Document Security Guide

How to Use DocScan

1. Drag and drop a file onto the scan area, or click to browse
2. DocScan will parse the file and check for dangerous content
3. Review the findings, structure, and details tabs
4. Use the verdict (CLEAN / SUSPICIOUS / DANGEROUS) to decide if the file is safe to open

What Makes Documents Dangerous?

JavaScript in PDFs

PDFs can contain embedded JavaScript that executes when the document is opened. Attackers use this to exploit vulnerabilities in PDF readers, redirect to phishing sites, or download malware. Look for /JS, /JavaScript, and /OpenAction entries.

VBA Macros in Office Files

VBA (Visual Basic for Applications) macros can execute arbitrary code when enabled. Malicious macros are the most common document-based attack vector. They're stored in vbaProject.bin inside the ZIP structure of DOCX/XLSX/PPTX files.

DDE Attacks

DDE (Dynamic Data Exchange) allows Office documents to execute commands without macros. A DDEAUTO field can run cmd.exe or PowerShell when the document is opened. Modern Office versions prompt before executing DDE, but older versions don't.

Template Injection

DOCX files can reference external templates via relationships. An attacker can point a template URL to a malicious .dotm file that contains macros, which are then loaded and executed when the document opens.

ActiveX Controls

ActiveX controls in Office documents can execute native code. They're one of the most dangerous features and are frequently disabled by security policies.

How to Protect Yourself

• Disable macros by default in Office settings
• Disable JavaScript in your PDF reader
• Keep software updated — most exploits target known vulnerabilities
• Use Protected View in Microsoft Office (enabled by default)
• Scan files before opening with tools like DocScan
• Be suspicious of unexpected attachments, even from known contacts

FAQ

Is DocScan safe to use?

Yes. DocScan processes files entirely in your browser. No files are uploaded to any server. The scanning code runs locally using JavaScript.

What file types does DocScan support?

PDF, DOCX, XLSX, and PPTX files.

Can DocScan detect all malware?

No. DocScan detects common document-based threats like JavaScript, VBA macros, DDE, ActiveX, and template injection. It is not a full antivirus and should be used alongside other security tools.

What is DDE in Office documents?

DDE (Dynamic Data Exchange) is a protocol that can be abused to execute commands in Office documents without macros. Attackers use DDEAUTO fields to run malicious commands when a document is opened.