File type detection vs antivirus: what each one actually tells you
A detector tells you what a file is. An antivirus tells you whether it is known to be bad. They answer different questions, and confusing them leads to false confidence in both directions.
People sometimes drop a file on our detector, see “PDF document, 99% confidence”, and conclude that the file is safe. Others run an antivirus scan, see “no threats found”, and conclude that the file is what its name says. Both are reasonable-sounding mistakes, and both come from treating two different tools as one.
Two different questions
A file type detector answers: what is this? It reads the bytes and reports a format: PDF, Windows executable, ZIP, Python script. It makes no judgement about whether the content is good or bad.
An antivirus answers: is this known, or does it behave like something, that is harmful? It compares the file against what it has seen before and what it expects malware to do. It makes no promise about what the file is, only about whether it trips an alarm.
A file can be a perfectly ordinary PDF and also a phishing lure. A file can be “clean” according to every scanner and also a Windows program wearing a PDF icon. Each tool covers what the other misses, which is why security systems use both.
How antivirus decides
Modern scanners combine several techniques, roughly from cheapest to most expensive:
- Hash matching. Compute the file’s SHA-256 and look it up in a list of known-bad files. Instant and exact, and useless against anything new or modified by a single byte.
- Signatures and patterns. Byte sequences, strings and structures characteristic of known malware families, written as rules (the open YARA format is the common language for these). Catches variants of known families.
- Heuristics and machine learning. Static features of the file (imports, entropy, packing, odd structure) scored for how malware-like they look. Catches some new threats, with false positives.
- Emulation and sandboxing. Run the file in a controlled environment and watch what it does. Catches behaviour regardless of disguise, at the cost of time.
- Reputation. How many other machines have seen this file, how old it is, who signed it. A brand-new, unsigned executable is suspicious on that basis alone.
- Behaviour monitoring. On the running machine, watch for actions like mass file encryption or credential theft and stop the process.
Every one of these is a judgement about risk. None is a statement about format.
How type detection decides
A detector looks at the content and classifies the format. Traditional tools like the Unix file command match magic bytes against a table. Model-based detectors like Magika, which this site runs, are trained on millions of files and also handle formats with no signature, such as source code and text configuration.
The answer is a format and a confidence. That is the entire output, and that is the point: it is fast, deterministic, and impossible to fool by renaming.
Why security needs type detection first
Type detection is not a weaker antivirus. It is a step that antivirus and mail filters depend on, for three reasons.
Routing to the right scanner. A PDF parser, an Office macro analyser and a PE executable emulator are different engines. A security pipeline has to know what a file is before it can send it to the one that understands it. Google has described using Magika for exactly this, routing files in Gmail, Drive and Safe Browsing to the appropriate scanners.
Policies are about types. “Block executables in email” and “quarantine macro-enabled Office files” are type rules. If the gateway decides type by extension, renaming invoice.exe to invoice.pdf walks straight through. If it decides by content, the rename changes nothing.
Mismatch is a signal by itself. A file whose name says one thing and whose bytes say another is suspicious before any scanner looks at it. An executable named .pdf, an HTML page named .jpg, a ZIP named .docx with macros inside: legitimate software rarely produces these, and attackers produce them constantly. A detector catches the mismatch even when the payload is new enough that no antivirus has a signature for it yet.
Where each one fails
| Situation | Type detector | Antivirus |
|---|---|---|
| Known malware, correctly named | Reports the type; no verdict | Catches it |
| Brand-new malware, correctly named | Reports the type; no verdict | May miss it |
Executable renamed to .pdf |
Catches the mismatch | Catches it only if the payload is known |
| Legitimate PDF with a phishing link | Reports PDF, correctly | May miss it; link scanning helps |
| Encrypted, password-protected ZIP | Reports ZIP | Cannot see inside |
| Harmless file with a wrong extension | Reports the real type | Reports nothing |
The phishing PDF row is the one to remember. The file is genuinely a PDF; the detector is right. It contains no exploit; the scanner may be right too. The harm is a button that sends you to a fake login page, and the best defence there is the three-question attachment check, not either tool.
Using both, without uploading anything
For a file you are unsure about:
- Check the type. Drop it on the detector. If the type does not match the name, stop: that alone is reason enough not to open it. The detector runs in your browser, so the file goes nowhere.
- Check the hash. The detector shows the file’s SHA-256. Paste it into VirusTotal’s search box. If dozens of engines have flagged it, you have your answer. This sends only the hash, not the file.
- Read “unknown hash” correctly. If VirusTotal has never seen the hash, that does not mean the file is clean. It means nobody has submitted it, which for a file emailed to you specifically is normal for targeted malware and for legitimate documents alike. Fall back to step 1 and to the attachment check.
- Upload only if it is not sensitive. Submitting the file itself to VirusTotal runs it through dozens of engines, and also makes it available to VirusTotal’s paying subscribers. Never upload a confidential document there.
What the detector’s answer means, and does not
When the detector says “PDF, 99%”, it means the bytes are a PDF. It does not mean the PDF is safe, that its links are honest, or that its sender is who they claim. When it says “PE executable” for a file called scan.pdf, it means you have caught a disguise, whether or not any scanner knows the payload.
That is a narrow claim, and a useful one precisely because it is narrow: it is the one question in file security that has an exact answer. The safety guides cover what to do with that answer for each type, and how it works explains what the detector does and does not look at.