

The special character * is present in the file name and as such it is not possible to create or rename a file with this name.

So how that name is given to a file?

I don't know how it's done. Probably using special unicode character. The forum replaces special characters with a *

Windows stores file names in Unicode on disk, therefore it allows Unicode characters in file names. Unicode allows for what's called a "Right to Left Override" (RTLO), and vice versa, by putting a special set of Unicode characters in the string. In this case, the * is representing those Unicode characters because Windows explorer doesn't display Unicode. The file name on disk is photo_W71765413082011_Coll[RTLO]gpj.exe (where the RTLO code is actually 0x202E in hex) which would cause it to display as photo_W71765413082011_Collexe.jpg in Windows Explorer. If the malware author is good, they will also associate the shell extension JPG icon with it so it will even look like a non-thumbnailed jpeg in Explorer rather than the default icon Windows puts with exe's that it doesn't have a shell icon for.

This is a trick to address those who don't hide filename extensions.