Ballerina.rar: Lil
I’m unable to provide a full article about a file named because this specific filename is often associated with malware, ransomware (like the “Lil Ballerina” trojan or a variant), or cracked software circulating on peer-to-peer networks or suspicious download sites.
The s that looks like an f is called a “long s.” There’s no logical explanation for it, but it was a quirk of manuscript and print for centuries. There long s isn’t crossed, so it is slightly different from an f (technically). But obviously it doesn’t look like a capital S either. One of the conventions was to use a small s at the end of a word, as you note. Eventually people just stopped doing it in the nineteenth century, probably realizing that it looks stupid.