When to use this
Use this before opening, storing, forwarding, or publishing a PDF from an untrusted source.
How Verifence evaluates it
File Scanner is designed for untrusted PDF and Microsoft Office documents entering through forms, portals, support queues, or APIs. It combines antivirus and content-disarm signals with document-structure checks and analysis of URLs found inside the file.
Supported documents
PDF, Word, Excel, and PowerPoint files are supported in modern and legacy formats, up to 50 MB per file.
PDF normalization
PDFs are normalized before structural analysis so obfuscation layers are less likely to hide embedded files or links.
Office threat signals
Office documents are checked for macros and VBA behavior, DDE or external references, embedded OLE objects, XML external entities, and unsafe archive content.
Antivirus and CDR
Documents pass through the configured Cloudmersive antivirus and content-disarm pipeline for malware and active-content signals.
Embedded URL analysis
Links extracted from documents are checked for known bad reputation, shortened destinations, punycode, IP-based links, suspicious suffixes, new domains, and brand lookalikes.
Hashes and reporting
Successful scans are recorded with file metadata, hashes, verdicts, reasons, and engine details for later review.
How to do it
- 01 Keep the PDF in temporary or quarantine storage and upload it to File Scanner before anyone opens or publishes it.
- 02 Use the web app for manual batches or POST one file to /api/scan for an application workflow.
- 03 Review the 0–100 score, OK/Warn/Block rating, SHA-256 hash, embedded-file signals, extracted links, reputation findings, and antivirus result.
- 04 Move OK files into the normal workflow, keep Warn files isolated for manual review, and reject Block files.
- 05 Store the hash and scan decision with the file record so a later review can identify exactly which bytes were evaluated.
How to act on the result
The scan found low risk. Continue with normal storage or processing while retaining the verdict for audit.
One or more elevated-risk signals need review. Quarantine the file instead of exposing it directly to users.
High-risk content was found. Known-bad URLs and antivirus detections force a block-level result.
The file was unsupported or could not be processed. Do not treat an error as a clean scan.
Implementation notes
- Each processed file costs 20 credits. Rejected or unprocessed files are refunded by the web scanning flow.
- The web tool accepts up to 20 files in one submission. The API accepts either one uploaded file or one public HTTP/HTTPS file URL, but not both.
- Remote-file scanning blocks private and reserved network destinations, limits redirects, uses a download timeout, and enforces the same 50 MB size ceiling.