← All detection heuristics · Archive
high
ARCHIVE_DOCUMENT_DOUBLE_EXTENSION_EXECUTABLE
What it means
An archive member uses a document-looking name such as invoice.pdf.exe but is executable code.
Why it fires
Windows often hides the final known extension, so a file ending in .pdf.exe, .doc.scr, or a similar combination can appear to be an ordinary document. The executable is carved for authenticated inspection, scanned with ClamAV, and its embedded network URLs are propagated to the parent archive.
Other Archive heuristics
ARCHIVE_CHILD_MALICIOUS ARCHIVE_MALICIOUS_EXECUTABLE ARCHIVE_AUTOCAD_AUTOLISP_BUNDLE ARCHIVE_JAVA_RESOURCE_EXECUTABLE_LAUNCH ARCHIVE_ENCRYPTED_KNOWN_PASSWORD ARCHIVE_ENCRYPTED_SUSPICIOUS_DELIVERY ARCHIVE_TRUNCATED_EXECUTABLE_MEMBER ARCHIVE_ANDROID_PACKED_DYNAMIC_DEX ARCHIVE_SCAN_INCOMPLETE ARCHIVE_COMPILED_AUTOLISP_CODE ARCHIVE_CORRUPT ARCHIVE_ENCRYPTED ARCHIVE_RECOVERED_MEMBER_IOCS ARCHIVE_PE_ZIP_POLYGLOT ARCHIVE_SIZE_LIMIT ARCHIVE_TRUNCATED_PARTIAL_CONTENTS ARCHIVE_CONTAINS_EXECUTABLE ARCHIVE_ANDROID_RESOURCE_ONLY_SPLIT ARCHIVE_LIMIT ARCHIVE_LARGE_ENTRY