scan.now
Premium Scan a site

Scan a File for Malware and Viruses

Upload a file up to 64 MB and get a verdict from signature matching, structural analysis and behavioural heuristics: Hidden executables, Office macros, PDF JavaScript, double extensions, archive bombs and more. Files are analysed in memory and never stored.

We never execute the file. A clean result means none of our indicators fired, not a guarantee. How to judge a file

What this tool checks

20 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

File structure and malware indicators

20 checks

The ones that most often decide the grade:

Critical Known malware signature matchThe file matched a known malware signature, in our own signature set or in the local antivirus daemon when one is...
High File content does not match its extensionThe bytes inside the file identify a different format from the one its extension claims, such as a Windows program...
High Double file extensionThe filename has a document-looking extension in front of a final executable one, such as invoice.pdf.exe, a...
High Office document contains macrosThe Office document contains VBA macro code, which runs with your user privileges as soon as you click Enable Content.
High Office document loads a remote templateThe document is attached to a template at a remote address, so opening it silently fetches content from an external...
High PDF contains JavaScriptThe PDF contains JavaScript, which Adobe Acrobat and some other readers execute when the document opens or when an...

How the file malware scanner examines an upload

The file is never executed. Multiple static-analysis layers look for known signatures, dangerous structures and misleading packaging.

Malicious files do not all look like executables. Office documents can contain macros and remote templates, PDFs can contain JavaScript or launch actions, and archives can hide executable content behind nested folders, misleading extensions or extreme compression ratios.

Scan.now reads the uploaded bytes in memory, calculates a SHA-256 fingerprint, identifies the actual file type and applies format-aware checks. Archives are inspected within strict depth, size and entry limits. Only the hash and derived verdict are retained; the uploaded file is discarded and never run.

Read in memoryAccept the bounded upload without writing it to a permanent file store.
Inspect safelyApply signatures, type validation and format-aware structural checks.
Explain the verdictList the indicators, severity and safe handling recommendation.

Put this result in context

This scanner answers one part of the review. Continue with Phishing URL Checker for lookalike domains and hidden redirects, then Password & Breach Check for breach lookup and strength analysis. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read Malware and File Scanning: How Scanners Detect Viruses, Trojans and Malicious Documents and Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It. The Known malware signature match check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

File analysis layers

Each layer catches a different family of suspicious behaviour without launching the file.

LayerWhat it examinesExamples it can flag
Type and namingMagic bytes, declared type, filename and extension combinations.Double extensions, executable content disguised as a document and type mismatches.
Signature matchingByte patterns and locally available malware signatures.Known or closely matching malicious samples.
Document structureOffice relationships, macros, remote templates, PDF actions and embedded objects.Active content that can run code or fetch a second-stage payload.
Archive inspectionEntry names, nesting, expansion size, compression ratio and contained file types.Path traversal names, archive bombs and hidden executable content.
Script and executable cluesSupported script syntax, launch behaviour and executable metadata.Obfuscated commands, suspicious launch instructions or dangerous file combinations.

How to interpret a file verdict

A warning identifies evidence. A clean result only means these static indicators did not fire.

No supported indicator found

The bounded signature and structural checks found no recognised warning. Keep normal endpoint protection in place before opening it.

Malicious or high-risk evidence

A known signature or dangerous active structure was found. Do not open the file on a normal workstation.

Suspicious capability

A macro, script, remote reference or packed archive may be legitimate, but its presence requires source and business-context review.

Handle an uncertain file safely

  • Confirm the sender and expected filename through a separate trusted channel.
  • Do not enable macros, bypass operating-system warnings or enter credentials after opening an unexpected document.
  • Use an isolated analysis environment and additional reputable scanners for high-value or high-risk decisions.
  • Preserve the SHA-256 hash so security staff can correlate the same file without redistributing it.

What this result does not prove

  • Static analysis cannot observe behaviour that appears only when the file executes in a particular environment.
  • Encrypted, corrupted, unsupported or deliberately evasive content can prevent complete inspection.
  • A clean result is a second opinion, not a replacement for endpoint protection, sandboxing or organisational controls.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Privacy Phishing URL Checker

Lookalike domains and hidden redirects
Privacy Password Strength & Breach Checker

Breach lookup and strength analysis
Browsers Browser Extension Analyzer

Permissions, host access, remote code
Websites Website Vulnerability Scanner

Headers, TLS, cookies, exposed files

Guides for this tool

Background reading written to go with these results.

12 min read · Updated Sep 11, 2026 Malware and File Scanning: How Scanners Detect Viruses, Trojans and Malicious Documents

A file scanner looks for known malware by signature, for suspicious structure such as macros and embedded scripts, and for behaviour...

Read the guide
8 min read · Updated Sep 16, 2026 Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It

You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...

Read the guide
8 min read · Updated Sep 02, 2026 How Antivirus and Malware Scanning Actually Works

A scanner decides whether a file is malicious by matching known signatures, analysing structure, emulating behaviour and consulting...

Read the guide
8 min read · Updated Sep 11, 2026 Malicious PDF Files: How a Document Runs Code and How to Check One

PDFs can carry JavaScript, launch actions, embedded files and exploits for the reader itself. The structures attackers use, the signals...

Read the guide
8 min read · Updated Sep 12, 2026 Office Macro Malware: Why 'Enable Content' Is Still the Most Dangerous Button

Word and Excel macros remain a leading malware delivery method because they run with your privileges. How macro droppers work, the newer...

Read the guide
8 min read · Updated Sep 14, 2026 Archives and Zip Bombs: Why Compressed Files Need Their Own Scan

Archives hide malware from casual inspection, can be password-protected to defeat scanners and can expand to terabytes to crash them....

Read the guide

Frequently asked questions

Do you keep my file?

No. It is analysed in memory and discarded. Only the SHA-256 hash and the verdict are stored.

Is this a replacement for antivirus?

No. It is a second opinion on one file before you open it. Antivirus watches everything, continuously, including what happens after a file runs.

What is the size limit?

64 MB. Larger files are best hashed locally and the hash checked against a threat-intelligence service.

Why is a clean-looking document flagged?

Documents that contain macros, remote templates, JavaScript or launch actions are flagged because those features are how documents deliver malware, even when this particular file is benign.

Do you check files against malware signatures?

Yes. Every file is checked against a signature database as well as being taken apart structurally, and the report tells you which layers ran. We do not name the engines behind the signature layer, because publishing that tells whoever is writing the next sample exactly what to evade.