Is it safe to open a ZIP file?
Opening a ZIP to look inside is safe; the archive itself does nothing. The danger is what is inside, and ZIP is the standard wrapper for delivering malware because it hides the real file type from email filters and from you.
How a .ZIP file can do harm
- Any file at all, including executables, scripts and shortcuts, with their real extensions out of sight until extraction
- Password-protected archives, with the password in the email, specifically to stop scanners inspecting the contents
- Path traversal entries (zip slip) that write files outside the folder you extract to, such as into a startup folder
- Zip bombs: tiny archives that expand to petabytes and crash scanners or fill disks
- Nested archives, each layer defeating a scanner that only looks one level deep
What it cannot do
- Execute anything on open; listing or extracting with a current archive tool runs no code
- Hide from a content check: the ZIP signature is unmistakable, and the entries' own bytes reveal what they are
Signs of a suspicious .ZIP file
- An unexpected attachment whose password is in the same message
- A single .exe, .scr, .js, .vbs, .lnk, .hta or .iso inside an archive that claims to be a document
- Entries with names like ../../ or absolute paths when you list the archive
- A tiny archive that claims to hold large files, or extraction that runs far longer than expected
- ISO, IMG or VHD files inside ZIPs, a newer trick for bypassing the Mark of the Web
Before you open it
- List the contents before extracting (right-click, Open in 7-Zip, or unzip -l) and look at the real extensions
- Extract into a fresh, empty folder and never into Program Files, the desktop, or a startup folder
- Keep your archive tool current; path traversal protections are a feature of recent versions
- Do not run anything extracted from an unexpected archive without checking its own type and signature
- Treat a password-protected archive from a stranger as hostile by default
Check that it really is a .ZIP file
The first question for any suspicious file is whether it is what its name says. Drop it on the detector: it reads the bytes in your browser, reports the real type, and computes the SHA-256 you can look up on VirusTotal, all without the file leaving your machine. A common ZIP signature is 50 4B 03 04 (PK..); see the signature reference.