The fix, in one snippet
binwalk suspicious.jpgIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner searches the whole byte stream, and every decompressed sub-stream it can reach (zip entries, PDF FlateDecode streams, OLE storages, base64 text runs), for an MZ header whose e_lfanew field points at a valid PE\0\0 signature, and for ELF and Mach-O headers. It also looks for OLE Package objects (\x01Ole10Native) in Office files, \objdata hex blobs in RTF, Microsoft cabinet (MSCF) headers, and data appended after a format's legitimate end: after %%EOF in a PDF, after the IEND chunk of a PNG, after the end-of-central-directory record of a zip. Single-byte XOR obfuscation is tested by looking for the encoded "This program cannot be run in DOS mode" string. Limits: multi-byte or real encryption is invisible to this method; a PDF portfolio that legitimately carries an installer is rare but possible.
Why it matters
A file that opens as a document or image but carries a program inside is a dropper: the visible part is displayed normally while a macro, script or shortcut extracts and runs the hidden binary, with no network download to inspect. RTF files with embedded Package objects prompt the user to open them; PNG files with appended data are used as a cheap form of steganography by loaders; polyglots are valid as two formats at once so each parser sees something harmless. The person opening the container is the target, and the container is chosen to pass the filters in front of them.
How to fix it
Do not open the file. If you need to analyse it, do so in a virtual machine with carving and Office tools:
$ binwalk -e suspicious.pdf
$ rtfobj suspicious.rtf # from oletools
$ oledump.py suspicious.docIf the container is something you built yourself (an installer inside a zip you renamed), you will already know. Otherwise delete it and report it. Related checks: executable file, Office macros and PDF embedded files. Guides: disguised files and signature vs heuristic detection.
Where this fits
Executable embedded inside another file is check 6 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Double file extension (high), where the filename has a document-looking extension in front of a final executable one, such as invoice.pdf.exe, a disguise that depends on Windows hiding known extensions. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Executable embedded inside another file closes one route in. Immediately below it: File content does not match its extension, where the bytes inside the file identify a different format from the one its extension claims, such as a Windows program named as a PDF or a zip named as an image; HTML file assembles a download in the browser, where the HTML file assembles a download inside the browser from encoded data using JavaScript, delivering a payload that never crossed the network as a file; Obfuscated or encoded script, where the script's code is deliberately hard to read: Encoded strings, character-code arrays or packed layers that hide what it does.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Executable embedded inside another file (high severity)
Scanner check id: embedded-executableThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 13, 2026
Disguised Files: Double Extensions, Fake Icons and Executables Pretending to Be Documents
invoice.pdf.exe, a screensaver with a folder icon, a shortcut that runs PowerShell: Attackers rely on the file looking harmless. The...
Read the guide
8 min read · Updated Sep 05, 2026
Signature vs Heuristic vs Behavioural Detection: How Malware Scanners Differ
Signatures catch what has been seen before; heuristics catch what looks wrong; behavioural analysis catches what acts wrong. Each...
Read the guide