scan.now
Premium Scan a site

Password-protected archive

The archive's contents are encrypted with a password, so neither Scan.now nor your antivirus can inspect what is inside before you extract it.

Do this: We cannot see inside. Ask the sender why it needs a password. Encryption stops every scanner, yours included, which is exactly why malware arrives this way with the password in the email.
PassThe archive is not password-protected.
MediumThe archive is encrypted and its contents could not be scanned.

The fix, in one snippet

Example to adapt Ask before opening 
A password in the same message that carries the file is a red flag, not a security measure.

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

For zip files the scanner reads each entry's general-purpose flag bit 0 and looks for compression method 99 (WinZip AES); for 7z it distinguishes an encrypted header from encrypted entries; for rar it reads the header-encryption flag. Traditional zip encryption leaves the file names and sizes in the clear, so those are listed; if the names look executable (.exe, .js, .lnk, .iso) the severity rises. Scan.now does not accept a password and does not try to guess one, so the contents remain unexamined and the finding is reported as "cannot scan" rather than "clean".

Why it matters

"The password is 1234" in the body of the email is a deliberate evasion: the gateway cannot open the archive, the recipient can. Emotet, Qakbot and Bumblebee all shipped this way, usually with an invoice or delivery theme. Encrypted archives have legitimate uses, such as HR documents or sharing sensitive data, but in those cases the password arrives through a different channel and the sender is expected. Note that traditional ZipCrypto is weak and leaks names, which does not matter to an attacker; the point is to defeat automated scanning, not to protect the contents.

How to fix it

Only extract if you expected the file and received the password separately. Extract inside Windows Sandbox or a virtual machine, then submit each extracted file to the file scanner on its own. Check the listing first; names are visible without the password for zip:

$ unzip -l delivery.zip
  Length      Date    Time    Name
   712704  2026-08-02 09:14   Delivery_Notice.pdf.exe

Administrators should quarantine encrypted archives from external senders. If you send sensitive files yourself, use 7-Zip with AES-256 and header encryption, and share the password by phone or a messaging app rather than in the same email. Guides: archives and zip bombs and is this file safe?

Where this fits

Password-protected archive is check 18 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits PDF contains embedded files (medium), where the PDF carries one or more attached files inside it, which can be executables, scripts or further documents that a reader can extract and open. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

Password-protected archive closes one route in. Immediately below it: EICAR antivirus test file, where the file contains the EICAR test string, a harmless sequence that every antivirus engine is required to detect; File hash reputation, where scan.now computed the file's SHA-256 (plus MD5 and SHA-1 for comparison with older feeds) and compared it with the hash lists it holds; this entry explains what a match or a miss means.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Password-protected archive (medium severity)
Scanner check id: archive-encrypted
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. PKWARE: .ZIP File Format Specification (APPNOTE)
  2. MITRE ATT&CK T1027.013: Encrypted/Encoded File
  3. CISA: Emotet Malware (AA20-280A)

Related guides

8 min read · Updated Sep 14, 2026 Archives and Zip Bombs: Why Compressed Files Need Their Own Scan

Archives hide malware from casual inspection, can be password-protected to defeat scanners and can expand to terabytes to crash them....

Read the guide 8 min read · Updated Sep 16, 2026 Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It

You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...

Read the guide