Can ZIP Files Contain Viruses? How to Safely Extract Compressed Files

Can ZIP Files Contain Viruses? How to Safely Extract Compressed Files

Most people open a compressed file the same way they open any other attachment: double-click and move on. That instinct is exactly what attackers rely on. ZIP, RAR, 7z, and TAR archives are not passive containers — they are delivery mechanisms, and the payload can be anything from ransomware to a file that quietly overwrites your system config.

This guide explains what threats live inside archives, why your local antivirus is not always enough, and how using a sandboxed online extractor removes most of the risk before a file ever touches your device.

What Can Hide Inside a ZIP File

An archive is just a container. It can hold anything — and anything includes:

• Executables — .exe, .bat, .cmd, .vbs, .ps1 files that run code the moment you open or double-click them.
• Macro-embedded Office documents — a .docx or .xlsm that runs a macro when opened, downloading a second-stage payload in the background.
• JavaScript payloads — .js files that Windows Script Host will execute directly from the desktop.
• Obfuscated scripts — code deliberately made unreadable so static scanners cannot pattern-match it.
• Double-extension tricks — a file named invoice.pdf.exe shows as invoice.pdf in Windows if file extensions are hidden (the default). The icon is a PDF icon. The file is an executable.

None of these require any vulnerability in your archive software to be dangerous. They only require you to extract and open the file.

How Malware Spreads Through Archives

The archive format itself is a social engineering tool. Common delivery vectors include:

Phishing email attachments — a message claiming to be a shipping notification, invoice, or HR document attaches a ZIP. The ZIP bypasses some email gateways because the malicious executable is not visible until extraction.

Fake software downloads — search results for "free video editor" or "PDF converter crack" frequently link to archives containing the advertised software bundled with a keylogger or cryptominer.

Archive-within-archive nesting — a ZIP inside a ZIP inside a ZIP. Each layer must be extracted manually, which exhausts automated scanners that only inspect one level deep. By the third layer, the payload is invisible to the scanner.

Password-protected archives — an attacker sends a ZIP with a password included in the email body ("password: 1234"). The archive is encrypted, which means no antivirus scanner can inspect its contents. The user decrypts it themselves, defeating the scanner entirely.

Zip Bombs: Tiny Files That Can Crash Your System

A zip bomb is an archive engineered to expand to a catastrophically large size during decompression. The most cited example, 42.zip, is 42 kilobytes on disk. Fully decompressed, it expands to approximately 4.5 petabytes — enough to fill thousands of hard drives and crash or freeze any system that attempts to process it naively.

The technique works by compressing layers of repeated data. Compressed, a sequence of a billion identical bytes takes almost no space. Decompressed, your system tries to allocate memory and write files for all of it simultaneously.

Zip bombs are used in two ways: as a denial-of-service attack against servers that scan uploads, and as a way to crash a victim's machine. A decompressor that does not check the uncompressed size before extracting will simply run until the disk or memory is exhausted.

Path Traversal Attacks

A path traversal attack embeds a malicious filename directly into the archive. Instead of document.txt, a file entry might be named ../../Windows/System32/drivers/etc/hosts or ../../../.bashrc. When a vulnerable extractor writes the file to disk, it follows the path literally — writing outside the intended extraction folder entirely.

In plain terms: the attacker controls where the file lands on your filesystem. They can overwrite system files, replace configuration files, or drop executable files in locations that run automatically on startup. The archive looks like a normal ZIP. The damage happens silently during extraction.

Why Extracting Locally Is Risky

When you extract an archive locally, you expose three layers of your system at once:

1. Your filesystem — path traversal or auto-run scripts can write anywhere your user account has access to.
2. Your antivirus — it only catches what it recognises. Obfuscated, novel, or password-protected payloads routinely bypass local AV.
3. Your decompressor software — unpatched vulnerabilities in WinRAR, 7-Zip, or the built-in Windows extractor have been exploited in the wild. Opening a malformed archive is enough to trigger the vulnerability.

One misplaced double-click on a file inside the archive can run a script before your AV has a chance to quarantine it.

The Sandboxed Approach: Process Files Remotely

When you extract an archive through an online tool, the extraction happens on a remote server — not your device. Your operating system, your filesystem, and your local applications are never touched. If the archive contains a zip bomb, it crashes a container on a server. If it contains an executable, it sits in a temporary directory that is deleted after your download, never running locally.

This is not a workaround — it is the architecturally correct separation between untrusted content and your local environment.

What FileCrank Does to Keep You Safe

FileCrank's extract tool is built with these specific threats in mind:

• Zip bomb detection — the decompressed size is checked before extraction begins. Files that would expand beyond safe limits are rejected immediately, before any data is written.
• Path traversal prevention — every output path is sanitised before a file is written. Directory traversal sequences (../, ..\\) are stripped and normalised, so extracted files always land inside the intended output directory.
• MIME-type validation — file headers (magic bytes) are inspected, not just extensions. A file named photo.jpg that is actually a Windows executable is flagged at the header level.
• Automatic cleanup — uploaded archives and extracted files are deleted from the server after your download completes. Nothing is retained.
• No installation required — nothing runs on your device. No browser extension, no desktop app, no risk of a supply-chain compromise in software you installed.

You can also repack archives to strip unwanted files before sharing, or compress files to create clean, safe archives yourself.

Checklist: Before You Open Any Archive

Run through this before extracting any compressed file you received:

• Did you request this file, or did it arrive unexpectedly?
• Is the sender's identity verified — not just a familiar name, but a verified email domain?
• Does the filename match what you expect? (invoice_march.zip from an unknown sender is a red flag.)
• Does the archive contain executables, scripts, or Office files with macros?
• Is it password-protected and you were sent the password in the same message? (This defeats AV scanning deliberately.)
• Have you inspected the file list before extracting everything?

If any answer gives you pause, use an online extractor to inspect the contents in a sandboxed environment before touching the file locally.

FAQ

Can a ZIP file infect your computer just by downloading it? Downloading alone is not enough — the malicious content must be extracted and executed. However, some browsers auto-extract files, and some vulnerabilities in decompression software can trigger on open. Treat the download as untrusted until you have inspected the contents.

What is a zip bomb and how do I protect against one? A zip bomb is an archive engineered to expand to an enormous size during extraction, consuming disk space or memory until the system crashes. Protection comes from using an extractor that checks uncompressed size before writing any data — which FileCrank does before processing begins.

Is it safe to open a ZIP from an email? Only if you are confident about the sender and the context. Unexpected ZIPs, ZIPs with passwords sent in the same email, and ZIPs containing .exe or .vbs files should be treated as suspicious. Inspect them in a sandboxed online extractor first.

Can antivirus software detect malware inside a ZIP? Most modern AV scanners inspect inside unencrypted archives. However, password-protected archives, deeply nested archives, and novel or obfuscated malware frequently bypass detection. AV is one layer of defence, not a complete solution.

What makes an online extractor safer than local software? The extraction happens on a remote server, so your local filesystem and applications are never exposed. A zip bomb hits the server's sandbox. A path traversal attempt writes to a temporary container. Your machine never sees the raw extracted files.

Quick Safety Checklist

Before extracting any archive, run through these four points:

• Scan before opening. Upload the archive to a sandboxed online extractor or a virus scanner before extracting locally — especially for files from unfamiliar sources.
• Verify the source. Confirm the sender's identity through a separate channel if the file arrived unexpectedly. A familiar name in an email header is not verification.
• Never run executables from a ZIP. If an archive contains .exe, .bat, .vbs, .ps1, or .js files, treat it as suspicious by default. Legitimate software distributions from reputable sources are the only exception, and even then, verify the checksum.
• Use a sandboxed tool. Extracting through an online tool means the archive's contents interact with a remote server, not your local filesystem. Understanding why that separation matters is covered in depth in our guide to how file compression works.