thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Magic Number

A fixed sequence of bytes at the start of a file that identifies its true format regardless of extension.

Definition

Examples include 4D 5A (MZ) for Windows executables, 25 50 44 46 (%PDF) for PDFs, 50 4B 03 04 (PK) for ZIP and Office Open XML files, and 7F 45 4C 46 for ELF. Analysts check magic numbers to detect files with misleading extensions.

Example

An "invoice.pdf" whose first bytes are 4D 5A is actually a Windows executable.

Exam tip

File signature analysis exposes extension spoofing.

Related terms