Tool 1.3

Is this file safe? Check an attachment or APK

See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps. Nothing is uploaded.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

An automated check; it doesn't guarantee security.

How to use it

Drop the file you received, or click to choose it: any type, up to 100 MB each, up to 10 at once. Your browser reads it on your device.
Read the result: the file's real type, its size and every warning sign found in it.
If it has warning signs, don't open it. Ask the sender through another channel first.

The files scammers send, and why they work

Many attacks that start with a message need you to open something. In Latin America the usual ones are an Android app sent on WhatsApp as a bank “update”, a PDF “invoice” or “payment receipt”, a ZIP with a password written in the message, a Word or Excel file that asks you to click “Enable content”, and a file called factura.pdf.exe that is really a program.

The check has to happen before you open the file or install the app. It reads the file on your device, without running it: it finds out what the file really is, whatever its name says, and looks inside for the tricks attackers rely on.

Reading the result: an app that says it's your bank's

Say a “bank adviser” sends Actualizacion-TuBanco.apk. The real type is Android app (APK), and the verdict reads “4 warning signs found”. The findings say it's an app sent as a file, that it can read your text messages, that it asks to be an accessibility service, and that it can draw on top of other apps. Under them you see the app's package name and every permission it asks for.

Together, those are the pattern of a banking trojan: it waits for you to open your bank's app, shows a fake login on top of it, reads the code the bank texts you, and approves the transfer itself. A real bank never sends its app as a file.

For a normal PDF, the result says it really is a PDF and lists the domains its links point to (up to 12). Each one opens in Is it a scam?, so you can check it before tapping.

What this check can't see

It is not an antivirus. It doesn't run the file and doesn't compare it with lists of known malware. It looks at how the file is built, so a harmful file with no known trick can pass, and a file with a warning sign may be harmless if you were expecting it.

It can't look inside RAR or 7-Zip archives, files locked with a password, or the encrypted parts of a PDF. And a clean file can still be part of a scam: a real PDF can carry a fake payment receipt or a bank account that isn't the company's. If you're thinking of uploading a file to an online scanner instead, many of those services keep the file and share it with security companies, so don't send them documents with personal data.

FAQ

Can a PDF have a virus?

A PDF can carry things that run or open when you view it: JavaScript, an action that launches another file or program, attached files, a form that sends what you type to a web address, or a link that opens a page by itself. This check looks for each of those. An invoice or a letter doesn't need any of them, so finding one is a reason to ask the sender first.

Can this replace my antivirus?

No. It spots the tricks that attachments use, like a program disguised as a PDF or macros in a document, but it doesn't recognize known malware the way an antivirus does. Keep your phone and computer updated and your antivirus on.

Someone sent me an APK to update my bank app. Is that normal?

No. Banks, stores and government offices publish their apps in the official stores (Google Play, the App Store or the phone maker's store) and don't send them as a file. Delete it and call your bank on the number printed on your card.

What does “Enable content” in Word or Excel do?

It runs the macros inside the document: small programs that can download and install malware. A document someone sends you should never need them, so leave the yellow bar alone.

I already installed the app. What now?

Turn on airplane mode, then uninstall it. If it won't uninstall, remove it first from the device administrator apps in your security settings. From another phone, call your bank to block your accounts, and then change your passwords.

Guides for this tool

G19Package held text scam: how to check a delivery messageA text says your parcel is held and asks for a small fee or your address? How to check it with the courier, read the link, and what to do if you paid.
G21Fake DIAN emails: how to spot them and check what you oweA message says you owe DIAN, face an embargo or your RUT will be suspended? How to check it, see your real tax status, and what to do if you clicked.

1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌