Scan a File for Malware and Viruses

Upload a file up to 64 MB and get a verdict from signature matching, structural analysis and behavioural heuristics: Hidden executables, Office macros, PDF JavaScript, double extensions, archive bombs and more. Files are analysed in memory and never stored.

We never execute the file. A clean result means none of our indicators fired, not a guarantee. How to judge a file

Illustration of the file malware scanner in use

What this tool checks

20 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

File structure and malware indicators

20 checks

The ones that most often decide the grade:

Critical Known malware signature matchThe file matched a known malware signature, in our own signature set or in the local antivirus daemon when one is... High File content does not match its extensionThe bytes inside the file identify a different format from the one its extension claims, such as a Windows program... High Double file extensionThe filename has a document-looking extension in front of a final executable one, such as invoice.pdf.exe, a... High Office document contains macrosThe Office document contains VBA macro code, which runs with your user privileges as soon as you click Enable Content. High Office document loads a remote templateThe document is attached to a template at a remote address, so opening it silently fetches content from an external... High PDF contains JavaScriptThe PDF contains JavaScript, which Adobe Acrobat and some other readers execute when the document opens or when an...

Guides for this tool

Background reading written to go with these results.

12 min read · Updated Sep 11, 2026 Malware and File Scanning: How Scanners Detect Viruses, Trojans and Malicious Documents

A file scanner looks for known malware by signature, for suspicious structure such as macros and embedded scripts, and for behaviour...

Read the guide

8 min read · Updated Sep 16, 2026 Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It

You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...

Read the guide

8 min read · Updated Sep 02, 2026 How Antivirus and Malware Scanning Actually Works

A scanner decides whether a file is malicious by matching known signatures, analysing structure, emulating behaviour and consulting...

Read the guide

8 min read · Updated Sep 11, 2026 Malicious PDF Files: How a Document Runs Code and How to Check One

PDFs can carry JavaScript, launch actions, embedded files and exploits for the reader itself. The structures attackers use, the signals...

Read the guide

8 min read · Updated Sep 12, 2026 Office Macro Malware: Why 'Enable Content' Is Still the Most Dangerous Button

Word and Excel macros remain a leading malware delivery method because they run with your privileges. How macro droppers work, the newer...

Read the guide

8 min read · Updated Sep 14, 2026 Archives and Zip Bombs: Why Compressed Files Need Their Own Scan

Archives hide malware from casual inspection, can be password-protected to defeat scanners and can expand to terabytes to crash them....

Read the guide

Frequently asked questions

Do you keep my file?

No. It is analysed in memory and discarded. Only the SHA-256 hash and the verdict are stored.

Is this a replacement for antivirus?

No. It is a second opinion on one file before you open it. Antivirus watches everything, continuously, including what happens after a file runs.

What is the size limit?

64 MB. Larger files are best hashed locally and the hash checked against a threat-intelligence service.

Why is a clean-looking document flagged?

Documents that contain macros, remote templates, JavaScript or launch actions are flagged because those features are how documents deliver malware, even when this particular file is benign.

Do you check files against malware signatures?

Yes. Every file is checked against a signature database as well as being taken apart structurally, and the report tells you which layers ran. We do not name the engines behind the signature layer, because publishing that tells whoever is writing the next sample exactly what to evade.