Drop a document or image

The selected file stays in your browser. This Core build checks real file signatures, SHA-256, filename/type mismatch, PDF active-content markers, Office macro-capable formats, embedded URLs and QR codes when the browser supports local QR decoding.

What never happens

• The document is not uploaded to SOS for this local inspection.
• A heuristic match never deletes or quarantines your file.
• “No warning found” is not presented as proof that a document is safe.

For executable files, use the SOS desktop agent file-intel engine: Magika + YARA-X + capa, with FLOSS available as an optional deeper stage.

Current local coverage

• PDF header and suspicious action markers such as JavaScript, Launch, OpenAction and embedded files
• Office/RTF extensions that can carry macros or active content
• Misleading extensions such as a file named PDF that is actually an executable
• URLs recovered from readable document bytes
• QR decoding through the browser’s local BarcodeDetector when available

OCR and full compressed-PDF object parsing are intentionally not claimed by this Core build unless their dedicated local engines are present.

Found a suspicious link?

SOS can pass only the extracted URL text to Scam Shield so it can be checked with the same URL and impersonation signals.