Drop any file here to analyze
PDF, email attachment, boarding pass, image, calendar invite, shortcut file, audio file
PDF · EML · ICS · PKPass · LNK · JPG · PNG · GIF · SVG · ICO · BMP · WEBP · WAV · MP3
Analysis Results
LOW
Detection Modules
PDF Structure
Scans the internal object tree of a PDF for dangerous actions — JavaScript that auto-executes on open, Launch commands, embedded hidden files, and external URL references used as tracking pixels.
Why it matters: A PDF can silently phone home the moment it is opened — leaking your IP address, operating system, and location to an attacker's server before you read a single word.
PDF
Image Steganography Indicators
Checks for data appended after the image's end-of-file marker, analyzes pixel bit distribution for LSB anomalies, scores Shannon entropy, and inspects EXIF metadata for suspicious URLs. These are heuristic indicators — a flag for closer review, not confirmation. The module does not decode or extract a hidden payload.
Why it matters: A normal-looking logo or banner image inside a PDF or email can be used to conceal data. An unusually even LSB distribution or high entropy can suggest steganography — though many ordinary images also trip these signals, so the finding warrants review rather than confirming a payload.
JPG · PNG · GIF · BMP · WEBP · ICO
Appended Audio Data
Reads the WAV RIFF header to find data appended after the declared audio stream ends, and flags unusually high-entropy trailers in MP3 files. This is appended-data detection, not in-sample steganography — the technique documented in the TeamPCP/Telnyx supply chain attack, where a payload was carried past the end of a WAV file.
Why it matters: WAV files have been used in real attacks to carry encrypted malware. A music file or voicemail attachment can be a delivery vehicle — documented in the TeamPCP supply chain campaign.
WAV · MP3
QR Code Analysis
Extracts and decodes all QR codes and barcodes — including PDF417 on boarding passes and Frame QR codes with embedded logos. Scores the decoded URL for typosquatting, homoglyph substitution, URL shorteners, and suspicious TLDs.
Why it matters: A boarding pass QR that looks identical to the legitimate version can point to a credential harvesting page. The attack is invisible until you scan — and by then it may be too late.
All image types · PDF · EML
Calendar & Meeting
Parses .ics calendar files for malicious URLs in LOCATION, DESCRIPTION, and ATTACH fields. Detects meeting platform spoofing — Zoom links that don't resolve to zoom.us, Teams invites pointing to attacker-controlled OAuth pages.
Why it matters: Calendar invites bypass most email security filters. Outlook and Google Calendar auto-add them — the malicious link appears in your calendar even if the email was quarantined.
ICS · EML
Shortcut File Analysis
Parses Windows shortcut (.lnk) files for suspicious command execution patterns — PowerShell, CMD, and living-off-the-land binaries (LOLBINs) like forfiles.exe that attackers use to execute payloads while evading detection. Detects UNC network paths, double extensions, and suspicious target directories.
Why it matters: Malicious LNK files are a primary delivery mechanism in phishing campaigns. They appear as innocent shortcuts but silently execute attacker commands the moment a user double-clicks — commonly delivered via calendar invites and email attachments.
LNK
URL Analysis
Analyzes every URL extracted from documents, calendar files, and email — checking for typosquatting, homoglyph substitution, suspicious TLDs, URL shorteners, raw IP addresses, and excessive subdomains used to spoof trusted domains.
Why it matters: A URL that looks legitimate at a glance can differ by a single character from the real domain. Automated analysis catches what the human eye misses — before anyone clicks.
All formats
Email Analysis
Parses raw .eml files for malicious attachments, suspicious sender domains, tracking pixels, and embedded URLs. Combines attachment scanning with header analysis to detect phishing delivery patterns.
Why it matters: Email is the primary delivery vector for every attack type Ladon detects. Analyzing the raw email file before opening any attachment or clicking any link is the first line of defense.
EML
Polyglot Detection
Checks every file's actual magic bytes against its declared extension. Scans for secondary file signatures embedded inside the primary file — a JPEG that is also a valid ZIP, a PNG that contains a Windows executable.
Why it matters: Security tools identify files by extension or the first few bytes. A polyglot file exploits this — passing as a safe image while carrying a malicious payload that malware on the endpoint extracts and executes.
All formats
Example Attack Scenarios
Travel Document
Boarding Pass QR Substitution
A modified e-ticket PDF with a malicious QR code replacing the legitimate boarding pass barcode. Destination: credential harvesting page mimicking the airline.
PDF
PDF JavaScript Tracking Pixel
An invoice PDF with an embedded invisible 1×1 image that phones home when opened — leaking the recipient's IP address, OS, and exact open timestamp to the attacker.
Calendar Invite
Malicious ICS Meeting Link
A fake Zoom meeting invite with the Join Meeting button pointing to an OAuth consent page. If approved, the attacker gains persistent access to Microsoft 365 — surviving a password reset.
Image Steganography
LSB Payload in Email Attachment
A company logo PNG in an email signature with an encrypted payload encoded in the least significant bits of each pixel. Undetectable by eye — statistically anomalous under analysis.
Appended Audio Data
WAV File Malware Carrier
A WAV audio attachment with malware appended after the audio data end marker. The audio plays normally — the payload is extracted by a companion dropper already on the system.
Polyglot File
JPEG / ZIP Polyglot
A file that passes image validation and renders as a photo in any viewer — but is also a valid ZIP archive containing a malicious executable extracted by malware on the endpoint.
Shortcut File
Malicious LNK Delivery
A Windows shortcut disguised as a calendar invite attachment. Double-clicking executes a hidden PowerShell command that fetches and runs a remote payload — the user sees nothing.
URL Analysis
Typosquatted C2 Domain
A PDF with embedded URLs pointing to attacker-controlled infrastructure on Chinese cloud storage — URLs designed to look legitimate at a glance but flagged by typosquat and TLD analysis.
Email
Phishing Email with Payload
A raw email file containing a malicious attachment and tracking pixel. The sender domain is a typosquat of a known vendor — designed to pass a quick visual check.