Polyglot detect
Check whether a file carries more than one valid format signature, at offset 0 or buried inside, the hallmark of a polyglot file.
Polyglot detect scans a file for every format signature it recognises, at offset 0 and every other position, calling it a polyglot once two or more signatures appear. Two formats sharing one prefix, ZIP and DOCX both starting PK, get listed separately rather than merged. A second signature only proves those bytes exist, not that a program reads the file that way.
Questions
What counts as a polyglot?
Two or more distinct format signatures found anywhere in the file, at offset 0 or buried inside it.
What does it show for a clean file?
How many signatures it found, which is 0 or 1, and the offset-0 signature if one was recognised.
Why do ZIP and DOCX both get listed at the same offset?
Because they share the same PK\x03\x04 signature prefix, so a match at that offset is reported for both formats rather than merged into one.
Does finding two signatures prove malicious intent?
No, it only proves the bytes are present; it says nothing about whether any real program reads the file the second way.
Is there a cap on how many matches are shown?
Yes, up to 200 buried matches are listed, with a count of how many more were not shown.