Executable file

An executable file is a file containing instructions that a computer can follow to carry out a task.

Files of this kind are what programs and applications are, and they are also, unfortunately, a long-standing way of delivering malware.

What characterises them

Instructions for the machine. They contain code the computer interprets and runs, from something as simple as printing a message to installing software across the system.

Formats. Each operating system has its own: .exe on Windows, .app on macOS, ELF binaries on Linux. There are also portable formats, such as a Java archive, that run wherever their runtime is installed.

Potential for abuse. Because they run code on the machine, they are used to deliver malware, and attackers routinely disguise one as a legitimate document in order to get somebody to open it.

A worked example

Somebody receives an apparently harmless email with an attachment named financial_report.exe.

Believing it is a report, they run it.

What it actually does is install ransomware, which encrypts their files and demands payment to release them.

The oldest trick in the example is not the malware, it is the file name. Windows hides known extensions by default, so a file called financial_report.pdf.exe is displayed as financial_report.pdf.

Why blocking executables is no longer enough

Blocking .exe attachments at the mail gateway was a reasonable control, and it worked well enough that attackers moved.

They moved in three directions, and all three are ordinary now.

The first is the dropper: the thing the user opens is not the malware, it is a small piece of code, often in a script or a document, whose only job is to fetch the real payload afterwards.

The second is living off the land: nothing new is delivered at all, and the attacker uses the interpreters and administrative tools already installed and already trusted.

The third is fileless malware, which runs in memory and never writes an executable to disk, so there is nothing for a file-based control to examine.

The practical consequence is that the question has changed. It is no longer which file types are allowed in, it is which processes are allowed to run and which parents are allowed to launch them. A document reader spawning a command interpreter is not a file problem, and it is one of the highest value things an organisation can alert on.

Where to read more

Techopedia, Executable file: an overview of what these files are and the role they play in running software.