scan.now
Premium Scan a site

Double file extension

The filename has a document-looking extension in front of a final executable one, such as invoice.pdf.exe, a disguise that depends on Windows hiding known extensions.

Do this: Delete it; nothing legitimate hides .exe behind .pdf. Windows hides the known extension, so invoice.pdf.exe is displayed to the user as invoice.pdf.
PassThe filename does not use a misleading double extension.
HighThe filename hides an executable extension behind a document-looking one.

The fix, in one snippet

Example to adapt Make Windows tell you the truth 
Explorer > View > Show > File name extensions

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

The scanner splits the name on dots and flags the case where the last extension is executable or script (.exe .scr .com .pif .bat .cmd .vbs .js .jse .wsf .hta .ps1 .msi .lnk .jar) and the one before it is a document or media type (.pdf .doc .docx .xls .jpg .png .txt .mp4 .zip and similar). It also detects the Unicode right-to-left override character (U+202E), which makes invoice_fdp.exe display as invoice_exe.pdf, and runs of spaces or underscores that push the real extension out of a file dialog's visible width. The finding is cross-checked with the content-type check. Compound extensions such as .tar.gz and .min.js are not flagged, because the final extension is not executable or the first is not a document type.

Why it matters

Windows Explorer hides extensions for known file types by default, and an executable can carry any icon it likes, so invoice.pdf.exe appears as invoice.pdf with a PDF icon. This has delivered trojans and ransomware in email zips for two decades; .scr and .pif behave exactly like .exe and are used because fewer people recognise them. The right-to-left override trick works on any platform that renders Unicode filenames. Windows users on default settings are the main target; macOS shows a warning for downloaded applications, but the disguise still passes a casual glance.

How to fix it

Show extensions everywhere: Windows 11: File Explorer > View > Show > File name extensions. Windows 10: View tab > tick File name extensions. macOS: Finder > Settings > Advanced > Show all filename extensions. Delete the file; if you have already run it, follow the steps under known malware signature. Outlook and Gmail block bare executables but not always those inside archives, so the extension display is your last line. Administrators can block these types with attack surface reduction rules or AppLocker. Guides: disguised files and double extensions and is this file safe?

Where this fits

Double file extension is check 5 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Decompression bomb (high), where the archive declares an uncompressed size vastly larger than its compressed size, so extracting it could fill your disk or freeze whatever tries to scan it. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

Double file extension closes one route in. Immediately below it: Executable embedded inside another file, where an executable program is embedded inside a file of another type, such as a Windows binary hidden in a PDF, an Office document, an RTF or an image; File content does not match its extension, where the bytes inside the file identify a different format from the one its extension claims, such as a Windows program named as a PDF or a zip named as an image; HTML file assembles a download in the browser, where the HTML file assembles a download inside the browser from encoded data using JavaScript, delivering a payload that never crossed the network as a file.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Double file extension (high severity)
Scanner check id: double-extension
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. Microsoft: Common file name extensions in Windows
  2. MITRE ATT&CK T1036.007: Double File Extension
  3. MITRE ATT&CK T1036.002: Right-to-Left Override
  4. Microsoft: Blocked attachments in Outlook

Related guides

8 min read · Updated Sep 13, 2026 Disguised Files: Double Extensions, Fake Icons and Executables Pretending to Be Documents

invoice.pdf.exe, a screensaver with a folder icon, a shortcut that runs PowerShell: Attackers rely on the file looking harmless. The...

Read the guide 8 min read · Updated Sep 16, 2026 Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It

You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...

Read the guide