What the file scanner is for
Not every threat is an app. A lot of what lands on a phone or laptop arrives as a file: an "invoice" from a courier you weren’t expecting, a résumé, a shared-drive link that downloads a ZIP, a "photo" from a number you don’t know. Most are harmless. The ones that aren’t tend to rely on a small set of tricks that are old, well understood, and still effective because nobody looks.
GuestSpy’s file scanner looks. You drop a file into the Web Scanner, it is read entirely inside your browser, and the scanner reports what the file actually is (as opposed to what its name says), what is inside it, and whether anything in it is designed to run code or fetch something from the internet when you open it. Every finding has a rule ID and a plain-English explanation. The file never leaves your device.
Invoice_8841.pdf.lnk
Windows shortcut (LNK) · 2.1 KB · extension says PDFHashes
- SHA-256
- c91e…77a0
- SHA-1
- 5b02…e1c9
- MD5
- 9f1a…02bd
Shortcut
- Target
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- Origin machine
- desktop-7h3kq
Step 1: the real file type
Every file format starts with a recognisable byte sequence, called magic bytes or a file signature. %PDF- for PDF. PKx03x04 for ZIP (and therefore for DOCX, XLSX, APK, JAR and IPA, which are all ZIPs). MZ for a Windows executable. x7fELF for Linux and Android native binaries. {rtf for RTF. D0 CF 11 E0 for the old binary Office formats (.doc, .xls, .ppt). 4C 00 00 00 for a Windows shortcut (.lnk). A JPEG starts FF D8 FF.
The scanner reads those bytes first and decides the type from them. Then it compares with the extension in the file name. When they disagree, you get rule GS-R-101, "Declared extension does not match real type", and that one finding is enough to move most files to at least Suspicious.
The common deceptions:
Double extensions. invoice.pdf.exe. Windows hides known extensions by default, so the user sees invoice.pdf with (if the attacker bothered) a PDF icon. The scanner shows the full name and the real type side by side.
Right-to-left override (RTLO).
The Unicode character U+202E reverses the display direction of everything after it. A file named reportfdp.exe displays as reportexe.pdf in many file managers. The scanner detects U+202E and other bidirectional control characters anywhere in a file name and reports GS-R-102, showing you the raw name with the control character made visible.
Spaces and lookalikes. invoice.pdf .exe, with enough spaces that the real extension is pushed out of view. Or invoice.pdf.scr, since .scr (screensaver) is an executable Windows users rarely recognise. Or .com, .pif, .cpl, .msi, .hta, .jar. The scanner keeps a list of extensions that execute on Windows, macOS and Android and flags any file whose real type is executable regardless of what the name claims.
Honest but dangerous. Sometimes the type matches and that is the problem. A bare .exe sent over WhatsApp, an .apk attached to an email, a .dmg from a "support agent". The scanner does not need a mismatch to warn you; executables from untrusted sources are flagged on type alone.
Step 2: hashes
The scanner computes SHA-1, SHA-256 and SHA-512 for every file, plus MD5 for cross-referencing with older tools. The SHA-256 is checked against the known sample hashes in the indicator database (which, for mobile samples, means an exact match attributes the file to a family and sets confidence to Exact hash match).
For files that are archives, the scanner also hashes each member file individually, so an APK inside a ZIP is matched just as if you had dropped the APK in directly.
Hashes are also simply useful. If you want a second opinion from an online service, you can paste the hash rather than upload the file, which keeps the file private and tells you immediately whether anyone else has seen it.
Step 3: entropy
Entropy is a measure of how random the bytes in a file look, on a scale from 0 (all the same byte) to 8 (indistinguishable from random). Plain text sits around 4 to 5. A compressed image or a ZIP sits around 7.5 to 8, because compression removes patterns. Encrypted data is the same.
The scanner computes entropy for the whole file and, more usefully, in blocks, so it can see a file that is mostly ordinary with one very high-entropy region. Then it compares with what is expected for the real type:
A PDF with a long, high-entropy stream that is not an image or a font may contain an encrypted or compressed payload.
An executable whose code section is near 8.0 is packed
The real code is compressed or encrypted and will be unpacked at runtime, which is a classic way to defeat signature-based antivirus. Rule GS-R-110, "High entropy suggests packing or encryption".
An Office document with a high-entropy blob in an unexpected place (not in media/) may be carrying an embedded file.
A script file with high entropy is almost certainly obfuscated (see Step 6).
Entropy is never a verdict on its own. A password-protected ZIP has maximum entropy and might be your tax return. It is context for the other findings, and the report shows it as a small chart with the suspicious blocks marked.
Step 5: content checks by type
This is where the scanner goes beyond "what is it" to "what does it do when opened".
Office documents and macros
Modern Office files (.docx, .xlsx, .pptx) are ZIPs. The macro-enabled variants (.docm, .xlsm, .pptm) and, confusingly, ordinary .docx files that have been renamed, can contain a word/vbaProject.bin (or xl/vbaProject.bin) file. That file holds VBA macro code in a compressed binary format.
The scanner:
Finds vbaProject.bin wherever it is, and in the legacy .doc/.xls formats finds the VBA storage inside the OLE container.
Decompresses the VBA source and looks for auto-execute names
AutoOpen, Document_Open, Workbook_Open, Auto_Open, AutoExec, AutoClose, Document_Close, Workbook_Activate. A macro with one of these runs the moment the document opens (once macros are enabled). Rule GS-R-120.
Looks for dangerous calls
Shell, CreateObject("WScript.Shell"), CreateObject("Scripting.FileSystemObject"), URLDownloadToFile, XMLHTTP, ADODB.Stream, CallByName, Environ, Kill, and Declare statements importing Windows API functions. Rule GS-R-121.
Detects obfuscation
Long Chr() chains, StrReverse, Replace() games, Xor loops, and strings assembled from numeric arrays. Rule GS-R-122.
Checks for XLM 4.0 macros in Excel (xl/macrosheets/), an older macro system still abused because many scanners only look for VBA.
Checks for DDE fields (DDEAUTO) in Word documents, which can run a command without any macro at all.
Checks word/_rels/ and word/document.xml for external template references (attachedTemplate pointing at a URL), which load a macro-bearing template from the internet when the document opens. This "remote template" trick means a clean-looking document can be dangerous because of a single URL.
Lists embedded OLE objects (word/embeddings/), which can be executables, scripts or other documents, and scans each one as its own file.
The macro source is shown in the report, with the auto-execute lines and dangerous calls highlighted. You do not have to read VBA; the summary line says what it does ("On open, downloads a file from an external URL and runs it").
PDFs
PDF is a rich format and most of its features are benign. A few are not, and the scanner looks specifically for:
/JavaScript
And /JS – script embedded in the document. Legitimate forms sometimes use it for validation. Malicious PDFs use it to exploit the reader or to launch something. The script is extracted and shown. Rule GS-R-130.
/OpenAction
And /AA (additional actions) – things that happen automatically when the document or a page opens. Combined with JavaScript, this is "runs on open". Rule GS-R-131.
/Launch
– an action that runs an external program or file. Almost never legitimate. Rule GS-R-132.
/EmbeddedFile
And /EmbeddedFiles – files attached inside the PDF. The scanner extracts and scans each one, so a PDF with an EXE attached is caught, and so is a PDF with a DOCM attached that has a macro. Rule GS-R-133.
/URI
Actions – links. Listed, checked against the database, and flagged if they point at a raw IP, a shortener or a file host.
/SubmitForm
– sends form data to a URL. A PDF "form" that submits your details to an attacker’s server is a phishing page that doesn’t need a browser.
/XFA
Forms, /RichMedia (Flash, historically), and /ObjStm object streams used to hide the above from naive scanners. The scanner decompresses object streams and FlateDecode filters before searching, and also notes any names obfuscated with hex escapes (/J#61vaScript), which is a sign someone was trying to hide them.
A PDF that only contains text, images and fonts gets a clean content check and the report says so plainly.
Archives
ZIP, 7z, RAR, TAR, GZ, ISO and IMG are opened (where the format permits without a password) and each member is listed and scanned recursively. The things the scanner highlights:
Executables inside
(.exe, .scr, .dll, .msi, .bat, .cmd, .ps1, .vbs, .js, .jar, .apk, .dmg, .pkg, .sh). Rule GS-R-140. The archive-with-a-single-executable pattern, especially when the executable has a document-like name, is a classic delivery method.
Shortcuts inside
(.lnk), see below. An archive containing a .lnk and a hidden folder is a known pattern.
Nested archives
Especially several layers deep, which exist mainly to exhaust scanners.
Password-protected members
Which the scanner cannot open. It says so, and notes that attackers use "the password is in the email" to get past mail gateways.
ISO and IMG
Disk images, which Windows mounts with a double-click and which were used heavily for a while because they bypass the "mark of the web" that triggers security warnings.
Path traversal names
(../../something), which can write files outside the extraction folder.
APK and IPA inside
An APK found in any archive is handed to the app scanner and gets the full app teardown: manifest, certificate, permissions, C2 matches. An IPA (iOS app) has its Info.plist read for bundle ID and entitlements, its embedded provisioning profile checked (enterprise-signed apps are a common way to sideload monitoring apps on iPhones without the App Store), and its signer listed.
Scripts
Plain-text scripts are both common and easy to read, which is why attackers obfuscate them. The scanner handles .js, .jse, .vbs, .vbe, .ps1, .psm1, .bat, .cmd, .hta, .wsf, .sh, .py and a few others.
Encoded scripts
(.jse, .vbe) are decoded first.
Obfuscation
Is scored: proportion of the file that is String.fromCharCode, eval, unescape, atob, Chr(), Execute, -EncodedCommand, -enc, FromBase64String, IEX/Invoke-Expression, ^ caret insertion in batch files, string reversal, and variables with randomised names. Rule GS-R-150.
Layered decoding
The scanner attempts to decode base64, hex and simple XOR layers and rescans the result, up to a limit, so you see the actual command underneath, not the wrapper. Each layer is shown.
Download-and-run patterns
WScript.Shell + Run, MSXML2.XMLHTTP + ADODB.Stream, Invoke-WebRequest + Start-Process, certutil -urlcache, bitsadmin, curl ... | sh. Rule GS-R-151.
Persistence patterns
Writes to Run registry keys, scheduled task creation (schtasks), startup folder paths, crontab, LaunchAgents plists.
Environment checks
That suggest the script is sandbox-aware: checking for VM names, screen size, recent documents, or sleeping for a long time before acting.
Windows shortcuts (.lnk)
A .lnk file looks like a document or folder in Explorer, especially with a custom icon. Inside, it has a target path and arguments. The scanner parses the shortcut structure and shows:
The target (powershell.exe, cmd.exe, mshta.exe, rundll32.exe are all red flags).
The full argument string, which is typically an encoded or heavily spaced command. Attackers pad arguments with hundreds of spaces so the Properties dialog shows only the harmless-looking start.
The icon location, which is often a legitimate system DLL chosen to make the shortcut look like a folder or PDF.
Machine information the format leaks
The creator’s NetBIOS name, MAC address and drive serial, which are useful for attribution and sometimes for proving who made the file.
Rule GS-R-160, "Shortcut launches a script host or shell".
HTML smuggling
An .html or .htm attachment, or a page you saved because it asked you to, can carry a complete payload inside itself. The technique is to embed a file as a base64 string in JavaScript, decode it in the browser with a Blob, and trigger a download with a generated link, so no file crosses the network as a file and mail filters see only HTML.
The scanner looks for:
Large base64 blobs in <script> tags.
new Blob(
URL.createObjectURL, msSaveOrOpenBlob, atob( combined with a download= attribute or a programmatic click.
Password prompts or decryption routines around the blob (the "enter the password from the email" variant).
Login-form lookalikes
A form that posts to an external domain, or that collects credentials and then redirects to the real site.
Rule GS-R-170. The smuggled file is decoded and scanned as its own file, so if the HTML drops a ZIP containing an LNK that launches PowerShell, the report shows all three layers.
Images and media
Image and media files are mostly checked for type mismatch and for appended data: a real JPEG followed by a ZIP, an executable, or a script after the end-of-image marker. Some image formats also carry metadata (EXIF) that includes GPS coordinates and device identifiers, which is its own privacy issue; the scanner lists it so you can decide whether to strip it before sharing.
Executables
When the real type is a Windows PE, a Mach-O (macOS), an ELF (Linux/Android native) or a DEX, the scanner reports headers, sections, imports, signing status (Authenticode for PE, with the signer’s name and whether the signature validates), entropy by section, and the string categories from Step 4. It does not emulate or run anything. The verdict for an unsigned executable arriving from an untrusted source is Suspicious at minimum; with packing and suspicious imports, Dangerous.
Walking through a report
Here is what a report looks like for an attachment that arrived as Invoice_4471.pdf.zip from a courier the recipient was not expecting a parcel from.
Subject
Sync Services (com.guest) v2.4.1
APK · 4.2 MBSHA-256 7f3a9c0e…4e21b
Verdict
Severity 96 / 100
Confidence: signing-certificate match
Danger code GS-STK-AND-1405
Family
TheTruthSpy
also: Copy9, iSpyoo, FoneTracker, GuestSpy (legacy)
Evidence (12)
| CERT | Signer matches TheTruthSpy family | Certificate |
| GS-R-014 | Hides launcher icon | T1628.001 |
| GS-R-021 | Accessibility service declared | T1417.001 |
| GS-R-030 | SMS + call log + location combination | T1636.004 |
| GS-R-018 | Device administrator receiver | T1626.001 |
| GS-IOC-C2 | media-sync-a.thetruthspy.com | T1437.001 |
Checks performed
37 rules evaluated · 12 fired · 25 passed · 5 evidence levels · database 176 families / 2,953 hashes
Overview
Verdict: Dangerous
Danger code:GS-TRJ-WIN-0203
Severity: 88 / 100
Confidence: Heuristic
Summary: This ZIP contains a Windows shortcut disguised as a PDF. Opening the shortcut runs PowerShell with a hidden, encoded command that downloads a file from a remote server and executes it. Do not open it. The archive also contains a hidden folder with a decoy PDF.
Type analysis
| File name | Invoice_4471.pdf.zip |
| Claimed type | ZIP archive |
| Real type (magic bytes) | ZIP archive (PKx03x04) – matches |
| Size | 14.2 KB |
| Members | 2 visible, 1 hidden directory |
The outer file is honest. It really is a ZIP. The trick is inside.
Hashes
SHA-256, SHA-1, SHA-512 and MD5 of the archive, and SHA-256 of each member. No match in the known-sample database.
Members
| Name | Real type | Finding |
|---|---|---|
Invoice_4471.pdf.lnk |
Windows shortcut | GS-R-101 extension mismatch (displays as Invoice_4471.pdf with extensions hidden); GS-R-160 launches powershell.exe |
.cache/Invoice_4471.pdf |
Clean. A real, boring invoice used as a decoy, opened by the script after the payload runs so the victim sees what they expected. |
Shortcut analysis
Target: C:WindowsSystem32WindowsPowerShellv1.0powershell.exe
Arguments: -w hidden -nop -ep bypass -enc <base64, 1,912 characters, preceded by 740 spaces>
Icon: %SystemRoot%System32shell32.dll, index 1 (the generic document icon)
Creator machine name and MAC address: shown in the report
Decoded command (layer 1 of 2)
The base64 decodes to a PowerShell command that itself contains a second base64 string. The scanner decodes that too.
Decoded command (layer 2 of 2)
The inner script: downloads a file from a raw IP address over HTTP (GS-R-041, raw IP endpoint; GS-R-151, download and execute), saves it under %APPDATA% with a random name, creates a scheduled task to run it at logon (persistence), then opens .cacheInvoice_4471.pdf so the user sees an invoice. The download URL and IP are listed under Network indicators and were not in the C2 database (which is expected; this database is focused on mobile stalkerware).
Entropy
Archive: 7.9 (normal for a ZIP). Shortcut member after extraction: 5.1, with a high-entropy block corresponding to the encoded argument. Decoy PDF: 7.4 (compressed streams, normal).
Strings
URLs: 1 (raw IP). Paths: %APPDATA%, schtasks. Commands: powershell, -enc, -ep bypass, IEX, Start-Process.
ATT&CK mapping
T1204.002 User Execution: Malicious File · T1059.001 PowerShell · T1027 Obfuscated Files or Information · T1036.007 Double File Extension · T1053.005 Scheduled Task · T1105 Ingress Tool Transfer. (File reports use the ATT&CK Enterprise matrix for Windows and macOS threats and ATT&CK for Mobile for APKs and IPAs.)
What to do
- 1Do not open the shortcut. If you already did, treat the computer as compromised: disconnect it from the network, change passwords from a different device, and have it cleaned or reinstalled.
- 2Report the email to your provider as phishing.
- 3If this arrived in the context of someone monitoring you, keep the file and this report as evidence.
Getting files into the scanner
Drop them onto the scanner page or use the file picker. On a phone, you can open the scanner in the browser and pick from Downloads, from a messaging app’s media folder, or share the file to the browser. Multiple files at once are fine; archives are opened automatically.
If the file came from an email, save the attachment rather than opening it. If it came from a link, right-click and save (or long-press and download) rather than clicking through; the page may be an HTML smuggling page, and that is better scanned than visited.
If you received something suspicious and want to warn someone, send them the GuestSpy report (export as PDF) rather than the file. Forwarding the file just extends the attack.
Frequently asked questions
Is the file uploaded to GuestSpy?
No. Type detection, hashing, decompression, macro extraction and every other step run in your browser. The indicator database is downloaded to your device. Only a community report, if you submit one, leaves the browser, and it contains the file hash and your vote, not the file.
Can it scan a file that’s already on my phone?
Yes, if you can select it in the browser’s file picker. On Android that covers Downloads and most shared storage. On iOS it covers the Files app, including iCloud Drive and third-party providers.
Why does it say "Suspicious" for a password-protected ZIP?
Because it can’t see inside, and unsolicited password-protected archives are a common way to get past scanners. If you know and trust the sender and the password, open it on a device you can afford to clean up, or extract it and scan the contents.
Does it detect ransomware?
It detects the delivery mechanisms (macro documents, script droppers, LNK files, executables in disguise) that most ransomware uses to arrive. It does not identify specific ransomware families by name, and it is not a replacement for endpoint protection on a computer.
What about files on a Mac?
The same checks apply. The scanner recognises Mach-O executables, .dmg and .pkg installers, .app bundles inside archives, AppleScript and shell scripts, and LaunchAgent plists. Office macros and PDF tricks are cross-platform.
Run a free scan right now
Drop an APK, a file, your installed-apps list or an iPhone configuration profile into the GuestSpy Web Scanner. Everything is analysed inside your browser. Nothing is uploaded.