LOCAL STATIC FILE ANALYSIS
Know what’s hiding
inside the document.
Upload an Office document, Windows installer, ZIP archive, JSON file, or JavaScript source. We’ll map static indicators into a report you can actually read.
Never executedYour document is only parsed
App uploads removedExternal tools may retain artifacts
Bounded inspectionOffice, MSI, ZIP, and JSON analysis
U
Your uploads
Remembered in this browser only. These reports stay unlisted unless you publish them; one report is kept per file hash.
| File | Risk | Findings | Analyzed | Submissions |
|---|
R
Testing mode · all reports listedListed reports, newest firstRecent reports
| Detection | File | Confidence | Main finding | Comments |
|---|
No public reports yet. A signed-in report owner can list a report from its Community tab.
DOC
SHA-256
Macro modules0
Auto-exec triggers0
Suspicious items0
Indicators (IOCs)0
Services0
01
Findings
No security-sensitive patterns were found.
| Severity | Type | Keyword | What it means |
|---|
PV
Document preview
02
Extracted modules
No VBA or XLM modules were extracted.
TC
ThreatCheck · AMSI
Flagged-byte context
The excerpt shows up to 256 bytes immediately before ThreatCheck’s flagged-end offset. It is context, not proof that every displayed byte is malicious.
03
ZIP entries
| Entry | Size | Type | Static indicators | Status |
|---|
Why it was detected
What could cause this signature to trigger
Microsoft Defender scan
| Scanned item | Source | Size | SHA-256 | Defender |
|---|
Why it triggered
The risk comes from the content inside the installer, not the MSI wrapper. Each item below is a contained file or action with the reasons a scanner would be suspicious. This is a static explanation, not a Defender verdict.
03
Preliminary checks
Quick triage from oletools (oleid): file format, macros, external relationships and embedded objects. Nothing was opened or executed.
04
External references & URLs
No external references or URLs were found.
| Type | Target | Found in |
|---|
05
Document parts
Packaged parts or OLE streams inside the document. Macro projects, embedded objects and ActiveX controls are highlighted.
| Part | Size | Kind |
|---|
03
Package identity & checks
Product
Package signature
PrevalenceNot checkedLocal analysis only. No hash was sent to a reputation service.
Package signing and installed-file signing are separate checks. File-level signatures and SHA-256 hashes require extracting payload bytes; they are not inferred from the MSI database.
04
Packaged files
Names, sizes, and probable destinations come from MSI tables. Runtime properties and transforms can change the final paths.
| File | Size | Probable destination | File signature |
|---|
05
Registry changes
No registry rows declared.
| Hive | Key | Name | Value |
|---|
06
Embedded streams & media
Binary-table streams are extracted and inspected with the contained files below (section 07); external media is listed only.
07
Contained-file inspection
| Archive entry | Size | Type | Static indicators | Status | Evidence |
|---|
Community
Sign in on WhyDetected and hand off an MSI to join the discussion.
Static analysis: