A Word, Excel or PowerPoint file is a ZIP package of parts. Some of them can run code (a VBA macro project, ActiveX controls, Excel 4.0 macro sheets, program-launching links), and some load things from elsewhere (a template on the web, a linked workbook on a network share, a picture fetched from an address). This scanner lists what a file contains, where each item sits and what it means, before you open it.
It is a structural inspection. It does not run or decompile macros, open embedded objects or follow links, and it is not an antivirus: it cannot judge what a macro does, and a file with no findings is not thereby harmless. The file is read in your browser and is not uploaded.
Loading the tool…
Overview
About Office Embedded Object & Macro Risk Scanner
What it checks (Open Packaging Conventions and the Office formats, ECMA-376 / ISO/IEC 29500):
- Macros and code: a VBA project (
vbaProject.bin) with the module names and automatic-start procedure names it can read in plain text (AutoOpen, Document_Open, Workbook_Open ...); macro-enabled file types; a file named .docx, .xlsx or .pptx that nevertheless contains macros; ActiveX controls; Excel 4.0 (XLM) macro sheets and Auto_Open names; formulas such as EXEC and CALL; PowerPoint actions that run a program or a macro; custom ribbons that call code; Office add-ins (web extensions). - Embedded objects: OLE objects and "Package" objects, with file names that look like programs or scripts; embedded Office documents, which are scanned one level down; any program or script file inside the package.
- External references: a template loaded from a web address or network share (remote template injection), linked OLE objects, workbook links and DDE links, data connections and web queries, pictures and media fetched from outside, links that open files or special-scheme addresses, DDE and INCLUDETEXT fields, automatic field updates, mail-merge sources.
- Package integrity: parts that are not well-formed XML are reported, and XML that declares entities is refused instead of expanded.
Output. Every finding has a severity (high, medium or information), the package part where it sits, details and a plain explanation of why it matters. The overall line is "components that can run code or load content were found", "some components are worth a look" or "no flagged components were found". The last never means the file is safe.
Different from the metadata tool. The Office Document Inspector & Metadata Remover lists authors, comments and hidden sheets and refuses macro-enabled files; this scanner is built for those files and looks at code and outside references instead.
Read more. The guide Office macros, embedded objects and links explained describes each component this scanner looks for.
Compatibility
Supported Formats
OOXML packages: .docx, .docm, .dotx, .dotm, .xlsx, .xlsm, .xltx, .xltm, .pptx, .pptm, .ppsx and .potx up to 100 MB. Not supported: the old binary formats (.doc, .xls, .ppt, which are not ZIP packages), password-protected files (an encrypted package cannot be read), OpenDocument files and PDFs (see the PDF Active Content Scanner).
Guide
How to Use Office Embedded Object & Macro Risk Scanner
- Drop a .docx, .xlsx, .pptx, .docm, .xlsm or .pptm file onto the box. Nothing is run or opened.
- Read the overall line and the counts, then the findings, starting with those marked high.
- For each finding read where it sits and why it matters; decide whether you expected it from the sender.
- If something is unexpected, do not open the file in Office; ask the sender or your IT team, or open it only in a protected environment.
Highlights
Features
- Macros and ActiveX VBA projects with module and auto-start names, XLM macro sheets, ActiveX controls and program-launching actions.
- Embedded objects OLE and Package objects, embedded files and embedded Office documents, scanned one level down.
- External references Remote templates, linked objects and workbooks, DDE fields, data connections, remote pictures.
- Severity and explanation Each finding has a part, a severity and a plain-language reason.
- Never executes anything Read as data in your browser; no macro, object or link is run, opened or followed.
Applications
Use Cases
- Looking at an attachment before opening it in Word or Excel
- Checking that a template or report contains no macros before sharing it
- Finding links to other workbooks, network shares or web addresses
- Seeing which embedded files hide inside a presentation
- Explaining to colleagues why a file triggers a security warning
Good to Know
Limitations
This is a structural inspection of the package, not an antivirus scan. It does not decompile or run VBA, so it cannot say what a macro does; automatic-start names are found only where they appear in plain text in the project. It does not follow links, open embedded objects beyond Office documents inside Office documents, or test for exploits in the Office programs, in fonts, in images or in a particular version of a viewer.
A file with no findings can still be harmful, and a file with findings, such as a workbook with data connections, is often legitimate. The tool never states that a file is safe, harmless or free of malware, and gives no security guarantee.
This tool runs entirely in your browser — your file is never uploaded to our servers. See our Privacy Policy for full details.
Support
Frequently Asked Questions
Is this an antivirus?
No. It lists structural components that can run code or load outside content. It cannot judge what a macro does and gives no verdict on whether a file is harmful.
Is my file uploaded or opened?
It is read in your browser and not uploaded. Nothing in it is run: macros are not executed, objects are not opened and links are not followed.
What is remote template injection?
A Word document can name a template that Word loads when the file opens. If the template sits on a web server or network share, whatever it contains, including macros, is fetched from there. The scanner reports such a reference as high severity.
The file has no macros. Can it still be a problem?
Components other than VBA can run code or load content: ActiveX, Excel 4.0 macro sheets, DDE fields, program-launching links and remote templates. The scanner looks for these too.
Why does a normal Excel file list data connections or links?
Finance and reporting workbooks often use them legitimately. They are reported because they pull data from elsewhere and can ask to refresh; read where they point.
How is this different from the Office Document Inspector & Metadata Remover?
That tool lists and removes names, comments, tracked changes and hidden sheets in macro-free files. This one is about code and outside references and handles macro-enabled files without changing them.
Keep Going
Related Tools
- Office Document Inspector & Metadata Remover Remove metadata from Word, Excel and PowerPoint files: see author names, comments, tracked-change authors, hidden sheets and speaker notes first, then clean a copy. In your browser.
- PDF Active Content Scanner Check a PDF for JavaScript, OpenAction, launch and submit actions, embedded files, XFA and automatic triggers, with plain-language explanations. A structural inspection, not an antivirus. In your browser.
- Excel Print Layout Preflight Checker Check an Excel workbook before printing or exporting to PDF: print area, paper size, scaling, page breaks, repeated headers, hidden rows and sheets and page count. PASS, WARNING or FAIL. In your browser.
- CSV Formula Injection Scanner & Cleaner Find CSV cells that a spreadsheet could read as formulas (starting with = + - @ or a tab), see row, column and reason, and download a cleaned copy. A defensive utility. In your browser.
- Send-Safe Document Checker Before you send a confidential PDF, Word, Excel or PowerPoint file: one overview of hidden information such as metadata, comments, tracked changes, hidden sheets, notes, attachments, scripts and macros, and which tool to use next. In your browser.