When to use this
Use this for DOC, DOCX, and other Office files submitted through forms, email, portals, or support flows.
How Verifence evaluates it
File Scanner is designed for untrusted PDF and Microsoft Office documents entering through forms, portals, support queues, or APIs. It combines antivirus and content-disarm signals with document-structure checks and analysis of URLs found inside the file.
Supported documents
PDF, Word, Excel, and PowerPoint files are supported in modern and legacy formats, up to 50 MB per file.
PDF normalization
PDFs are normalized before structural analysis so obfuscation layers are less likely to hide embedded files or links.
Office threat signals
Office documents are checked for macros and VBA behavior, DDE or external references, embedded OLE objects, XML external entities, and unsafe archive content.
Antivirus and CDR
Documents pass through the configured Cloudmersive antivirus and content-disarm pipeline for malware and active-content signals.
Embedded URL analysis
Links extracted from documents are checked for known bad reputation, shortened destinations, punycode, IP-based links, suspicious suffixes, new domains, and brand lookalikes.
Hashes and reporting
Successful scans are recorded with file metadata, hashes, verdicts, reasons, and engine details for later review.
How to do it
- 01 Accept only the supported Word, Excel, and PowerPoint formats and keep the original file out of user-accessible storage while scanning.
- 02 Upload the document in the web app or send it as multipart/form-data to /api/scan.
- 03 Review macro and VBA, DDE and external reference, OLE object, XML external entity, unsafe archive, embedded-link, and antivirus signals.
- 04 Quarantine Warn results for a security-aware reviewer and reject Block results before office software can execute their active content.
- 05 Use the recorded hash, reasons, and engine details when explaining the decision to the submitting user or client.
How to act on the result
The scan found low risk. Continue with normal storage or processing while retaining the verdict for audit.
One or more elevated-risk signals need review. Quarantine the file instead of exposing it directly to users.
High-risk content was found. Known-bad URLs and antivirus detections force a block-level result.
The file was unsupported or could not be processed. Do not treat an error as a clean scan.
Implementation notes
- Each processed file costs 20 credits. Rejected or unprocessed files are refunded by the web scanning flow.
- The web tool accepts up to 20 files in one submission. The API accepts either one uploaded file or one public HTTP/HTTPS file URL, but not both.
- Remote-file scanning blocks private and reserved network destinations, limits redirects, uses a download timeout, and enforces the same 50 MB size ceiling.