Right-to-Left Override (RLO) Extension Spoofing

Created the Thursday 03 August 2023. Updated 3 months, 1 week ago.

The Right-to-Left Override (RLO) character (U+202E) is a Unicode control character used for bidirectional text formatting. It affects the way text is displayed, causing text following the RLO character to be rendered from right to left, which is typically used in languages like Arabic and Hebrew.

However, malicious actors have found a way to exploit this Unicode character to deceive users by using it in file extensions. By strategically placing the RLO character within a file name, they can manipulate the visual appearance of the extension while maintaining its actual content.

For example, consider a file named "invoice.pdf" with the RLO character followed by malicious code: invoice\u202Efdp.exe. When displayed in certain contexts, it may appear as invoiceexe.pdf (hiding the ".exe" extension) instead of the actual "invoice.pdf.exe". This tactic aims to trick users into believing the file is harmless when, in reality, it could be a dangerous executable.

Technique Identifier

U1010

Technique Tags

Extension Spoof RLO Filename

Code Snippets

Description

In this example malware.exe becomes Annexe.jpeg but keeps its executable properties.

Rename-Item -Path malware.exe -NewName ("Ann" + ( [char]0x202E) + "gepj.exe")

Detection Rules

                                    rule SUSP_RLO_Exe_Extension_Spoofing_Jan24 {
	meta:
		description = "Detects Right-To-Left (RLO) Unicode (U+202E) extension spoofing for .exe files"
		author = "Jonathan Peters"
		date = "2024-01-14"
		reference = "https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/"
		hash = "cae0ab10f7c1afd7941aff767a9b59901270e3de4d44167e932dae0991515487"
		score = 70
	strings:
		$ = { E2 80 AE 76 63 73 2E 65 78 65 } // csv
		$ = { E2 80 AE 66 64 70 2E 65 78 65 } // pdf
		$ = { E2 80 AE 78 73 6C 78 2E 65 78 65 } // xlsx
		$ = { E2 80 AE 78 63 6F 64 2E 65 78 65 } // docx
		$ = { E2 80 AE 70 69 7A 2E 65 78 65 } // zip
		$ = { E2 80 AE 67 6E 70 2E 65 78 65 } // png
		$ = { E2 80 AE 67 65 70 6A 2E 65 78 65 } // jpeg
		$ = { E2 80 AE 67 70 6A 2E 65 78 65 } // jpg
	condition:
		1 of them
}