To judge whether a file is safe, work through five checks in order: where it came from and whether you expected it, what its bytes say it really is, whether its hash is already known, what a scan finds inside it, and, if you still need to open it, how to do so where it cannot do harm. Most files fail or pass at the first two steps.
Start from the question you are really asking
"Is this file safe?" is unanswerable as stated, because no check can prove a negative. The answerable version is: is there enough evidence to open this file with the risk I am willing to take? That reframing does two useful things. It puts the burden where it belongs, on the file to justify itself, and it makes the answer depend on stakes. A meme from a friend and an invoice from a supplier you have never used deserve different thresholds. The order below is arranged so that the cheapest checks with the strongest evidence come first, and you stop as soon as you have an answer. The malware scanning hub covers how the pieces fit into a scanner; this guide is about your decision.
Step 1: origin and expectation
Most malware arrives as a file that someone was persuaded to open, and the persuasion almost always involves a plausible sender and a reason to hurry. So the first question is not about the file at all:
- Did you expect it? An invoice you were waiting for is different from an invoice that appeared. A shared document you asked for is different from one "shared with you".
- Does the sender make sense for this file? Your bank does not email executables. A courier does not send Word documents. A colleague does not usually send a password-protected zip with the password in the same message.
- Was it pushed? Urgency, a deadline, a threat of suspension or a reward are the mechanics of phishing, and they are covered in how to spot phishing.
- Can you verify by another channel? A phone call, a message on a platform the email did not come through, or checking the vendor's site directly settles most cases in a minute.
A file from a compromised account is the hard case: the address is real, the name is right, the history is genuine. The tell is a change in behaviour, such as a new file type, an unfamiliar tone, a link where there was never one. When the origin check comes back "unexpected and unverifiable", stop here for anything that runs code. You do not need the remaining steps to decline.
Step 2: what the file really is
Names and icons are chosen by the sender. The format is dictated by the first bytes. Check them:
# macOS / Linux
$ file "Q3 statement.pdf"
Q3 statement.pdf: PE32 executable (GUI) Intel 80386, for MS Windows
# Windows PowerShell
PS> Format-Hex -Path ".\Q3 statement.pdf" -Count 16
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ..............Four outcomes cover almost everything. The bytes match the extension and the type cannot run code (an image, a plain text file, a video): the remaining risk is a parser exploit, which is real but rare against updated software. The bytes match and the type can carry code (Office document, PDF, archive, HTML): continue to step 4. The bytes are an executable, script or shortcut whatever the name says: you have your answer, and Scan.now's extension mismatch and double extension findings exist for this case. The bytes are an archive: list its contents and apply this step to each member, as described in archives and zip bombs. Make sure extensions are visible on your system so that the name at least tells you what it claims; the disguised-files guide linked below explains why that setting matters.
Step 3: the hash
Compute the file's SHA-256 and look it up. Three answers are possible, and only two of them are informative:
| Lookup result | What it means | Action |
|---|---|---|
| Known malicious, with a family name from several engines | This exact file has been analysed and is malware | Delete; report if it came by email |
| Matches the hash on the publisher's own download page | You have the file the publisher released | Trust to the extent you trust the publisher |
| Never seen, or seen only once | Nothing; new malware and new legitimate files look identical here | Continue to step 4 |
$ shasum -a 256 setup.dmg
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 setup.dmg
C:\> certutil -hashfile setup.msi SHA256The details, and why MD5 and SHA-1 are not adequate for the second case, are in file hashes explained. Scan.now's file hash reputation check performs the lookup as part of a scan.
Step 4: scan it, and read the findings
A scan gives you two things: a signature verdict, which is either a match or silence, and a list of structural findings, which are facts about the file for you to weigh. Upload the file to Scan.now's file scanner: it is analysed in memory with signature matching, structural analysis and heuristics, never executed and never stored. Then read the report as evidence rather than as a verdict:
- A known malware signature match is a fact. Stop.
- An Office macro, a PDF with JavaScript or an encrypted archive is a property that legitimate files sometimes have. Ask whether this file, from this sender, has any reason to have it. A macro in a spreadsheet from your own finance team is expected; in an "invoice" from a stranger it is disqualifying.
- An obfuscated script, a shortcut pointing at PowerShell, an HTML file that assembles a download, or an executable hidden inside a document has no innocent version. Treat those like a signature match.
- "No findings" means none of the layers objected. Combine it with steps 1 to 3: no findings on an expected file from a verified sender is a pass; no findings on an unexpected executable is not.
A second scanner is worth the minute when the stakes are high, because engines differ in what they know, and two clean verdicts from independent engines are worth more than one.
Step 5: opening it anyway, safely
Sometimes the checks are inconclusive and the file matters. The remaining option is to reduce what it can do if it is malicious:
- Use the least capable viewer. Open PDFs in a browser viewer; open Office files in Protected View without enabling anything; open images in an image viewer, not a full editor. If the content is readable there, you are done and need never leave the sandbox.
- Convert it. Print a document to PDF, export a PDF to images, paste text into a plain editor. The copy has the content and none of the objects.
- Isolate it. A virtual machine with no shared folders and a snapshot to roll back to, or a spare device with nothing on it, is the right place for a file you must run. Do not sign in to anything inside it.
- Watch for the ask. A file that asks you to enable content, allow a connection, open another file, run a program or enter a password has revealed its purpose. Decline and close.
When the checks disagree
The steps do not always line up, and the disagreements have a sensible resolution. A verified sender plus a scan finding such as a macro means the sender may be compromised or may simply use macros; ask them, and open in Protected View meanwhile. An unverified sender plus a clean scan on a document is the most common ambiguous case; the answer is to read it in a restricted viewer and never enable anything, which costs you nothing if it is legitimate. A known-good publisher hash plus a heuristic warning is almost always a packed installer tripping a rule, and the hash wins. A signature match from one engine and silence from another is a new sample that one vendor has catalogued first; treat it as malicious. In every case the tie-breaker is the same: the more the file can do if you are wrong, the more evidence it needs before you let it. Check the disguised files guide if any of the doubt is about what the file claims to be.
If you already opened it
Assume the worst for the type of file: an executable or script has run whatever it contained; a document with macros enabled has done the same; a document opened in Protected View or a browser viewer has probably done nothing. Disconnect the machine from the network, change important passwords from a different device, starting with email, and enable two-factor authentication where you have not. Run a full scan with your installed antivirus and, if anything is found or you remain unsure, treat the machine as compromised and reinstall rather than clean. The malware types guide describes what different payloads do next, which helps decide how far to go, and the download-time protections described in scanning downloads before opening them are the layer that should have caught it earlier.
