Is an EXE file safe to open?
An .exe is a program. Opening it runs whatever the author wrote with your user's permissions, so the only question that matters is whether you trust where it came from.
How an .EXE file can do harm
- Anything: an executable has no sandbox and can read, encrypt, delete or send your files, install persistence, and download more
- A legitimate program bundled with adware or a second, hidden payload
- A dropper that looks inert, then writes the real malware to disk and runs it
- Code signed with a stolen or fraudulently obtained certificate, which defeats the 'is it signed?' check
What it cannot do
- Run without being executed; downloading it is not the same as opening it
- Escape a properly isolated virtual machine or a sandbox like Windows Sandbox, under normal circumstances
Signs of a suspicious .EXE file
- Double extensions such as invoice.pdf.exe, which Windows shows as invoice.pdf when extensions are hidden
- A document, image or archive icon on a file the detector identifies as a PE executable
- Arrival by email, chat or a download link in a message, rather than from the vendor's site or a store
- A SmartScreen or Gatekeeper warning that the publisher is unknown
- A file name with Unicode right-to-left override characters, so exe appears in the middle of the name
Before you open it
- Download software only from the publisher's own site, the Microsoft Store, or winget
- Show file extensions in Explorer (View, Show, File name extensions) so a disguised .exe is visible
- Check the digital signature: right-click, Properties, Digital Signatures; a missing or untrusted signature is a strong warning
- Scan the SHA-256 on VirusTotal before running; a file nobody has seen before is a reason for more caution, not less
- Run anything doubtful in Windows Sandbox or a throwaway virtual machine first
Check that it really is an .EXE file
The first question for any suspicious file is whether it is what its name says. Drop it on the detector: it reads the bytes in your browser, reports the real type, and computes the SHA-256 you can look up on VirusTotal, all without the file leaving your machine. A common PEBIN signature is 4D 5A (MZ); see the signature reference.