Skip to content
Aback Tools Logo

Suspicious File Pattern Detector

Upload any file to scan for suspicious patterns commonly used in malware distribution and file-based attacks. Our Suspicious File Pattern Detector checks for: double extensions (detecting masquerading files like document.pdf.exe), Unicode bidirectional override characters (all 11 bidi control characters including U+202E RIGHT-TO-LEFT OVERRIDE that can make a file appear as a different type), zero-width invisible characters used to create visually identical filenames, Shannon entropy analysis to identify encrypted or packed payloads (with configurable thresholds for warning at 6.5 bits/byte and critical at 7.5), and hidden data appended after known end-of-file markers for PNG (IEND), JPEG (EOI 0xFF 0xD9), PDF (%%EOF), ZIP (end-of-central-directory), and GIF (0x3B) formats. Each detected pattern is classified by severity (info, warning, critical) with detailed explanations, and the tool provides an overall file risk assessment. All processing runs entirely in your browser - nothing is uploaded to any server. Free to use, no signup required.

Suspicious File Pattern Detector

Upload any file to scan for suspicious patterns commonly used in malware distribution and file-based attacks. Checks for double extensions, Unicode bidi overrides, zero-width characters, high entropy (encrypted/packed payloads), and hidden data appended after end-of-file markers - all processed locally in your browser.

Drop any file here or click to browse

Supports any file type - up to 100 MB. All processing is done locally.

How Pattern Detection Works

This tool scans both the filename and file content for suspicious indicators. Filename analysis checks for double extensions (e.g., document.pdf.exe), Unicode bidirectional override characters that can make filenames appear as a different type, and zero-width invisible characters used to create visually identical but distinct filenames. Content analysis calculates Shannon entropy to detect encrypted or packed payloads, and searches for hidden data appended after known end-of-file markers (IEND for PNG, %%EOF for PDF, end-of-central-directory for ZIP, and more). All processing is done locally in your browser - no data is uploaded anywhere.

Features

Double Extension Detection

Detects filenames with double extensions (e.g., document.pdf.exe, invoice.docx.js) - a common malware technique where files masquerade as safe document types while actually being executable. Checks against a comprehensive list of known dangerous executable extensions (.exe, .bat, .vbs, .ps1, .jar, .dll, and more) paired with safe-looking preceding extensions (.pdf, .docx, .jpg, .png, etc.).

Unicode & Filename Anomaly Detection

Scans filenames for Unicode bidirectional override characters (U+202E RIGHT-TO-LEFT OVERRIDE and 9 others) that can make a file appear as a safe type when it is actually an executable. Also detects zero-width invisible characters used to create visually identical but distinct filenames. Shows the actual (unobfuscated) filename for complete transparency.

Entropy-Based Payload Detection

Calculates Shannon entropy across multiple file regions to detect unusually high entropy indicative of encrypted, compressed, or packed payloads. Flags content with entropy above 6.5 bits/byte as suspicious and above 7.5 as critical (consistent with encrypted malware payloads). Typical text files have entropy around 4-5, making high-entropy regions easy to spot.

Hidden Data After EOF Detection

Scans for data appended past official end-of-file markers for multiple formats: IEND for PNG, %%EOF for PDF, EOI (0xFF 0xD9) for JPEG, end-of-central-directory for ZIP archives, and GIF trailer (0x3B). Detected hidden data is analyzed for entropy, printable text, and executable code signatures (MZ, ELF, Mach-O headers). Also performs generic trailing-padding analysis for unknown formats.

Use Cases

Security Threat Detection

Quickly screen downloaded files and email attachments for malicious indicators before opening them. Detect double-extension masquerading, hidden payloads, and Unicode obfuscation - the most common techniques used to distribute malware through phishing campaigns and drive-by downloads.

Digital Forensics & Incident Response

During incident response investigations, scan suspicious files for tampering indicators. Hidden data after EOF markers can reveal steganographic payloads, appended malware, or exfiltrated data concealed within otherwise legitimate-looking files. Entropy analysis helps identify packed/encrypted malware samples.

Enterprise Email Security Screening

Before allowing email attachments into your organization, scan them for suspicious patterns. Flag files with double extensions (the most common bypass technique for email filters), RTL override characters used to disguise file types, or hidden data appended after legitimate file boundaries.

Security Awareness & Education

Use real examples to demonstrate to employees and students how attackers disguise malicious files. Show how a file named document.pdf.exe appears in different operating systems and how Unicode override characters can make a filename look completely different from its actual extension.

File Integrity & Tamper Detection

Check if files have been tampered with by detecting hidden data appended after EOF markers. If a legitimate file shows unexpected data past its expected boundary, it may have been modified to include additional content - useful for verifying file integrity in security-sensitive contexts.

Cybersecurity Research & Analysis

Analyze malware samples and suspicious files to understand the obfuscation techniques used. The tool provides detailed entropy analysis across file regions, identifies specific Unicode characters used for obfuscation, and detects commonly abused file format features for hiding data.

About

What Are Suspicious File Patterns?

Suspicious file patterns are indicators in a file's name or content that suggest it may be malicious or tampered with. Attackers commonly use techniques like double extensions (invoice.pdf.exe where the file is actually an executable), Unicode bidirectional override characters (which can reverse the display of a filename to hide the real extension), and hidden data appended after legitimate file boundaries. These patterns are rarely seen in legitimate files and are strong indicators of malicious intent.

How Double Extension Masquerading Works

Double extension attacks work by exploiting operating system defaults that hide known file extensions. A file named document.pdf.exe appears in Windows as "document.pdf" because the .exe extension is hidden. The tool detects this by checking if the filename has the pattern [safe_extension].[dangerous_extension] - checking against a database of known safe document types (.pdf, .docx, .jpg, etc.) paired with dangerous executable types (.exe, .bat, .vbs, .ps1, etc.). This is one of the most common malware distribution techniques in phishing campaigns.

How Unicode Bidi Override Detection Works

Unicode bidirectional (bidi) override characters, particularly U+202E RIGHT-TO-LEFT OVERRIDE, can reverse the display order of characters in a filename. A file named "doc‮cod.exe" displays as "doc.exe.doc" on most systems because the RTL override reverses everything after it. The tool specifically scans for all 11 Unicode bidi control characters, lists each one found with its Unicode code point and official name, and shows the actual (unobfuscated) representation of the filename so you can see the true extension.

What Does Entropy Analysis Tell Us?

Shannon entropy measures the randomness or unpredictability of data. Normal files have predictable entropy ranges: text files average 4-5 bits/byte, compressed files 5-6.5, and encrypted or properly random data approaches 8 bits/byte. Malware authors often pack or encrypt their payloads to evade signature-based detection, which results in very high entropy regions. The tool analyzes multiple regions of the file (beginning, middle, and end) to catch partial packing and provides the highest detected entropy value with appropriate context.

Related Tools

Steganography Detector

Upload an image to detect potential hidden data using LSB (Least Significant Bit) steganography analysis. Analyzes pixel-level modifications, shows a heatmap of altered pixels, detects statistical anomalies, and extracts hidden text messages if found. Compatible with standard LSB encoding and the STEG magic header format. All processing happens locally in your browser - free online steganography detector, no signup required.

Image File Size Analyzer

Upload any image to see a detailed binary-level breakdown of what contributes to its file size - pixel data, compression overhead, metadata (EXIF/IPTC/XMP), color profiles (ICC), and structural headers. Get prioritized optimization tips with estimated savings for web performance, mobile app optimization, and storage reduction. Supports JPEG, PNG, GIF, WebP, BMP, TIFF, AVIF, and HEIC - all processing runs locally in your browser, no server upload required. Free online image file size analyzer.

File Magic Byte Detector

Upload any file to instantly detect its true file type by reading the magic bytes (file signature / header). The tool bypasses incorrect file extensions and reveals the real format. Shows hex dump with matching signature bytes highlighted, ASCII interpretation, MIME type, file category, and extension match analysis. Supports over 120 file signatures across 16 categories: images, audio, video, documents, archives, executables, fonts, certificates, disk images, and more. All processing runs locally in your browser - free online File Magic Byte Detector, no signup required.

Image Clone Detector

Detect copy-move forgeries in images using pixel-block matching. Upload any image to find cloned/copied regions, view heatmap overlays showing the location and intensity of detected clones, and get confidence scores with region details. Three sensitivity presets for different detection needs. 100% private browser-based processing - free online Image Clone Detector.

FAQ
What file types does the Suspicious File Pattern Detector support?
The tool accepts any file type up to 100 MB. Filename analysis (double extensions, Unicode bidi characters, zero-width characters) works on all files regardless of type. Content analysis - entropy calculation and hidden-data-after-EOF detection - works on the file's binary data and has special EOF markers for PNG, JPEG, PDF, ZIP (and ZIP-based formats like DOCX/XLSX/PPTX), and GIF files. For other formats, a generic trailing-padding analysis is performed.
Can this tool detect all types of malware?
No. This tool detects specific suspicious patterns commonly used in malware distribution and file-based attacks - it is not a comprehensive antivirus scanner. It focuses on: filename obfuscation techniques (double extensions, Unicode bidi overrides), entropy anomalies suggesting encrypted/packed content, and hidden data appended after legitimate file boundaries. It does not detect viruses, worms, trojans by signature, or zero-day exploits. Use it as a first-line screening tool in combination with proper antivirus software.
What is a "double extension" and why is it suspicious?
A double extension is when a filename contains two file extensions, like "invoice.pdf.exe" or "photo.jpg.js". This is suspicious because operating systems (especially Windows) hide known file extensions by default, so "invoice.pdf.exe" displays as "invoice.pdf" - making an executable file look like a PDF. This is one of the most common techniques used in phishing campaigns to trick users into opening malicious files. The tool detects this pattern by checking if a known safe extension is followed by a known dangerous extension.
What are Unicode bidirectional override characters?
Unicode bidirectional (bidi) override characters are special Unicode control characters that change the text direction of characters that follow them. The most dangerous one is U+202E RIGHT-TO-LEFT OVERRIDE, which reverses the display order of subsequent characters. An attacker can name a file "doc‮exe.pdf" - the RTL override reverses "exe.pdf" to display as "fdp.exe", making it appear that the file is a PDF when it is actually an executable. The tool detects all 11 Unicode bidi control characters and shows you the unaltered actual filename.
How is entropy calculated, and what do the thresholds mean?
Shannon entropy is calculated by analyzing the frequency distribution of byte values in a data sample. The result ranges from 0 to 8 bits per byte. Plain text files typically have entropy around 4-5 bits/byte. Compressed or packed data ranges from 5-6.5. Values above 6.5 bits/byte are flagged as suspicious because they suggest encrypted or properly packed content, which is consistent with malware trying to evade signature detection. Values above 7.5 are flagged as critical since they strongly indicate encrypted payloads. The tool samples three regions (beginning, middle, end) to catch partially packed files.
What does "hidden data after EOF" mean?
Many file formats have well-defined end-of-file (EOF) markers that signal where the file data ends - for example, IEND in PNG, %%EOF in PDF, or 0xFF 0xD9 in JPEG. If data exists after these markers, it is not part of the original file and has likely been appended. Attackers use this technique (a form of steganography) to hide data or malicious payloads within otherwise legitimate-looking files. The tool searches for known EOF markers for common formats and flags any data found beyond them, analyzing the appended data for entropy, printable text, or executable code signatures.
Are my files uploaded to any server?
No - absolutely not. All pattern detection runs entirely in your browser using the File API. Your files are read locally and never leave your device. No data is uploaded, logged, stored, or transmitted anywhere. This is a 100% client-side tool.
What is the file size limit?
The tool accepts files up to 100 MB. For content analysis, only the first 1 MB of the file is sampled for entropy calculation and EOF analysis to ensure fast processing. Filename analysis works instantly regardless of file size.
Is this Suspicious File Pattern Detector completely free?
Yes - 100% free, forever. No signup, no account, no premium tier, no usage limits. Scan as many files as you need. All processing is done locally in your browser with zero server uploads.