File X-Ray

How to use File X-Ray

1. Save the attachment or download somewhere you can find it, but don’t open it. Saving a file is safe; opening it is what lets a bad one run.
2. Press Choose files or drop one or more files onto the box. Any file type works, up to 50 MB each.
3. Read the verdict for each file (Looks safe, Be careful or High risk) and the reasons underneath. File X-Ray shows what the file really is, not just what its name says.
4. For a second opinion, copy the SHA-256 fingerprint or use Search on VirusTotal. Only the fingerprint is searched; the file itself stays on your device.
5. No file to hand? Try the Fake invoice, Macro document or Clean PDF examples. They’re built in your browser and are completely harmless.

If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi

Why dangerous attachments still work

Lots of scams arrive as a file rather than a link: an “invoice”, a “delivery note”, a “remittance advice” or a CV sent to a jobs inbox. The name looks ordinary and the message sounds urgent, so it’s easy to double-click without thinking. One click can install software that steals passwords, watches your banking or locks your files for a ransom.

The trick is usually in the name or the contents. Windows hides known file endings by default, so invoice.pdf.exe shows up as invoice.pdf. Office files can carry macros that run as soon as you press Enable content, and PDFs can contain scripts, actions that run on opening, or other files tucked inside. File X-Ray reads the first bytes of the file to find its real type, then looks inside for those tricks.

What the warnings mean

• Real type doesn’t match the name: the file says it’s a PDF or a photo, but its contents are something else, such as a Windows program. Honest files rarely do this.
• Double extension or disguised program: names like statement.pdf.exe or photo.jpg.scr, often padded with spaces so the real ending drops off the screen.
• Hidden text-direction or invisible characters: special characters can flip part of a name so exe reads as pdf. They have no honest use in a file name.
• Program, script, installer or app file: .exe, .scr, .js, .vbs, .msi, .apk, .jar and similar files run code as soon as they’re opened. Nobody needs to email you one of these out of the blue.
• Contains macros: an Office file with a vbaProject.bin inside, or a macro-enabled type such as .docm or .xlsm. Never press Enable content on a document you weren’t expecting.
• JavaScript, launch actions or action on open in a PDF: a PDF that tries to run something or open other files when you view it. Ordinary letters and statements don’t need this.
• Loads content from the internet, DDE fields and embedded objects: ways for a document to fetch or run something extra after you open it.
• Archives, password-protected archives and disk images: ZIPs, ISOs and similar files are often used to smuggle a program past email filters, especially when the password is in the email. File X-Ray looks inside ZIP files and Office documents where it can and tells you when it can’t.
• Web page or SVG image with scripts: a “document” that’s really a web page can show a fake login page when opened.

The verdict adds these up. Looks safe means none of the warning signs we check for turned up. It isn’t antivirus and can’t promise a file is harmless, because brand-new threats may not show any of these signs. If you weren’t expecting a file, check with the sender using a phone number or address you already have, not the details in the message.

Privacy

Your files are read on your own device and are never uploaded, logged or stored. File X-Ray works out the file type, the fingerprint and the warning signs inside your browser tab. When it needs to unpack a ZIP or an Office file, it loads the JSZip reader from jsDelivr, but your file stays with you. The VirusTotal button only sends the fingerprint, and only if you press it. Refresh the page and everything is gone.

FAQ

Is it safe to drop a dodgy file in here?

Yes. File X-Ray only reads the file’s bytes as data. It never opens, runs or previews the file, so nothing inside it can run.

Is this the same as antivirus?

No. It’s a quick red-flag check for the tricks scammers use most, such as disguised names, macros and risky PDFs. Keep your computer’s own security software switched on and up to date, and use the VirusTotal fingerprint search when you want a second opinion.

Can it check files inside a ZIP?

Yes, for ordinary ZIP files. It lists what’s inside and flags programs, macro documents and disguised names, including ZIPs inside ZIPs. It can’t look inside password-protected or damaged archives, or formats such as RAR and 7z, and it tells you when that happens.

I’ve already opened a file I’m worried about. What should I do?

Disconnect from the internet, run a full scan with your security software and change important passwords from a different device. If it was a work file, tell your IT team straight away. If money or bank details may be involved, call your bank on the number on the back of your card or dial 159, and report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (in Scotland, call Police Scotland on 101). Forward the email to report@phishing.gov.uk.

Related: Catpool home, Security, Document X-Ray, File Hash Checker, Email X-Ray, Link X-Ray.