Office Macros, Embedded Objects and Outside Links Explained

A .docx, .xlsx or .pptx file looks like one document, but it is a ZIP package of many parts joined by relationships (the Open Packaging Conventions of ECMA-376 and ISO/IEC 29500). Most parts are text, styles and pictures. A few can do more: run code, start another program, or fetch content from somewhere else. Knowing which, helps you decide whether to open a file, and what a file you send might reveal or carry.

Things in a package that can run code

• VBA macros. Stored in a part called vbaProject.bin. Office stores macros only in macro-enabled formats (.docm, .xlsm, .pptm), which is why a file with a plain .docx name and macros inside is suspicious. Macros can start automatically through procedures named AutoOpen, Document_Open or Workbook_Open, once the user enables content.
• Excel 4.0 (XLM) macros. An older macro language kept alive in macro sheets; it needs no VBA project, which is why checks that look only for VBA can miss it.
• ActiveX controls. Windows components embedded in a document.
• DDE and fields. Word fields such as DDEAUTO, INCLUDETEXT and MACROBUTTON can ask Office to run a command, pull in a file or call a macro.
• PowerPoint actions that run a program or a macro when a shape is clicked or hovered over.

Things that load content from elsewhere

• Remote templates. A Word document can name a template, and Word loads it on opening. If it is on the web or a network share, whatever it holds, including macros, comes from there.
• Linked objects, workbook links and data connections. Excel can pull values from another file or query a database or web page, and offer to refresh them.
• Remote pictures and media. A picture fetched from an address tells that server that the document was opened, and from where.
• Network-share addresses. A link or picture that points at a server share can make Windows contact that server, which is why such addresses are treated with caution.

Embedded objects

An OLE object is another program's data stored inside the document. A "Package" object can hold any file, including a script or a program, and open it when the icon is double-clicked. Whole Office documents can be embedded in each other, so a clean-looking presentation can contain a macro-enabled workbook.

What a structural check can say

The Office Embedded Object & Macro Risk Scanner reads the package as data and lists these components, where they sit and why they matter, with a severity. It does not run macros, open objects or follow links, and it cannot say what a macro does. It is not an antivirus: a file with no findings is not thereby harmless, and a workbook with data connections is often entirely legitimate. For the content of a file such as names, comments and hidden sheets, use the Office Document Inspector & Metadata Remover, and read the guide to hidden metadata in Office files.

Before you open or send a file

• If the sender did not announce macros or links, treat their presence as a reason to ask.
• Keep Office's default of blocking macros from the internet and do not click "Enable content" unless you know why it is needed.
• Before sending a file out, run the Send-Safe Document Checker: it gathers metadata, comments, tracked changes, hidden sheets, notes, attachments, scripts and macros in one list and names the tool to use for each.
• For PDFs the equivalents are scripts, launch actions and attachments; see the guide on OpenAction and JavaScript in PDFs.