File scanner

Upload a file and nineteen engines read it — by its bytes, not its name — and return a score from 0 to 100 with every finding behind it.

The Artifact Scanner takes a file and tells you what it is, what is wrong with it and how sure the platform is. The file stays on your server.

A file is what its bytes say

The type is read from the file’s content, never from its name. More than 40 formats are recognised by their bytes alone — Windows, Linux and macOS executables, Java and Android code, Office documents old and new, PDF, RTF, archives (ZIP, RAR, 7-Zip, GZIP, XZ, BZIP2, Zstandard, TAR, CAB, ISO), images, packet captures, SQLite databases and scripts with a shebang.

Containers are opened to see what they hold: a ZIP with word/ inside is a Word document, with AndroidManifest.xml and classes.dex an Android app, with META-INF/MANIFEST.MF a Java archive.

A file whose content does not match its name is a masquerade, and it is scored as one: a Windows program called invoice.pdf or data.json, a Word document with macros renamed report.bin, an Android app renamed app.zip. The name decides only between plain-text types — whether a text file is JSON, YAML or Python.

The engines

Engine	Looks for
Masquerade	Content that does not match the name, and a Linux or macOS program posing as a kernel thread
PE structure	Imports, sections and header anomalies in Windows executables
Office macros	VBA extracted from OLE2 and OOXML documents, and what it calls
Script and macro patterns	Malicious patterns in VBA, JavaScript, VBScript and PowerShell
Static heuristics	Injection and hollowing chains in a program’s import table
Secrets	Hard-coded keys, tokens and passwords
Archive inspector	Path traversal, executables and encryption inside ZIP and TAR
Local intelligence	The file’s hash, and the addresses and domains in it, against your local threat intelligence
YARA	The built-in rule set
YARA community	Community packs: 1,240 ReversingLabs rules and 2,926 YARA Forge rules, from sources whose licence allows it. A match names the rule’s author
ClamAV	ClamAV signatures
Sandbox lite	Static behavioural analysis of what the code would do
App integrity	Who signed an Android app, whether the signature holds, and whether it is a rebuild
Hidden payloads	Programs and scripts hidden in text: base64 (also reversed or split over lines), hex and byte arrays, and gzip inside them. What they decode to is analysed as a file of its own
Java archives	Every class in a JAR, read for what the program can do, and signatures over the decompressed classes
Installers	What a Windows Installer package runs, and each file it carries, cabinets included
Android apps	Permissions, components and platform calls, read for the shape of a job such as a banking trojan
Similar samples	Fingerprints close to known malware: relatives that no signature names
Shortcuts	The command inside a Windows shortcut
Capabilities (capa)	What a Windows or Linux program can do, read from its code by Mandiant’s capa, mostly tied to ATT&CK. It runs on a server with four cores and 8 GB to spare

YARA, ClamAV, capa and the macro and sandbox engines need their components installed. Where one is missing, it reports skipped — never “clean”. A platform on your own server includes ClamAV.

The score

Verdict	When
Dangerous	Something named the file: a signature, a known-bad hash, a rule written for that malware, or a disguise. The score is then 50 or more.
Suspicious	40 or more, and nothing named it: what it can do, riskware, the shape of a malicious job
Low risk	25–39
No threats found	0–24

The same score reads as the same word everywhere: on a phone, on a computer, in the scan history and in reports.

The result opens with Why this verdict: one sentence on what the verdict rests on and the reasons behind it, in the console’s language. A detection’s own name stays as its engine gave it.

The result lists every engine with its status and findings, so you can see exactly why the score is what it is. What its bytes say shows the type the content declares, next to the name it came with.

What the verdict means

Dangerous needs something to name the file: a signature, a known-bad hash, a rule written for that malware or tool, or a disguise. What a program is merely able to do is not enough.
Suspicious is what a program or app gets for what it can do when nothing names it. An injection chain in a program’s imports reads this way: debuggers have one too.
Riskware is an app that is not its publisher’s own build, or that a potentially unwanted program signature matched. Suspicious, not malicious.
Sensitive data is a file holding keys or credentials. It is not malicious, and it should not be shared.
Only partly checked is a file the scanner could not read: compressed or encrypted bytes in a format it does not open, audio and video. It is never reported as clean.

Android apps

The App integrity engine reads an app’s package name and signing certificates without running it. An app signed with a public test key, one whose signature schemes name different keys, and a rebuild signed by a website with a “mod” name read as riskware.

The signature itself is checked as Android checks it (schemes v2 and v3): it must verify, its key must be the certificate’s, and the digest it signs must be this file’s. A file changed after signing, or a certificate copied into someone else’s app, reads as riskware. An app signed only the old way (v1) is not checked, and earns no trust.

Keys of popular apps are built in: Telegram, WhatsApp, Signal, Zoom, AnyDesk, TeamViewer, Firefox, Brave, VLC, Bitwarden and F-Droid, each taken from a download on its publisher’s own site. A copy signed by that key, with a signature that holds, is the publisher’s own, and what it asks for is not held against it. A copy under the same package name with another key reads as repackaged. Apps published only through a store are not in the list: an administrator can record the key of a build they trust.

What an app may do is listed under What the app can do (reads SMS, draws over other apps, camera, starts at boot and so on) and earns nothing: a messenger and a spy app ask for the same permissions. The verdict rests on the shape of a job, counted on 101 clean apps and checked on 406:

Suspicious: a hidden app (no icon in the app list) that starts at boot with sensitive access; an app that reads messages or notifications and whose code names the Telegram bot API, the way SMS stealers in Central Asia report; a banking trojan’s permissions on a hidden app or one that reports to a bot. None of the 406 clean apps has any of these.
Low risk: a banking trojan’s permissions alone (accessibility, drawing over apps, reading messages), which automation tools also have, and a device administrator that can lock or wipe the device, which app lockers also are.
Riskware: a signature that does not hold, a public test key, a rebuild.

An app whose manifest cannot be read is reported as only partly checked. A Windows program inside an app is a finding against it; a Windows library is not, since Java libraries and .NET apps carry them.

Online and on an air-gapped server

Both run the same engines. A connected server can also ask public hash databases, if an administrator allows it; offline they show as off, not as clean. MalwareBazaar and ThreatFox need the administrator’s free abuse.ch key (LEGIT_ABUSECH_AUTH_KEY); without it they are not asked and read “needs a key”. Only the file’s hash is sent, never the file. ClamAV signatures reach an air-gapped server in a signed update bundle. The scanner page says before you upload how many engines are ready, how old the signatures are and the largest file this server can take.

Limits

A file can be up to 1 GB; the server’s memory sets the real limit, and the scanner page shows it. Your plan sets how many files a week the tenant can scan; past that, the scan is refused with the date the allowance resets.

Stored files

A scanned file is kept with its scan in the history, so the result can be opened again. Deleting the scan deletes the file and its reports with it; a file that another scan still uses stays until that scan is deleted too.