Let's say an attacker connects to the Bitcoin network. Let's say this attacker possesses an old ASIC HW and she used it to generate a blockchain of half a million blocks, with faked timestamps and really low difficulty, but otherwise valid. So, this chain is longer than the Bitcoin blockchain, but is shorter difficulty-wise.
How does the attacker presents this version of blockchain to the network and how much work will the network nodes spend on finding out that that blockchain is difficulty-wise shorter. Do they need to (and will they) download the whole chain from the attacker? Or is there any information on the top of the blockchain that can be used as hint on how much total work was spent in the entire chain?