triage a suspicious file safely, never execute it

the hook: someone emails you "invoice.pdf" and your gut says nope

you know that feeling. an attachment shows up, the name looks normal, but something's off. maybe the sender's weird, maybe the extension has an extra dot in it. the instinct to double click and "just see what it is" is exactly how systems get owned. good news: you can figure out what a file actually is without ever running it. this is basic triage, and every defender should have this muscle memory.

step one: hash it before you touch it

the very first thing you do with a suspicious file is generate a hash, not open it. a hash is a fingerprint, a short string that uniquely represents the file's contents. if even one byte changes, the hash changes completely.

sha256sum invoice.pdf.exe

take that hash and paste it into VirusTotal or a similar lookup. odds are decent that someone else on the planet has already seen this exact file. if 40 antivirus engines flag it, you're done, you know it's bad and you didn't have to execute a single instruction of it. if nothing comes up, that just means it's new or targeted, not that it's safe.

step two: pull strings out of it

strings extracts every readable chunk of text buried inside a binary, even if the file itself isn't meant to be read as text.

strings invoice.pdf.exe | less

you're scanning for anything human readable that hints at intent: hardcoded URLs, IP addresses, suspicious command lines, references to powershell, registry paths, or weird domain names. malware authors are lazy sometimes and leave plaintext command and control addresses sitting right there. this step alone has outed plenty of malicious files without any dynamic analysis at all.

step three: check what the file actually is

this is the part everyone skips and it's the one that matters most. the extension on a filename is just text, it means nothing about what the file actually contains. windows will happily let something named invoice.pdf.exe show up looking like a pdf if file extensions are hidden, and that's the entire trick.

file invoice.pdf.exe

the file command doesn't trust the name at all. it reads the actual file header, the magic bytes at the start of the file, and tells you what it truly is. a real pdf will report back as PDF document. if instead you get PE32 executable, congratulations, you just caught a disguised executable before it did anything to your machine. this single command has saved more people than any antivirus popup.

step four: if you must run it, run it somewhere that can't hurt you

sometimes you genuinely need to see behavior, what files it drops, what network calls it makes, what registry keys it touches. that's fine, but it happens in an isolated sandbox, never on your daily driver. think a disposable virtual machine with no network access to your real environment, snapshotted so you can roll it back, or a dedicated malware analysis vm that's fully segmented from anything you care about. tools like any.run or a local cuckoo setup exist so you can detonate safely and watch what happens from a safe distance. the golden rule: if you wouldn't be upset if that vm got fully wrecked, you're in the right environment.

the takeaway

the whole point of triage is to learn as much as possible before you ever give a file permission to execute. hash it and check if the world already knows about it. pull the strings and look for anything that smells like infrastructure or commands. run file and confirm the thing actually is what it claims to be. only after all that, if you still need behavioral answers, detonate it in a sandbox that has zero path back to anything real.

protect yourself going forward by showing file extensions in your file explorer settings, so invoice.pdf.exe actually looks like invoice.pdf.exe instead of hiding behind a fake icon. be suspicious of double extensions. and build the habit of never executing first and asking questions later, analysis always comes before execution, no exceptions.