Malware · Tool

File Checker

Downloaded a “geometry dash auto speedhack.exe” and now you’re having second thoughts? Good instinct. Drop it here and I’ll tell you what it really is, if its name is trying to trick you, and its fingerprint, so you can look it up on VirusTotal in one click.

Your file is never uploaded. Everything happens inside your browser, on your own PC. I don’t get it, my server doesn’t get it, nobody gets it. And checking it here can’t run it, so relax.

This isn’t an antivirus. It catches sneaky names and fake file types and recognises malware I’ve written about, but “no warnings” doesn’t mean “safe”. For a real verdict from dozens of antivirus engines, hit the VirusTotal button. And if you’re not sure about a program, the best antivirus in the world is not double-clicking it.

How it works

The checker looks at three things:

  • What the file really is. Every type of file starts with a few “magic” bytes: Windows programs start with MZ, PNG images with ‰PNG, PDFs with %PDF. That’s how it knows your “photo.jpg” is actually a program, no matter how innocent the name looks.
  • Tricks in the name, like the double extension ILOVEYOU used (.TXT.vbs), an invisible character that flips the end of the name backwards (yes, that’s a real thing), or a ton of spaces that push the real .exe out of view.
  • Its fingerprints. A hash like SHA-256 is calculated from every single byte, so it identifies this exact file. Change one byte and the hash is completely different. VirusTotal uses the same fingerprint, which is why the button can show you its results without your file ever leaving your PC.

For Windows programs it also reads the header the way VirusTotal’s Details tab does: whether it’s 32- or 64-bit, when it says it was built, its sections, and whether it has a digital signature block. That’s how I found out MEMZ was built on 10 July 2016. On a Sunday. Leurak, what were you doing on a Sunday.