Attachment Analysis — Detecting Dangerous File Types

The attachment as an entry point

Email remains the primary distribution channel for malware, and the attachment is the most direct vehicle. The attack patterns have barely changed over the years because they keep working: an executable with a harmless name, an Office document with a macro, or an archive that slips past the gateway scanner.

This check does not inspect file contents for malicious code — it is not an antivirus scanner. It evaluates the structural characteristics by which the typical delivery paths can be recognized.

What AnalyzeMy.Email checks

• Dangerous file extensions — executable and scriptable formats such as .exe, .scr, .bat, .cmd, .js, .vbs, .ps1, .hta, .lnk
• Double extensions — the classic invoice.pdf.exe. Windows hides known extensions by default, leaving "invoice.pdf" visible
• Macro-enabled Office files — .docm, .xlsm, .pptm, .dotm and other formats capable of executing embedded macros
• All MIME types of the attachments are recorded and reported

Why these three patterns in particular

• Executables are the most direct route. Most gateways block them by now, which is why attackers wrap them in archives — often password-protected with the password in the message body, so the scanner cannot look inside.
• Double extensions exploit a display setting that has been on by default for over twenty years. Icons can be chosen freely; putting a PDF icon on an .exe is trivial.
• Macros were the main vector for Emotet and its successors for years. Microsoft now blocks macros originating from the internet by default, which devalued the path considerably — but it still works wherever that default has been overridden by policy.

Recommendations

• As a recipient: block executable formats at the gateway as a matter of principle, along with password-protected archives from external sources. Do not disable the mark-of-the-web tagging by policy.
• As a sender: avoid macro-enabled formats in business correspondence. An .xlsm sent to a customer increasingly ends up in quarantine — use .xlsx when macros are not required.
• Large files belong in a linked storage system, not in an attachment. That reduces message size and bypasses attachment filters entirely.
• Attachments in automated mail — invoice PDFs, for instance — should be named cleanly. Cryptic names with several dots trigger unnecessary warnings.