A colleague forwarded me an email last year with an attachment called "invoice_march.pdf." Looked completely normal. Except when I checked the actual file extension, it was invoice_march.pdf.exe, an executable masquerading as a PDF. If she'd double-clicked it without checking, it would have run malware on her machine. She's a smart person. The file just looked innocent.
Malicious files are one of the primary ways cybercriminals deliver malware, ransomware, and spyware. A single infected file can compromise your entire system, encrypt your documents for ransom, or silently steal your passwords and financial information in the background. The Australian Cyber Security Centre (ACSC) consistently ranks malicious email attachments as one of the top threats facing Australian businesses and individuals.
In this guide, I'll explain how to check if a file is safe before opening it, which file types are most dangerous, and how file hash scanning works to detect known malware.
How to Check If a File Is Safe
There are several layers of defence you can use before opening any file. Here they are, from simplest to most thorough.
1. Check the Source
Where did the file come from? Files from official app stores, well-known software websites, and trusted colleagues are generally safe. Files from unknown email senders, random websites, pop-up download prompts, or peer-to-peer networks carry significantly higher risk. If you weren't expecting a file, be suspicious regardless of who apparently sent it, their account may have been compromised. Learn more about spotting phishing emails with malicious attachments.
2. Check the File Extension
The file extension tells you what type of file it is and how risky it might be. Some file types are far more dangerous than others because they can execute code on your computer.
.bat, .cmd, .ps1, Script files that run commands automatically.
.js, .vbs, .wsf, Script files often used by malware droppers.
.scr, Screensaver files (actually executables in disguise).
.docm, .xlsm, .pptm, Office files with macros (the "m" means macros enabled).
.zip, .rar, .7z, Archives can hide any file type inside, including malware.
.mp3, .mp4, .wav, Audio/video files (generally safe).
.txt, .csv, Plain text files (cannot execute code).
.pdf, Generally safe, but can contain malicious links or exploits.
.docx, .xlsx, Office files without macros (lower risk but check source).
Important: Be aware of double extensions. A file named "invoice.pdf.exe" is not a PDF, it's an executable. Windows hides known extensions by default, so "invoice.pdf.exe" might appear as just "invoice.pdf" with an executable icon. This is what frustrates me most about Windows security defaults, hiding file extensions is a decision that actively helps malware authors disguise their payloads, and it's been the default setting for decades despite every security professional on the planet wanting it changed. Enable file extension visibility in Windows File Explorer settings immediately to see the full filename. Seriously, do it right now.
3. Scan It with a File Scanner
The most reliable method is to scan the file before opening it. ScanTotal's File Scanner computes the file's SHA-256 hash (a unique digital fingerprint) entirely in your browser and checks it against databases of known malware. Your file never leaves your computer, only the hash is checked, preserving your privacy.
4. Check the File's Hash Manually
If you have a file hash (SHA-256, MD5, or SHA-1) from a software vendor, you can verify that the file you downloaded hasn't been tampered with. Legitimate software publishers often list file hashes on their download pages so you can confirm the file is authentic.
On Windows, open PowerShell and run: Get-FileHash filename.exe. On macOS or Linux, use: shasum -a 256 filename. Then compare the output to the hash listed on the vendor's website. If they match, the file is authentic.
You can also paste any hash directly into ScanTotal's Threat Search to check if it's associated with known malware.
What Is a File Hash and How Does It Detect Malware?
A file hash is a unique fingerprint generated by running a file through a mathematical algorithm like SHA-256. Every unique file produces a different hash, even changing a single byte in the file creates a completely different hash value. This makes hashes incredibly useful for identifying files.
Security researchers around the world continuously analyse malware samples and catalogue their hashes in threat intelligence databases like MalwareBazaar, ThreatFox, and others. When you scan a file, the scanner computes its hash and checks it against these databases. If there's a match, you know the file is a known malware sample.
For example, the EICAR test file (a harmless file used to test antivirus software) has the SHA-256 hash: 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f. Any scanner that recognises this hash will flag it immediately.
Common Ways Malicious Files Reach You
Email attachments remain the most common delivery method. Invoices, shipping notifications, resumes, and "urgent documents" are popular disguises. The attachment might be a macro-enabled document, a disguised executable, or an archive containing malware.
Fake software downloads appear when searching for popular free software. Scammers create convincing copycat websites that serve infected versions of legitimate programs. Always download software from the official vendor's website.
Drive-by downloads happen when visiting a compromised or malicious website triggers an automatic download without your explicit consent. This is why keeping your browser and operating system updated is critical.
Social media and messaging links to shared files on cloud storage platforms can lead to malicious downloads. Be cautious about files shared in group chats, forums, or social media messages, especially from people you don't know.
What to Do If You Opened a Malicious File
If you've already opened a suspicious file, act quickly. Disconnect from the internet to prevent the malware from communicating with its command server or spreading to other devices on your network. Run a full system scan with your antivirus software. Change passwords for your important accounts from a different, uninfected device. Monitor your bank accounts and credit report for unusual activity. If you're on a work computer, contact your IT department immediately. Don't wait.
For ransomware specifically (if your files have been encrypted), do not pay the ransom. Contact law enforcement and check the No More Ransom project (nomoreransom.org) for free decryption tools.
How to think about file-type risk
Three questions decide most of it:
- Can this file execute code? Executables and scripts can do whatever your user account can do, which on a home computer is usually quite a lot.
- Can this file hide another file inside it? Archives, disk images, and installers are containers. The risk lives in what's inside, not the wrapper.
- Is this format a known malware carrier? Some formats have a long history of being abused because they combine "looks innocent" with "can do something dangerous."
Every extension below maps to some combination of those three. Let's walk through them.
High-risk: direct executables
.exe, .msi, .bat, .cmd, .com, .scr, .ps1, .vbs, .js (Windows)
What they do: Run code directly on your computer. A double-click is enough.
When they're fine: You're installing software from a known publisher, Windows shows a recognisable signature, and you expected to download it.
When to worry: Anywhere else, email attachments, unexpected downloads, files on a site that's impersonating a brand, files renamed from another format.
Every piece of Windows software you've ever installed is either a .exe or arrives inside a .msi installer, so these extensions are not inherently evil, they're the normal delivery format for software. The question is always who is behind the particular file and whether you asked for it.
.bat, .cmd, .ps1, and .vbs are script files: plain text instructions that Windows executes. They're especially dangerous because they're easy to write, easy to modify, and can be delivered as tiny files that look harmless until you open them. .scr is a screensaver format that's really just an executable in disguise, and it shows up in phishing attachments far more often than in legitimate screensavers.
.app, .pkg, .dmg (macOS)
macOS equivalents. .app bundles are applications. .pkg files are installer packages that run with elevated privileges. .dmg is a disk image that usually contains an .app. Modern macOS requires Apple's notarisation for apps to run without warnings, and Gatekeeper blocks unsigned code by default, but users can and do override those warnings, which is where most Mac malware sneaks in.
.apk (Android)
The standard Android install format. If you're downloading an .apk from outside the Google Play Store, Android calls this "sideloading" and warns you for good reason, you're bypassing the store's review process. Some legitimate apps are only distributed this way, but it's also the primary delivery format for Android malware. If you're asked to install an .apk to "track a parcel," "view a police notice," or "get a refund," close the browser.
.elf, .sh (Linux)
ELF binaries and shell scripts. Most home users won't encounter these, but if you run a Linux server or a Raspberry Pi, a stray .elf from /tmp/ is often the first sign of a botnet infection.
High-risk: macro-enabled documents
.docm, .xlsm, .pptm (and older .doc / .xls)
What they do: Office documents that contain macros, small programs written in VBA that run inside Word, Excel, or PowerPoint.
When they're fine: Internal business templates, trusted vendor workbooks, and automation macros you've reviewed.
When to worry: Any macro-enabled document from an external sender, especially ones that open with "Enable Content" prompts and promise invoices, resumes, or delivery confirmations.
Macros are still one of the most reliable ways malware reaches a corporate network. Microsoft has spent years tightening the defaults, recent versions of Office block macros from internet-sourced files by default, but attackers respond with new tricks: ZIPping the file, embedding it in an ISO, or socially engineering the user to click through the warning. Treat every unexpected .docm, .xlsm, or .pptm as suspicious.
.doc and .xls (the older formats without the "m") can also contain macros even though the extension doesn't show it. That's why modern Office formats split them into .docx/.docm, the "m" advertises that macros are present.
Medium-risk: documents that can embed active content
What it does: Portable Document Format. Usually text, images, and layout. Can also embed JavaScript, launch-actions, forms that post to external URLs, and exploits targeting old reader bugs.
When to worry: Unexpected PDFs that prompt you to "enable features," PDFs containing only a button that opens a URL, PDFs from senders you can't verify.
PDFs were the go-to malware carrier a decade ago when Adobe Reader had a steady stream of exploits. Modern readers, including the built-in viewers in Chrome, Edge, and Safari, run PDFs in heavily sandboxed environments, so exploit-based PDF malware is much rarer than it used to be. What's still common is phishing PDFs: a document that looks like an invoice but is really a giant clickable button pointing to a credential-harvesting page. Treat a PDF link the same way you'd treat any other link, check where it leads before you tap through.
.docx, .xlsx, .pptx (no macros)
The macro-free Office formats are generally fine. They're structured XML inside a ZIP, and while there are edge cases involving external references and remote template loading, the everyday risk is much lower than the macro-enabled versions. Still, open unexpected ones in Protected View (the default) and don't click "Enable Editing" unless you trust the sender.
Medium-risk: containers and disk images
.zip, .rar, .7z, .tar, .gz
What they do: Compress one or more files into a single archive. Safe or dangerous depending entirely on what's inside.
When to worry: Password-protected archives from external senders, archives containing executables or scripts, and archives whose only purpose seems to be hiding something from email filters.
Archives are wrappers, nothing more. The risk belongs to the contents. A common malware pattern is a password-protected .zip where the password is supplied in the email body, this is specifically designed to prevent scanners from seeing inside. If you receive one, that's a strong signal to stop and investigate.
.iso, .img, .dmg, .vhd
Disk images are full filesystems in a single file. On Windows 10 and later, a double-click mounts the image as a drive and exposes its contents, including executables that can bypass the "mark of the web" (the metadata Windows uses to warn about files from the internet). Malware authors love this trick. An unexpected .iso attachment is a strong signal of phishing, especially when it contains a small .lnk shortcut or .exe.
Low-risk: media and data files
.jpg, .png, .gif, .webp, .mp3, .mp4, .mov, .txt, .csv
What they do: Images, audio, video, and plain text. No code execution in any common scenario.
When to worry: When the extension is a lie, a file called invoice.pdf.exe or photo.jpg.scr where the real extension is hidden by a long filename.
Plain media files are genuinely low-risk. Historic exploits against image and audio decoders exist, but modern operating systems patch them quickly and most users aren't running ancient vulnerable libraries. The main thing to watch for is extension disguise: Windows hides known extensions by default, so holiday-photo.jpg.exe might display as holiday-photo.jpg with an Explorer icon that looks like an image. If you enable "show file name extensions" in File Explorer, this trick stops working.
Quick reference table
| Extension | Risk | When to scan |
|---|---|---|
| .exe, .msi, .bat, .ps1, .scr, .vbs | High | Always, unless from a trusted publisher you expected |
| .apk, .app, .pkg, .dmg | High | Always when sideloaded or from an unfamiliar source |
| .docm, .xlsm, .pptm, .doc, .xls | High | Always from external senders |
| Medium | When unexpected or from an unverified sender | |
| .zip, .rar, .7z | Medium | Always from external senders, especially if password-protected |
| .iso, .img, .vhd | Medium-High | Nearly always, rare in legitimate email |
| .docx, .xlsx, .pptx | Low-Medium | Only if sender is unverified |
| .jpg, .png, .mp4, .mp3, .txt, .csv | Low | Only if the file behaves strangely or won't open |
What a PDF actually is
A PDF (Portable Document Format) is a container. Its job is to render a document identically on any device, which means it has to bundle fonts, images, layout instructions, and interactive elements into a single file. That ambition is both its strength and its security problem, the PDF specification is large, and parsing it correctly is genuinely difficult.
Beyond rendering text and images, the full PDF specification supports:
- JavaScript execution, yes, PDFs can run scripts. Originally for form validation and interactive features.
- Embedded files, a PDF can contain other files (including executables) that the viewer can offer to extract.
- /Launch actions, an internal action type that can instruct the viewer to open an external file or URL.
- Form submissions, PDFs can include forms that POST their data to a URL.
- Dynamic content, XFA forms, embedded SWF (historically), 3D content.
Most of these features are rarely used in the documents you actually receive, but they exist in the specification and are honoured by fully-featured viewers. This is the core of PDF risk: the format supports more than most documents need.
The four main attack patterns
1. JavaScript exploiting a viewer vulnerability
The classic PDF attack. A PDF contains carefully-crafted JavaScript that exploits a bug in the PDF viewer to execute code outside the viewer's sandbox. Every major PDF viewer has had vulnerabilities of this kind at some point, and targeted campaigns often chain multiple exploits together to reach arbitrary code execution.
Mitigation in 2026: Adobe Acrobat, Foxit, and similar viewers now run with significantly stronger sandboxing than they did five years ago. Keeping your viewer current is the single most important defence, most attack campaigns target known, patched vulnerabilities because enough users remain unpatched for the exploit to still pay off.
2. Embedded file (drop and prompt)
The PDF contains an executable or script as an embedded file. When the user opens the PDF, it either auto-extracts the file (older viewers) or shows a prompt asking the user to open the attachment. The file extension often includes unicode trickery, spaces, zero-width characters, right-to-left overrides, to look harmless while actually being executable.
Modern defence: mainstream viewers now block execution of embedded executables without explicit user consent, and several file types are blocked outright. Browser viewers typically ignore embedded files altogether.
3. /Launch action (legacy vector)
An internal PDF action type that instructs the viewer to open an external file or URL. Historically this could be used to silently execute commands, the PDF would ship with an embedded payload and use /Launch to start it. Severely exploited throughout the 2010s, with both Adobe and Microsoft repeatedly issuing patches and policy tightening.
Status in 2026: /Launch actions are heavily restricted in every mainstream viewer. Adobe Acrobat disabled the ability to launch arbitrary executables by default over a decade ago. Browser viewers have never supported it.
4. Phishing-via-PDF (the dominant vector in 2026)
Not a PDF exploit at all, a social-engineering attack that uses a PDF as the delivery vehicle. The PDF itself is harmless: it's a one-page document showing what looks like a legitimate invoice, shipping notice, shared document, or HR form. Inside the document is a prominent clickable link or "button", "Click here to view document", "Open in DocuSign", "Verify your account".
The link goes to a phishing page. When the victim clicks, they're taken to a fake login page and asked to authenticate. The PDF never runs any code. Antivirus scans the PDF clean. The email gateway lets it through because it's a PDF and nothing in the file is detectable.
Why this works: PDFs are commonly sent as image-rendered documents. Text-based email filters can't see the link target because it's embedded in what appears to be an image. The whole PDF can be one page with a "View document" button that links to a phishing URL, and most spam filtering doesn't catch it.
Why browser PDF viewers are meaningfully safer
Chrome, Firefox, Safari, and Edge all include built-in PDF viewers that render PDFs without most of the risky features. Specifically:
- They do not execute PDF JavaScript.
- They do not prompt to open embedded files.
- They do not honour /Launch actions.
- They render PDFs in the same sandbox as the browser, which is among the most hardened sandboxes on modern desktop systems.
The trade-off is that some legitimate PDF features don't work, interactive forms might not submit correctly, digital signatures might display differently, some complex layouts render imperfectly. For 90% of PDFs the trade-off is invisible; for the remaining 10%, you can open the file in a full reader after previewing it in the browser first.
That "preview first" habit is a genuinely good defence. Open every PDF from an unexpected source in the browser first. If it's what you expected (a real invoice, a real form, a real document), you can decide whether to open it in a fuller viewer. If it's not what you expected, a fake DocuSign page, a PDF pretending to be a password-protected document you need to authenticate to view, you've identified the phishing attempt without executing anything.
When a "clean" PDF is still worth worrying about
A PDF that scans clean on every engine can still be dangerous if:
- It came from an unexpected source claiming to be a shared document, invoice, or receipt. Legitimate business communication rarely arrives as a surprise PDF from a sender you don't know.
- It contains a prominent "open document" or "verify account" link. The PDF itself is clean; the URL it links to may not be. Don't click.
- It's password-protected and the password is in the email body. This is a common technique used to evade gateway scanning, the scanner can't read the encrypted contents, so it passes the file through as unscannable. Once the user decrypts, the payload (usually a phishing link or an embedded exploit) is fully active.
- It renders as a single image of text rather than containing selectable text. Image-only PDFs are suspicious by default in business contexts, they exist largely to evade text-based filtering.
What I'd Tell You to Do Right Now
Go into your Windows File Explorer settings and turn on file extension visibility, that one change alone would have saved my colleague from that disguised .exe file. Then, next time you download anything from an email or a website you're not 100% sure about, drag it into our file scanner before you open it. It takes five seconds and the file never leaves your browser. I scan every attachment that comes from an address I don't recognise, and the one time I found something malicious it was a .docm file pretending to be a delivery receipt from a supplier we'd never used. Five seconds of checking versus potentially days of recovery. Easy decision.