Divin'n'phishin with executable filetypes on Windows

What it is

A method for enumerating which Windows file extensions execute directly on double-click (no helper application), useful for identifying phishing payload filetypes that survive mail defenses. The author uses only built-in assoc/ftype commands, so it works on future or constrained Windows environments where the answer isn't already documented.

How it works

Every extension maps to a "File Type" (assoc), and each File Type maps to a launch command (ftype). The tell for direct execution is that the command is the file itself — ="%1" — rather than passing the file as an argument to another binary (e.g. winword.exe /n "%1"). Dumping all associations and grepping for that pattern isolates the directly-executable set:

batfile="%1" %*
cmdfile="%1" %*
comfile="%1" %*
exefile="%1" %*
piffile="%1" %*
scrfile="%1" /S

Note scrfile uses /S rather than the bare %1 pattern — so a plain ="%1" grep alone would miss it.

What to do

Reproduce the enumeration on any target Windows build:

C:\>assoc > assoc.txt
$ cut -d '=' -f2 assoc.txt > types.txt
C:\> for /f %l in ('type types.txt') do echo %l >> defs.txt && ftype %l >> defs.txt
$ grep -E '="%1"' defs.txt

For a defender, the inverse is the value: these six File Types (batfile, cmdfile, comfile, exefile, piffile, scrfile → .bat .cmd .com .pif .exe .scr) are the direct-execution set to block or alert on at the mail gateway. Indirect File Types (="%1" absent) can still execute depending on the handler binary, so treat the grep as a floor, not a complete list.

Caveats

• The author states all these filetypes have been documented before; the contribution is the method, not novel extensions.
• .pif files contain no executable code (they lack the MZ magic number), yet Windows runs them through the same pseudo-executable handling — so file-content inspection that keys on MZ will not flag a malicious .pif.
• The demonstrated .com payload is simply a compiled C# binary renamed; the "MS-DOS Application" association executes it regardless of true format.