Adversaries may masquerade malicious payloads as legitimate files through changes to the payload’s formatting, including the file’s signature, extension, and contents.

Tactics
TA0005

Sub-technique of
T1036


See: MITRE ATT&CK