What is the SHS file format?
A .shs file contains a fragment of a Microsoft Word or Excel document in the form of an embedded object, created and used by older Windows systems. The format is built on the OLE2 Compound File Binary container - the same binary structure used by legacy .doc and .xls files - identified by the magic bytes D0 CF 11 E0 at offset 0. The Windows component responsible for reading and writing .shs files is shscrap.dll, the Shell Scrap Object Handler. This handler shipped with Windows 95 through Windows XP before SP2; Microsoft disabled it by default in Windows XP SP2 (2004) and removed it from later releases, making the format effectively obsolete.
.shs files are generated by dragging and dropping a selected fragment of an Office document onto the Desktop or into a folder. The Shell Scrap Object Handler (shscrap) captures the selection and saves it as a scrap object that can later be dragged back into a compatible document. Critically, Windows hid the .shs extension by default regardless of the user's folder settings - unlike most file types, toggling "show file extensions" did not reveal it. A user could not open a .shs file directly; it could only be pasted into an open document. Because .shs is an executable format, it was actively exploited as a malware delivery vector: attackers disguised executables as harmless-looking scrap files whose hidden extensions made detection difficult.
Security & safety
RISK: HIGHSHS is a recognized malware extension. Because Windows always hid the .shs suffix, attackers disguised executables as innocent files (e.g. "report.doc.shs"), and double-clicking ran embedded code - the technique behind the 2000-era Stages / Life Stages worm. Microsoft disabled the format from Windows XP SP2 for this reason. Rule: never double-click or "run" an .shs you received, especially by e-mail. If you must examine one, do it on an isolated VM and only inspect the OLE streams with a forensic viewer (7-Zip / structured-storage viewer) - never execute it.
Format details
in a nutshellPrograms that open SHS files
Windows3 apps
Windows 9x / 2000 / XP pre-SP2 (legacy, in a VM)
Built-in On a legacy system with shscrap.dll registered, double-clicking re-inserts the scrap into its source app - only safe inside an isolated VM with a KNOWN-good file.
7-Zip (inspect only)
Open-source Open the .shs as an OLE compound file to view internal streams WITHOUT executing it - forensic inspection, not normal opening.
SSView / OLE viewer (forensic)
Free Use a structured-storage viewer (e.g. MiTeC Structured Storage Viewer) to browse the OLE streams safely and extract embedded data. Technical details
deep spec| Container format | OLE2 Compound File Binary (CFB) - the same low-level container used by legacy Office formats |
| Magic bytes | D0 CF 11 E0 A1 B1 1A E1 at offset 0 (standard OLE2 CFB signature) |
| Developer | Microsoft |
| MIME type | application/octet-stream |
| Handler component | shscrap.dll - Windows Shell Scrap Object Handler; registered the .shs shell extension in the OS |
| OS support | Windows 95 through Windows XP pre-SP2; disabled by default from XP SP2 (2004), absent from Vista and later |
| Creation method | Drag-and-drop of a selected document fragment onto the Desktop or into an Explorer folder |
| Usage method | Drag-and-drop only back into a compatible Office document; no direct open or double-click action was supported |
| Extension visibility | Forced-hidden by the shell regardless of the user's "show file extensions" folder setting - a behavior unique to .shs |
| Content type | Serialized OLE object embedding a document fragment (text, spreadsheet cells, or other OLE-compatible content) |
| Platform | Windows only; no macOS or Linux support was ever provided |
| Security risk | Executable payload capability combined with forced extension hiding made .shs a documented malware and virus delivery vector |
| Internal structure | Uses OLE2 compound document streams internally; scrap data is stored in named streams within the CFB container |
| Forensic inspection | 7-Zip and OLE viewers such as SSView can open .shs files to inspect internal streams without executing them |
| Released | Windows 95 (1995); shscrap.dll removed/disabled by default from Windows XP SP2 (2004) onward - format effectively dead |
SHS conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about SHS files.
