Fake File Detector

The oldest trick in malware history is also the simplest: rename a program to look like a document. A file called invoice.pdf.exe is a Windows executable — but because Windows hides known extensions by default, many people see only "invoice.pdf" and double-click it expecting a PDF viewer. That one click runs a program instead, and this exact disguise has delivered malware through email attachments for decades.

The defense is to ignore the name and read the file's magic bytes — the signature stamped into the first bytes of every real format. A genuine PDF begins with the text %PDF; a genuine JPEG begins with the bytes FF D8 FF; a Windows program begins with the letters MZ. These signatures are what your operating system actually uses to decide how to handle a file, so comparing them against the claimed extension exposes the disguise instantly.

Keep the honest limit in mind: magic bytes reveal the type, not the intent. A real PDF can still carry a malicious payload, and this tool will happily call it a PDF. Use it to unmask disguises — then let your antivirus decide about malice.