← All detection heuristics · General
info
SCAN_OPTIONAL_STAGES_SKIPPED
What it means
Core static analysis completed; optional late-stage decoders were skipped after the per-file soft deadline.
Why it fires
Large documents (typically multi-megabyte PDFs) can exhaust the soft per-file budget after the core object/action/stream pass has already finished. Unlike SCAN_INCOMPLETE the file WAS substantively inspected, so the verdict is real and the result is not flagged Error — only optional decoders (legacy/XFA JavaScript, late sub-format walkers, embedded-PDF recursion) did not run. This finding carries no risk weight: it records reduced coverage, not evidence about the file. Treat a clean verdict here as slightly less conclusive than a clean verdict on a fully walked file.
Other General heuristics
POLYGLOT_PDF_APPENDED_ZIP_CVE_BUNDLE EXTRACTED_FILE_CLAMAV POLYGLOT_GIF_PDF_FORCEDENTRY_SHAPE SPEC_DIVERGENCE_HIGH PDF_EXTENSION_MISMATCH POLYGLOT_PDF_ZIP_APPENDED EXTRACTED_FILE_STATIC_TRIAGE CORPUS_HISTORICALLY_MALICIOUS POLYGLOT_TEXT_PDF POLYGLOT_ZIP_PREFIXED FORMAT_NEUTRAL_SCAN PPT_FOPT_COMPLEX_DATA_OVERFLOW PPT_FOPT_PROPERTY_TABLE_TRUNCATED CORPUS_RARE_COMBINATION CORPUS_RARE_STRUCTURAL_FEATURE_SET ANALYSIS_TIMEOUT_PARTIAL EMBEDDED_URL MACRO_VALID_PUBLISHER_SIGNATURE POLYGLOT_PDF_APPENDED_ZIP_SCAN_INCOMPLETE SCAN_INCOMPLETE UNKNOWN_FORMAT