Files built with the polyglot technique have been showing up more and more in cyberattacks in recent years. They let attackers slip malware past email filters and file scanners, deceive victims in phishing attacks, and complicate incident investigations. To pull this off, attackers deliberately construct a file that a system can interpret as different formats depending on which application opens it.\u00a0 A classic example is a file that can be handled as a PNG image or a ZIP archive. All it takes is changing the file\u2019s extension, or simply using one or another application to open it.<\/p>\n
Let\u2019s take a look at why it\u2019s even possible to create files like this, which format combinations have turned up in real-world attacks, and how organizations can protect themselves from this threat.<\/p>\n
The data formats behind polyglot files are seldom exotic. It all comes down to a clever combination of common formats that happen to be structurally compatible. Polyglots exploit at least one of the following quirks in certain file formats:<\/p>\n
The Polydet<\/a> GitHub repository describes numerous examples of possible file combinations for building a polyglot. Under the MITRE classification, this technique falls under the Masquerading category (T1036.008<\/a>, Masquerade File Type).<\/p>\n Publicly available malware campaign analyses reveal all kinds of polyglots. Attackers adapt the entire attack scenario to fit a specific file type combination.<\/p>\n The Head Mare group delivered the PhantomPyramid<\/a> malware as a ZIP attachment. The file consisted of Windows executable code (EXE) with a small ZIP archive glued onto the end. When the victim opened the archive, it contained a file with the extension PDF.LNK, which would then launch that same polyglot attachment\u00a0\u2014 this time as an executable file.<\/p>\n In the attack documented by JPCERT<\/a>, attackers created a file that started as a PDF and was detected as a PDF by most scanners but carried a DOC extension and opened in Office applications as a valid DOC file containing malicious macros.<\/p>\n The attacks spreading the StrRAT and Ratty<\/a> Trojans used a polyglot built from a signed Windows installer package (MSI) with malicious Java code (JAR) tacked onto the end.<\/p>\n The StrelaStealer attacks<\/a> used a polyglot with an HTML extension: a Windows library (DLL) with a decoy HTML document glued onto the end. A shortcut in the archive launched the file twice: once via the start command (the equivalent of a double-click, which opened a browser showing the HTML document), and once via rundll32 (which launched the malicious DLL).<\/p>\nExamples of polyglot files in known cyberattacks<\/h2>\n