The Acorn application guide

Document Threat Lab

The test invoice is a constructed DOCX with one external hyperlink and no VBA macro. Inspect the package paths and extracted strings without running the document. Ordinary XML namespace strings are not threats simply because they match a rule.

Constructed test example

Inspect a document’s package without opening it in Office

Example input

A valid constructed DOCX package with an external hyperlink and no VBA macros.

Result or controls shown

Static package information, source hash and extracted indicator strings for the demonstrated DOCX.

Static examination of an invented DOCX invoice identifies its OpenXML container, one external hyperlink and no VBA macros. The source hash and package paths remain visible; the document was not opened in Office.

Enlarge the screenshot to read the source records.

Examination steps

Steps to review in your evaluation

Identify the document and inspect its package structure.
Review links, available macro indicators and extracted strings beside their source paths.
Separate ordinary document components from findings that require further examination.

Related application guides

Start with your requirements

Request an application demo

Tell us the source type and task you want to examine. We can plan a demo using suitable training material. Do not send confidential evidence.