I would think most anti-virus programs nowadays examine files for the bit where they are simply renamed to avoid triggers. They will search for assorted executable code. After all, some email scams actually say “download this, rename it to that, then open it…”
My AV actually flags stuff downloaded from elsewhere and makes me specifically enable it - particularly Office files that could have embedded executable coe.