25

Both are binaries and I guess that AV products know that .scr files that are not screensavers should be dealt with with "special care".

I see quite a lot of "Document.pdf.scr" malware samples and can't explain why it's better than plain ol' executable...

2 Answers 2

44

Probably because user education has focussed on ".exe extensions are bad", so a .scr might have a better chance of being run, especially if the email claimed it was a script to do something useful.

4
  • 5
    Indeed, the example given does two different attacks on those who did not drink deep of the Pierian spring; with some Windows configurations (the default) the file will appear as "Document.pdf", which is commonly thought of as safe and in any case a type of file one often has to open, risk or not. Only if that fails does ignorance of the nature of .scr have an affect.
    – Jon Hanna
    Nov 5, 2015 at 15:36
  • @JonHanna Except those who see "Document.pdf" here should actually be expecting to see just "Document". That is, if they always worked in the hidden extensions mode, they might not even know that those files with the red twirly line on white icon that happen to open in this Acrobat thingy have .pdf as extension (or what an extension is at all) ... Nov 5, 2015 at 21:46
  • 5
    @HagenvonEitzen, you assume that a novice user even thinks about consistency, i.e. notices whether or not the file has a .pdf extension. I bet plenty of them have no idea either way and would open anything with the familiar icon - or even think an unusual .pdf extension is safer than normal. Bear in mind these are the same users who will happily open a context-free email that has no specific relation to them entitled Re: The Payment and double-click things like your_invoice.bat Nov 6, 2015 at 0:57
  • @HagenvonEitzen that's the opposite of what I've seen with users on extension hidden machines. Given the choice between AppName.exe and AppName.exe.config; when extensions are hidden they almost always click on the one that shows AppName.exe and get confused when they're asked what they want to use to view the xml instead of having the application launch. Nov 6, 2015 at 15:55
41

On popular skid forums such as hackforums.net the use of .scr is purely social engineering based. Someone is more likely to run the program when they think its a "screenshot" (.scr). Other common extensions used in this manner include "its a website link" (.com) and, "it's just an old MS-DOS game" (.dos).

As you can see it's all purely social engineering based.

7
  • 4
    .scr was used for screen savers in Windows back in the day Nov 4, 2015 at 17:39
  • 33
    .scr is used for screen savers today. Nothing's changed. See Windows\System32 (or wherever your system folder is).
    – phyrfox
    Nov 4, 2015 at 19:06
  • 17
    @Mindwin he's addressing naive user perception, which enables social engineering.
    – casey
    Nov 4, 2015 at 20:17
  • 3
    Yes... ".scr" just LOOKS like a screenshot to the unknowing user. Nov 4, 2015 at 21:02
  • 3
    The point is, the email says "screenshot", not "screen saver", relying on users not knowing what a .scr file is. Nov 5, 2015 at 10:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .