exe

One EXE file of 74 bytes. Executables are the best-known risky download, and nearly every upload blocklist includes them. The file is plain text and not a real program, so a Windows machine will not run it. Use it for the simplest check: does your form refuse .exe and show a useful message? Then try harder cases. Rename it to .txt or .jpg, upload it inside a zip, or use mixed case such as .ExE. If any of these gets through, the blocklist depends on something other than the true file contents.