Common File Extensions That Can Be Risky to Open
Files come in various formats, but some are very risky and commonly used to spread malware. To make it easy for you, here is a list of all popular file extensions and their security rankings. You can easily search for the type of extension you are going to download and check its security.
Before that, check our interactive chart below where we display the top 15 riskiest file extensions. This allows you to skip downloading them or be extra careful when using files with these extension types.
Top 15 Popular Formats
Risk AnalysisCriticalMediumMinimal
.exe
.iso
.js
.zip
.pdf
.docx
.xlsx
.pptx
.html
.csv
.jpg
.mp4
.png
.mp3
.txt
Comprehensive format directory
A detailed breakdown of file extensions, exactly where they open, and their security contexts.
| Extension | Category | Usage Details & Context | Risk Level |
|---|---|---|---|
.exe | Executable | Windows executable program. Very high risk as it can run malicious code directly. Used for / Apps :Windows OS | Critical |
.sys | System File | Windows system driver. Extremely dangerous if replaced by a malicious driver (Rootkit level). Used for / Apps :Windows OS Kernel | Critical |
.scr | Executable | Windows screensaver file. Functions exactly like an .exe and is often used by malware. Used for / Apps :Windows OS | Critical |
.msi | Installer | Windows Installer package. Can execute malicious payloads during installation. Used for / Apps :Windows Installer | Critical |
.ps1 | Script | PowerShell script. Highly capable and often abused by advanced threats. Used for / Apps :Windows PowerShell | High |
.dll | System File | Dynamic Link Library. Contains code executed by other programs; heavily used in malware loading. Used for / Apps :Windows OS | High |
.bat | Script | Batch script used to automate tasks in Windows command prompt. Used for / Apps :Windows Command Prompt | High |
.vbs | Script | Visual Basic Script. Older but still frequently used to drop malware. Used for / Apps :Windows Script Host | High |
.cpl | Executable | Control Panel extension. Functionally similar to a .dll and executed by the system. Used for / Apps :Windows Control Panel | High |
.hta | Application | HTML Application. Runs as a fully trusted application on Windows without browser sandboxing. Used for / Apps :Windows OS | High |
.iso | Disk Image | Contains a complete optical disk image. Attackers use it to bypass "Mark of the Web" protections. Used for / Apps :Windows Explorer, Rufus, Daemon Tools | High |
.docm | Document | Word document with macros enabled. Macros can execute embedded malicious code. Used for / Apps :Microsoft Word | High |
.xlsm | Spreadsheet | Excel spreadsheet with macros. Similar risk to .docm files. Used for / Apps :Microsoft Excel | High |
.wsf | Script | Windows Script File. Can contain multiple scripting languages and bypass some basic filters. Used for / Apps :Windows Script Host | High |
.apk | App Package | Android Package Kit. The primary format for Android malware apps. Used for / Apps :Android OS | High |
.js | Script | JavaScript file. Can execute malicious scripts outside the browser via Windows Script Host. Used for / Apps :Windows Script Host, Node.js | High |
.jar | Executable | Java Archive. Can run cross-platform malware if Java is installed. Used for / Apps :Java Runtime Environment (JRE) | High |
.sh | Script | Shell script for Unix/Linux systems. Used for / Apps :Linux/macOS Terminal | High |
.php | Script | Server-side PHP script. Dangerous if uploaded to poorly configured web servers. Used for / Apps :Web Servers (Apache, Nginx) | Medium |
.zip | Archive | Compressed archive. Risk comes from what is hidden inside, often used to evade scanners. Used for / Apps :WinRAR, 7-Zip, File Explorer | Medium |
.rar | Archive | Alternative compressed archive format, similar risk to ZIP. Used for / Apps :WinRAR, 7-Zip | Medium |
.7z | Archive | 7-Zip archived file. Highly compressed, used to evade detection. Used for / Apps :7-Zip | Medium |
.bz2 | Archive | Bzip2 compressed file. Can conceal malware layers. Used for / Apps :7-Zip, WinRAR | Medium |
.py | Script | Python script file. Used for / Apps :Python IDLE, Terminal | Medium |
.rb | Script | Ruby script file. Used for / Apps :Ruby Interpreter | Medium |
.pkg | Installer | macOS Installer Package. Used for / Apps :macOS Installer | Medium |
.tar | Archive | Uncompressed archive often coupled with GZIP (.tar.gz). Used for / Apps :Archive Utilities, Terminal | Medium |
.gz | Archive | Gnu Zipped archive. Used for / Apps :Archive Utilities, Terminal | Medium |
.dmg | Executable | macOS disk image. Can contain malicious applications for Mac users. Used for / Apps :macOS Finder | Medium |
.deb | Package | Debian software package. Used for / Apps :Debian/Ubuntu Linux | Medium |
.rpm | Package | Red Hat software package. Used for / Apps :Red Hat/CentOS Linux | Medium |
.rtf | Document | Rich Text Format. Historically exploited due to vulnerable parsers in Word/WordPad. Used for / Apps :WordPad, Microsoft Word | Medium |
.pdf | Document | Portable Document Format. Can exploit reader vulnerabilities or carry malicious links. Used for / Apps :Adobe Acrobat, Web Browsers | Medium |
.docx | Document | Word document (no macros). Generally safer, but can exploit parsing vulnerabilities or contain phishing links. Used for / Apps :Microsoft Word, Google Docs | Medium |
.xlsx | Spreadsheet | Excel spreadsheet. Similar risk profile to .docx. Used for / Apps :Microsoft Excel, Google Sheets | Medium |
.pptx | Presentation | PowerPoint presentation. Can contain malicious links or exploit parsing engines. Used for / Apps :Microsoft PowerPoint, Google Slides | Medium |
.sql | Database | SQL database dump. Risk of data exposure rather than direct code execution. Used for / Apps :MySQL, PostgreSQL, SQL Server | Medium |
.html | Web Page | HTML file. Can be used for local phishing pages or redirecting to malicious sites. Used for / Apps :Google Chrome, Edge, Safari | Low-Medium |
.xml | Data | Extensible Markup Language. Used for configuration and data exchange. Safe but parsing vulnerabilities exist. Used for / Apps :Web Browsers, Code Editors | Low |
.svg | Vector Image | Scalable Vector Graphics. Being XML-based, can sometimes host malicious scripts (stored XSS). Used for / Apps :Illustrator, Web Browsers | Low-Medium |
.json | Data | JavaScript Object Notation. Standard format for API payloads and config. Used for / Apps :VS Code, Web Browsers | Low |
.yaml | Data | YAML data file used for configuration (e.g., Docker, Kubernetes). Used for / Apps :Code Editors | Low |
.ini | Config | Initialization config file for older Windows software. Used for / Apps :Notepad, Text Editors | Low |
.csv | Spreadsheet | Plain text data. Very low risk of execution, though "CSV Injection" in Excel is a minor threat. Used for / Apps :Microsoft Excel, Text Editors | Low |
.jpg | Image | Image file. Safe unless exploiting a specific image viewer vulnerability (rare). Used for / Apps :Photos, Photoshop, Web Browsers | Low |
.mp4 | Video | Video file. Generally safe, rarely used for exploits. Used for / Apps :VLC, Windows Media Player, QuickTime | Low |
.avi | Video | Older video container format. Used for / Apps :VLC, Windows Media Player | Low |
.mkv | Video | Matroska video container. Used for / Apps :VLC Media Player | Low |
.mov | Video | Apple QuickTime movie. Used for / Apps :QuickTime Player, VLC | Low |
.png | Image | PNG image file. Similar to JPG, extremely low risk. Used for / Apps :Photos, Web Browsers | Low |
.gif | Image | Animated image format. Low risk. Used for / Apps :Web Browsers, Image Viewers | Low |
.webp | Image | Modern web image format. Used for / Apps :Web Browsers | Low |
.mp3 | Audio | Audio file. Very safe. Used for / Apps :Spotify, iTunes, Music Players | Low |
.wav | Audio | Uncompressed audio. Used for / Apps :Audio Editors, Music Players | Low |
.flac | Audio | Lossless audio. Used for / Apps :VLC Media Player | Low |
.woff2 | Font | Web Open Font Format. Used for / Apps :Web Browsers | Minimal |
.txt | Document | Plain text. Cannot execute code. The safest common file format. Used for / Apps :Notepad, TextEdit, VS Code | Minimal |
.md | Document | Markdown file for documentation. Used for / Apps :Typora, VS Code, GitHub | Minimal |
.css | Stylesheet | Cascading Style Sheets for web design. Used for / Apps :Web Browsers, Code Editors | Minimal |
Was this article helpful?
Comments
0Share your thoughts, questions, or feedback about this guide.