Why is spreading malware.scr instead of malware.exe more common?

Question

Both are binaries and I guess that AV products know that .scr files that are not screensavers should be dealt with with "special care".

I see quite a lot of "Document.pdf.scr" malware samples and can't explain why it's better than plain ol' executable...

score 44 · Accepted Answer · answered Nov 04 '15 at 11:25

44

Probably because user education has focussed on ".exe extensions are bad", so a .scr might have a better chance of being run, especially if the email claimed it was a script to do something useful.

answered Nov 04 '15 at 11:25

Matthew

27,381
7
91
103

5

Indeed, the example given does two different attacks on those who did not drink deep of the Pierian spring; with some Windows configurations (the default) the file will appear as "Document.pdf", which is commonly thought of as safe and in any case a type of file one often has to open, risk or not. Only if that fails does ignorance of the nature of .scr have an affect. – Jon Hanna Nov 05 '15 at 15:36
@JonHanna Except those who see "Document.pdf" here should actually be expecting to see just "Document". That is, if they always worked in the hidden extensions mode, they might not even know that those files with the red twirly line on white icon that happen to open in this Acrobat thingy have .pdf as extension (or what an extension is at all) ... – Hagen von Eitzen Nov 05 '15 at 21:46
5

@HagenvonEitzen, you assume that a novice user even thinks about consistency, i.e. notices whether or not the file has a .pdf extension. I bet plenty of them have no idea either way and would open anything with the familiar icon - or even think an unusual .pdf extension is safer than normal. Bear in mind these are the same users who will happily open a context-free email that has no specific relation to them entitled Re: The Payment and double-click things like your_invoice.bat – underscore_d Nov 06 '15 at 00:57
@HagenvonEitzen that's the opposite of what I've seen with users on extension hidden machines. Given the choice between AppName.exe and AppName.exe.config; when extensions are hidden they almost always click on the one that shows AppName.exe and get confused when they're asked what they want to use to view the xml instead of having the application launch. – Dan Is Fiddling By Firelight Nov 06 '15 at 15:55

score 41 · Answer 2 · answered Nov 04 '15 at 15:52

41

On popular skid forums such as hackforums.net the use of .scr is purely social engineering based. Someone is more likely to run the program when they think its a "screenshot" (.scr). Other common extensions used in this manner include "its a website link" (.com) and, "it's just an old MS-DOS game" (.dos).

As you can see it's all purely social engineering based.

answered Nov 04 '15 at 15:52

Chad Baxter

632
4
8

4

.scr was used for screen savers in Windows back in the day – Neil McGuigan Nov 04 '15 at 17:39
33

.scr is used for screen savers today. Nothing's changed. See Windows\System32 (or wherever your system folder is). – phyrfox Nov 04 '15 at 19:06
chad, are you sure you meant screenshot, and not screensaver? – Mindwin Remember Monica Nov 04 '15 at 19:59
17

@Mindwin he's addressing naive user perception, which enables social engineering. – casey Nov 04 '15 at 20:17
3

Yes... ".scr" just LOOKS like a screenshot to the unknowing user. – Chad Baxter Nov 04 '15 at 21:02
1

Even so, I'm pretty sure anyone that's used Windows in the last decade or two wouldn't be "surprised" if they saw an email saying "Hey, check out this cool new screensaver I found" with a .scr attachment. – phyrfox Nov 05 '15 at 07:15
3

The point is, the email says "screenshot", not "screen saver", relying on users not knowing what a .scr file is. – Alfred Armstrong Nov 05 '15 at 10:28

Why is spreading malware.scr instead of malware.exe more common?

2 Answers2