Filename versus reality
Compares the extension and claimed MIME type with magic bytes for PDF, images, archives, executables, WebAssembly, and SQLite.
Hidden Payload & Polyglot File Scanner
Compare a file’s name with its real header, map secondary format and executable signatures, surface suspicious embedded names, and locate high-entropy regions.
Evidence warning: This is not an antivirus verdict. A signature can be coincidental or benign, and encrypted or obfuscated content can evade static checks. Never execute an untrusted sample.
Analyze any file
Maximum 10 MB. The API processes the file in memory and does not retain file content. The scanner reads bytes but never executes embedded code.
What the analysis checks
Polyglot and appended content
Maps secondary signatures at byte offsets so hidden archives, documents, or executable-format markers are visible.
Suspicious embedded names
Searches byte strings for script and executable filenames commonly found in archives or embedded resources.
Entropy map
Reports whole-file and 64 KiB block entropy to identify regions that may be compressed, encrypted, packed, or media data.
Forensic workflow
- 1
Hash and scan the original file without opening or executing it.
- 2
Review mismatches, secondary signatures, executable markers, names, and entropy together—not in isolation.
- 3
Escalate suspicious samples to a controlled sandbox, antivirus, YARA rules, or a qualified reverse engineer.
Frequently asked questions
What is a polyglot file?
It is one byte sequence that can be interpreted as more than one file format. Some are research demos or compatibility tricks; others can bypass weak upload checks.
Does a ZIP signature inside a document mean malware?
No. Modern office documents and embedded resources can legitimately use ZIP. The offset and surrounding format determine whether it deserves review.
Does high entropy mean encryption?
Not by itself. Encryption, compression, photos, video, and packed executables can all have high entropy.
Is a low-risk report safe to open?
No. It only means these static checks found no high-priority signal. Use layered security and do not execute untrusted files.