A MINI-PROJECT
REPORT
ON
POLYGOT FILE DETECTION AND ANALYSIS
TOOL
Submitted in partial fulfillment towards the award of degree in
[Link] in Computer Science and Engineering
SESSION 2022-23
ODD SEMESTER
NITRA TECHNICAL CAMPUS,
GHAZIABAD
(College Code-802)
Affiliated to Dr. A.P.J. Abdul Kalam Technical University, Lucknow)
DEPARTMENT OF COMPUTER SCIENCE AND
ENGINEERING
SUBMITTED BY:
NAME Mohd Anas
ROLLNO.2308020100048
BRANCH/YR CSE 3rd
INDEX
S No. CONTENT PAGE
1 ACKNOWLEDGEMENT
2 CERTIFICATE
3 DECLARATION
4 ABSTRACT
5 CHAPTER’S
The chapters may be broadly divided into 8 parts as
below:
i. Introduction
ii. Literature Survey
iii. Proposed Formulation
iv. Proposed System
v. Implementation
vi. Results and Discussion
vii. Conclusion and Future scope
viii. Refrences
ACKNOWLEDGEMENT
I would like to express my sincere gratitude to my project guide, faculty members, and
the Department of Computer Science and Engineering, NITRA Technical Campus, for
their guidance, encouragement, and support throughout the course of this mini project. I
also thank my friends and family for their constant encouragement and motivation.
Mohd Anas
CERTIFICATE
This is to certify that the mini project report titled “Polyglot File Detection and Analysis
Tool” submitted by Mohd Anas (Roll No: 2308020100048) of [Link] (CSE, 3rd Year)
has been carried out under my supervision and guidance in partial fulfillment of the
requirements for the award of Bachelor of Technology degree.
Signature of Guide Signature of Head
DECLARATION
I hereby declare that the mini project report entitled “Polyglot File Detection and
Analysis Tool” submitted by me to the Department of Computer Science and
Engineering, NITRA Technical Campus, is a bonafide work carried out by me under the
guidance of my project guide. This work has not been submitted to any other institution
for the award of any degree/diploma.
Mohd Anas
Roll No: 2308020100048
ABSTRACT
This project presents a web-based tool for Polyglot File Detection and Analysis using
HTML, CSS, Python, and Flask. Polyglot files are files that can be interpreted as more
than one file type simultaneously, which makes them dangerous in cybersecurity
contexts. The system allows users to create polyglot files, detect multiple embedded file
formats, extract files, scan them with antivirus APIs, and check for phishing links, while
maintaining blockchain-based logs of operations for integrity and transparency.
CHAPTER 1 – INTRODUCTION
Polyglot files are a category of files that can be interpreted as more than one file type
depending on the application parsing them. For example, a file can simultaneously be a
valid PDF and JPEG, leading to potential cybersecurity threats. This project focuses on
developing a system that can create such files for research purposes and detect them
effectively.
The objectives of the project are:
• To create polyglot files from different formats.
• To detect polyglot files and identify their embedded formats.
• To extract embedded files.
• To check files against antivirus databases (VirusTotal).
• To detect phishing links.
• To maintain blockchain-based records of operations.
CHAPTER 2 – LITERATURE SURVEY
Literature survey is an essential part of understanding the problem domain. Cybersecurity
researchers have long identified polyglot files as a threat vector. Attackers use them to
bypass antivirus engines and execute malicious code. Previous research indicates that
many detection tools fail when files embed multiple headers and magic bytes. This
project builds upon these studies by combining multi-format detection with blockchain-
based integrity checks.
Key points from literature:
• Polyglot files often exploit parser confusion.
• Traditional antivirus tools struggle to detect embedded formats.
• Blockchain provides tamper-proof logging useful for digital forensics.
• Flask-based lightweight web apps are suitable for rapid cybersecurity prototyping.
CHAPTER 3 – PROBLEM FORMULATION
Existing file detection mechanisms fail when dealing with polyglot files, as they only
recognize the primary format. This allows attackers to embed malware or phishing data
within harmless-looking files. The challenge is to design a detection mechanism that
scans the entire file for multiple magic bytes and signatures, while also ensuring logs are
tamper-proof.
CHAPTER 4 – PROPOSED SYSTEM
The proposed system has the following modules:
• Create Polyglot – Allows merging multiple files.
The Create Polyglot feature allows users to merge two or more files of different formats
(such as PDF, JPEG, EXE, ZIP, etc.) into a single polyglot file. This feature is important
because polyglot files are commonly used in cybersecurity research to study how
malicious actors can embed multiple file formats in one file to evade detection.
In the system, users can upload multiple files through the web interface. The backend,
built using Python and Flask, processes the uploaded files and concatenates their byte
streams intelligently while preserving key file signatures. For special cases like PDFs, the
system ensures that only one valid %%EOF marker is added at the end, maintaining
compatibility.
Once generated, the polyglot file can be downloaded by the user. This file serves as the
input for further testing in other modules such as detection, extraction, and antivirus
scanning. The feature is valuable for demonstrating the risks of polyglot files while also
providing a controlled way to experiment with them.
• Detect Polyglot – Identifies all embedded formats.
The Detect Polyglot feature is responsible for identifying whether an uploaded file
contains multiple embedded formats. Polyglot files are dangerous because they can
masquerade as harmless documents or images while containing hidden malicious content.
This feature helps in detecting such files by scanning for multiple file signatures and
magic bytes inside the same file.
When a user uploads a file, the system uses the detect_format module to check its binary
structure. The detection process analyzes file headers, footers, and known signatures of
formats like PDF, JPEG, ZIP, APK, and EXE. If more than one valid format is detected,
the system marks the file as a polyglot and lists all the embedded formats found.
The results include details such as the file name, path, SHA-256 hash, detected formats,
primary file type, and a verdict on whether the file is polyglot. Additionally, this
detection record is stored in the Blockchain module to ensure tamper-proof logging. This
feature is essential for demonstrating how attackers use polyglot files and how they can
be identified with proper scanning techniques.
• Extract Files – Extracts the inner files.
Extract Files Feature
The Extract Files feature allows users to separate and retrieve the original components
from a polyglot file. Since polyglot files are created by merging multiple files of different
formats, it becomes essential to extract these embedded parts for analysis and safe
handling.
In this feature, the user uploads a polyglot file, and the backend checks whether the file is
a standard archive (like ZIP) or a custom polyglot. If it is a ZIP file, the system uses
standard extraction methods to unpack the contents. For custom polyglot files, the system
leverages the extract_files module, which scans the file structure and splits it back into its
original formats based on magic bytes and headers.
The extracted files are saved in a dedicated output directory, and the user is notified of
the location. Additionally, extraction events are recorded in the Blockchain module to
maintain an immutable log of all operations. This feature is crucial for digital forensics
and cybersecurity research, as it enables analysts to recover hidden data from suspicious
polyglot files.
• AV Detection – Uses VirusTotal API for antivirus checks.
AV Detection Feature
The AV Detection feature integrates the project with the VirusTotal API to perform
antivirus scanning of uploaded files. This is important because polyglot files often carry
malicious payloads that can bypass traditional security tools. By scanning them with
VirusTotal, the system leverages multiple antivirus engines at once to provide a more
reliable security check.
When a user uploads a file for scanning, the backend first computes its SHA-256 hash to
uniquely identify the file. This hash, along with the file itself, is submitted to VirusTotal
for analysis. The API returns a detailed report showing whether the file is clean or
flagged as malicious by various antivirus vendors.
The results are displayed to the user and include details like detection ratio, flagged
engines, and timestamp. The system also stores the AV scan record in the Blockchain
module, ensuring that all results are securely logged and cannot be tampered with.
This feature demonstrates how external security services can be integrated into a custom
tool, making the project not just a file analyzer but also a proactive defense mechanism
against malware.
• Phishing Detection – Detects phishing links using heuristics.
Phishing Detection Feature
The Phishing Detection feature focuses on identifying potentially malicious or deceptive
URLs that may be used to trick users into revealing sensitive information, such as
passwords or banking details. Phishing attacks are one of the most common cybersecurity
threats, often disguised as legitimate websites.
In this feature, the user provides a URL through the web interface. The backend then
applies heuristic checks using predefined blacklisted keywords like “login”, “verify”,
“update”, “secure”, “banking”, or “paypal”. It also scans for suspicious patterns such as
the presence of “@” symbols or obfuscated domains. If any of these markers are
detected, the system flags the URL as Phishing, otherwise it is labeled Safe.
The detected result, along with the submitted URL and a timestamp, is then stored in the
Blockchain module for tamper-proof logging. This ensures a reliable forensic record of
phishing detection events.
This feature highlights the importance of proactive web security checks and demonstrates
how simple heuristics can help users identify and avoid phishing attempts, reducing the
risk of credential theft or financial fraud.
• Blockchain – Maintains immutable logs of operations
Blockchain Records Feature
The Blockchain Records feature ensures that every operation performed within the
system is securely logged in an immutable chain of records. In cybersecurity, maintaining
tamper-proof logs is essential for digital forensics, auditing, and accountability. This
feature provides transparency and reliability by making it nearly impossible to alter or
delete past records.
Whenever a user performs an action—such as creating a polyglot file, detecting
embedded formats, extracting files, scanning with antivirus, or checking phishing links—
the system generates a record. This record includes details like the filename or URL, hash
value, detection results, verdicts, and a timestamp. Instead of storing these logs in a
traditional database, the system appends them to a custom blockchain, where each block
is cryptographically linked to the previous one.
Users can view the blockchain through a dedicated interface that shows the full chain of
records. This not only helps verify the authenticity of past operations but also builds trust
in the analysis results.
By integrating blockchain, the project goes beyond simple file analysis and provides a
forensic-grade logging mechanism, making the tool more secure, reliable, and innovative.
System Workflow:
1. User uploads files.
2. System creates or detects polyglot.
3. Outputs are logged in blockchain.
4. Users can view results and reports.
CHAPTER 5 – IMPLEMENTATION
The project has been implemented using HTML, CSS, Python, and Flask. The frontend
uses Flask templates for forms and results, while the backend consists of Flask routes
connected to detection and creation modules. Blockchain implementation provides
immutable storage of logs. VirusTotal API is used for antivirus scanning.
The project folder structure includes: [Link], templates (HTML files), static (CSS), and
Python modules for detection, creation, and blockchain.
Implementation details of modules:
• [Link] – Flask application entry point.
• polyglot_create.py – Handles creation of polyglot files.
• detect_format.py – Detects file formats based on magic bytes.
• extract_files.py – Extracts polyglot contents.
• [Link] – Simple blockchain for logging.
• templates/ – Contains frontend HTML files.
• static/css – Contains styling files.
CHAPTER 6 – RESULTS AND DISCUSSION
The project successfully allows creation and detection of polyglot files. The outputs show
the detected formats, primary file type, and whether the uploaded file is a polyglot.
Phishing link detection and antivirus integration enhance the security aspect of the tool.
Blockchain ensures that results are immutable.
Screenshots of the working system are provided below.
CHAPTER 7 – CONCLUSION AND FUTURE SCOPE
This mini project demonstrates a functional system for detecting and analyzing polyglot
files. The system is effective for educational and research purposes, highlighting the risks
associated with such files.
Future enhancements include:
• Support for more file formats (APK, DOCX, XLSX).
• Improved detection engine with AI.
• Integration with sandboxing environments.
• Real-time monitoring for enterprise use.
REFERENCES
1. Security Research Papers on Polyglot Files
2. OWASP Secure File Upload Guidelines
3. Flask Documentation – [Link]
4. VirusTotal API Documentation – [Link]
5. Blockchain in Cybersecurity – IEEE Papers