← All detection heuristics · General
high
POLYGLOT_GIF_PDF_FORCEDENTRY_SHAPE
What it means
File starts with GIF magic but contains a PDF body at a later offset.
Why it fires
Project Zero's FORCEDENTRY analysis documented a fake-GIF routing trick where image processing accepts a GIF-named/headered file while ImageIO/CoreGraphics identifies and parses embedded PDF/JBIG2 content. The detector flags that wrapper shape so the parent object is not treated as a benign GIF.
Other General heuristics
POLYGLOT_PDF_APPENDED_ZIP_CVE_BUNDLE EXTRACTED_FILE_CLAMAV SPEC_DIVERGENCE_HIGH PDF_EXTENSION_MISMATCH POLYGLOT_PDF_ZIP_APPENDED EXTRACTED_FILE_STATIC_TRIAGE CORPUS_HISTORICALLY_MALICIOUS POLYGLOT_TEXT_PDF POLYGLOT_ZIP_PREFIXED FORMAT_NEUTRAL_SCAN PPT_FOPT_COMPLEX_DATA_OVERFLOW PPT_FOPT_PROPERTY_TABLE_TRUNCATED CORPUS_RARE_COMBINATION CORPUS_RARE_STRUCTURAL_FEATURE_SET ANALYSIS_TIMEOUT_PARTIAL EMBEDDED_URL MACRO_VALID_PUBLISHER_SIGNATURE SCAN_OPTIONAL_STAGES_SKIPPED POLYGLOT_PDF_APPENDED_ZIP_SCAN_INCOMPLETE SCAN_INCOMPLETE UNKNOWN_FORMAT