Is this attachment safe? A 60-second check for any file

Most malicious attachments are caught by three questions that take less time than opening the file. The questions, the file types that deserve them most, and the one check that works for everything.

securityhow-toemail

Attachment-borne malware has not changed its strategy in twenty years, because it does not need to. It relies on three things: that you will not look at where the file came from, that you will trust the icon and the extension, and that you will click through one warning. Defeating it means doing the opposite, which takes about a minute. Here is the routine.

Question 1: did I expect this?

Not “does this look plausible” but “was I expecting a file from this sender, about this subject, today”. Attackers are good at plausible. Invoices, delivery notes, voicemail notifications, shared documents, résumés and “please review” requests are plausible by design; that is why they are the standard lures.

If the answer is no, the file does not get opened until you have confirmed it through a channel you already had: a phone number from your contacts, a message in a system you both use, not a reply to the email. A genuine sender will not mind. This question alone defeats most attachment campaigns, because most of them are sent to people who were not expecting anything.

Question 2: what is the file, really?

The name and icon are the attacker’s to choose; the bytes are not. Three quick checks:

Show the real extension. Windows hides extensions by default, so Invoice.pdf.exe appears as Invoice.pdf with whatever icon the executable asks for. In File Explorer, View, Show, File name extensions. Do this once and leave it on.

Look at the extension you now see. Documents (.pdf, .docx, .xlsx), images (.jpg, .png) and plain archives are the normal attachments. The ones that should stop you are the executable and script families: .exe, .msi, .scr, .bat, .cmd, .ps1, .vbs, .js, .jse, .hta, .wsf, and the two that catch people most now, .lnk (a Windows shortcut, which can run any command) and .iso or .img (disk images that bypass download warnings). Also .html and .svg, which are web pages and run script when opened. None of these is a normal thing to receive from a colleague.

Check the bytes. Drop the file on the detector: it reads the content in your browser, without uploading anything, and tells you what the file actually is. A .pdf that is really an executable, an .svg that is really an HTML login page, a .docx that is a ZIP with macros inside: the content shows what the name hides. The detector also computes the file’s SHA-256, which you can paste into VirusTotal to see whether anyone has flagged it, again without sending the file.

Question 3: is it asking me to do something?

A safe document just opens. A malicious one needs your help, and it asks for it in a few recognisable ways:

  • “Enable Content” or “Enable Editing” in Word or Excel. Macros do not run otherwise, so the document has to persuade you. Legitimate documents are readable without it. See the Word safety guide.
  • A password in the same email as a ZIP attachment. The password exists to stop scanners seeing inside. See the ZIP guide.
  • A blurred preview with a button in a PDF or an image, or a page that is mostly “Click here to view”. See the PDF guide.
  • A sign-in form that appears when you open an attachment. Real sign-in pages are at https:// addresses you can read; a login form at a file:// address is a phishing page. See the HTML and SVG guides.
  • A security warning from Windows, macOS or your browser. SmartScreen, Gatekeeper and “this file could harm your computer” exist for exactly this moment. The warning is the answer.

If the file wants a click, a password, or a permission before it will show you anything, the correct number of clicks is zero.

The file types, ranked by how much they deserve the routine

  1. Executables and scripts (.exe, .lnk, .js, .vbs, .hta, .iso): never open from an attachment. There is no legitimate workflow that sends these by email. Guide.
  2. Office documents (.doc, .docm, .xls, .xlsm): the macro carriers. Open in Protected View or a web viewer, never enable content. Guide.
  3. Archives (.zip, .rar, .7z), especially with a password: list the contents before extracting, and apply this whole list to what is inside. Guide.
  4. PDFs: usually fine, but the biggest phishing vehicle by volume. Open in a browser viewer rather than Acrobat, and do not click the button. Guide.
  5. HTML and SVG: web pages in disguise. Open in a text editor if you must, never in a browser. Guides.
  6. Images (.jpg, .png): nearly always safe as images; the risk is a file named like an image that is not one. Guide.

What to do with a file that failed

Do not open it “just to check”. Do not forward it to a colleague to ask what they think. Report it through whatever your organisation uses, or delete it. If you already opened something and then saw a warning, enabled content, or typed a password, change that password from a different device and tell someone whose job it is to know, immediately rather than later; the first hour matters.

The routine, on a card

  1. Expected? No: verify through another channel first.
  2. What is it? Show extensions, check the bytes, look up the hash.
  3. Asking for a click? Then no.

Sixty seconds, and it catches the great majority of what arrives. The full guides for each format are at /safe/.

← All posts