Is this email attachment safe to open? How to check before you click
Most email-based malware still arrives the same way it did years ago: an attachment that looks routine, opened without a second thought. Knowing which file types can actually run code, and which can't, removes most of the guesswork.
The one distinction that matters most
A file can either contain data (a document, image or PDF for a program to display) or contain a program (something the computer runs). Programs can do anything a virus needs to do. Plain data files generally can't, on their own, though a few document formats support scripts that blur this line, covered further down.
File types that can run code directly
These are extensions Microsoft Outlook blocks automatically as "Level 1" unsafe attachments, because they can execute a program on your computer. If you weren't expecting one of these, don't open it, even if it appears to come from someone you know:
| Type | Common extensions |
|---|---|
| Windows programs and installers | .exe, .msi, .msp, .com, .scr, .pif, .bat, .cmd |
| Scripts | .js, .jse, .vbs, .vbe, .ps1, .py, .wsf |
| Shortcuts and system files | .lnk, .scf, .url, .reg, .inf |
| Disk and archive images that can auto-run content | .iso, .img, .vhd |
| Mobile app installers | .apk (Android), .appx |
This is a shortened version of Outlook's full blocked list, which covers more than 100 extensions. If Outlook has blocked something for you, that's normally correct, and the fix is not to force it through.
The trick to watch for: double extensions
A file named invoice.pdf.exe is a program, not a PDF. Windows can hide the real extension by default, so it may display as just invoice.pdf with a PDF-like icon. If your file names never seem to show an extension, turn extensions on:
File Explorer → View → Show → File name extensions (Windows 11), or View → Options → View tab → uncheck "Hide extensions for known file types" (Windows 10).
Once visible, a file claiming to be a document but ending in .exe, .scr or .js is an immediate red flag.
Files that are usually safe, with one caveat
- Images (.jpg, .png, .gif) — safe to open in essentially all normal cases.
- PDFs — safe in the vast majority of cases. Keep your PDF reader updated, since old versions have occasionally had vulnerabilities.
- Plain text (.txt) — safe.
- Office documents (.docx, .xlsx, .pptx) — generally safe, unless they ask you to "enable macros" or "enable content". That single prompt is how a huge share of document-based malware activates. If a document you weren't expecting asks for that, don't click enable.
- Compressed archives (.zip, .rar) — safe to open, but check what's inside before running anything, since an archive can contain an executable file hiding under an innocent name.
Red flags that matter more than the file type
- You weren't expecting it, especially an invoice, shipping notice, or "signed document" you have no context for.
- Urgency: "overdue invoice attached, pay today."
- A sender you know, but the message doesn't sound like them, or arrives with no message at all. Compromised accounts send exactly this kind of email.
- A password-protected zip file with the password inside the email. This is a known trick specifically used to get malware past automatic email scanners, which can't see inside a locked archive.
If you're not sure
- Don't open it. Reply to the sender through a new message (not "reply") or a different channel, and ask if they meant to send it.
- Check the actual file extension using the steps above.
- If you've already opened something you now regret, disconnect from the internet and run a full scan. See how to scan with Windows Security.
If you already clicked something inside the file
If it asked for a password or personal details, treat it the same as any phishing attempt. See what to do if you clicked a suspicious link.