Safe and Dangerous Bid File Formats. In Other Words, How Not to Get Hacked in a Foolish Way.
Imagine receiving an email requesting a quote. Nothing unusual—a regular message, like the many that come in each week. The content is brief, but there’s a .zip file attached. Nothing strange about that either—people sometimes compress documents, especially when they want to send several files at once or reduce the attachment size.
Upon unpacking, a surprise: instead of a PDF or an Excel file, there’s a file with the .js extension inside.
This is where a red flag should go up.
For clarity — .js is not a document that can be opened in Word or previewed in a file browser. It is a JavaScript script, meaning a piece of code that can run on a computer and do something you may not want. In short: it is not an offer, but a potential threat.
A cold shiver? Rightly so.
That’s why this is a good time to remind ourselves which file formats are safe and which should raise our suspicion. The more people are aware of such traps, the less likely it is that something will catch us off guard at the worst possible moment.
There are, of course, many more files such as .js. .exe files are also particularly dangerous—they are executable files that launch a program. In most cases, clicking on such an attachment is asking for trouble.
In this article, I’ll show you which offer file formats are safe and which should raise concerns. You’ll also learn how to distinguish a regular offer from a potential attack vector, and what to do if you have even the slightest doubt.
This text will be useful not only when you receive offers, but also in the case of any other attachments sent by email.
Table of contents
-
Not sure about an extension? Google it, or ask Grok or ChatGPT
-
⚠️ Spoofed extensions (the last dot counts), most common examples:
-
✅ Safe graphic formats (for visualizations of offers, projects, and graphic materials):
-
⚠️ Compressed graphic files (e.g., .zip files containing .jpg, .obj, etc.)
In what format should the offer be submitted?
Most often, offers come in PDF format. This is currently the standard—the document looks the same for everyone, cannot be accidentally edited, and is also clear, aesthetically pleasing, and professional.
Sometimes someone sends a DOCX (that is, a Word document) if they want the recipient to be able to fill something in. Occasionally, there is also an XLSX file when the quote is in the form of a spreadsheet. I have also received offers in plain TXT format—then you know that someone is working quickly and taking shortcuts, but their intentions are generally honest.
You need to be especially careful with such files — .js, .exe, .bat, .vbs, .jar and similar formats are not intended for sending offers or business documents. They are typically technical or executable formats that can run code on your computer. In short: if you see them in an attachment, stop and don’t open them without thinking. An offer should not come in the form of a program.
Not sure about an extension? Google it, ask Grok or ChatGPT.
Let’s be honest — you won’t remember all file extensions. And even this article doesn’t cover everything you might receive as an attachment. There are countless files and formats, and some of them may look completely harmless, even though in reality they can be dangerous.
If you receive a file with a strange extension and have no idea what format it is — don’t guess blindly and absolutely do not open it. Simply type the extension into Google (e.g., “what is a .js file”) or ask ChatGPT or Grok about it. You’ll get an answer in a few seconds and avoid a potential threat. It’s a really simple habit: before you click, make sure you know what you’re dealing with. Sometimes it’s the difference between a peaceful workday and several hours spent battling a virus.
Pay attention to the sender’s email/account
What should you do when you receive an offer in a suspicious format? First, look at the sender. If it’s someone you know, remain vigilant, as someone may be impersonating them. Carefully check the email address (to make sure there are no typos), and preferably find another, independent way to contact that person—don’t click “reply” and don’t trust the contact details in a suspicious email or on a suspicious website.
If the sender is new, verify that the company actually exists, that the email comes from an official domain, and that the message makes sense. If anything raises doubts — do not open the attachment until you have cleared up all suspicions.
This is only a brief summary—the entire verification process is described in more detail later in the article.
Request a quote in a different format
If you have even the slightest doubt about the attachment, the simplest solution is to ask for the offer to be sent in a format you consider safe—for example, PDF. This is a completely natural and professional request. You can write directly: “For security reasons, I do not open compressed files or scripts—please send the offer in PDF format.”
It is also good practice to ask for a brief summary of the offer in the body of the email. This way, even without opening the attachment, you can assess whether the inquiry appears credible and whether it is worth pursuing. A serious sender will have no problem with such a request—and you gain an additional level of security.
Safe and Unsafe File Formats
✅ Safe and Common File Formats for Listings:
Format | Description |
.pdf | The most commonly used format for sending quotations, contracts, and documents. Difficult to edit accidentally, it preserves formatting. |
.doc / .docx | Word documents – may contain offers, contracts, and forms. Require caution when opening from unknown sources (macros). |
.odt | Open text document format (e.g., LibreOffice). Less commonly used, but safe. |
.txt | Plain text – used mainly for notes or simple queries. It contains no formatting. |
.xls / .xlsx | Sometimes used for quotations or summaries, e.g. in the form of calculation tables. Be cautious with macros. |
.rtf | Text format – less popular, but generally safe. |
.csv | Tabular data format, often used in tenders or data imports. |
.html / .htm | Used rarely – e.g. for generated online offers. Caution is required – it may contain scripts. |
Although PDF and HTML files are considered relatively safe, they can also pose a threat—especially if they come from an unknown source.
📄 PDFs may contain embedded scripts, links leading to fake websites, or forms designed to steal data. Sometimes, opening such a file may even initiate an attempt to download malware, especially in older or outdated PDF readers.
🌐 HTML is a file that the browser interprets as a web page. It may contain hidden scripts that automatically redirect you to a fake website, ask for your login details, or simulate a banking form.
What are macros?
Macros are small programs embedded in Word or Excel documents (most often in files
.doc
,
.docm
,"""
.xls
,"""
.xlsm
), which automate various tasks—but can also execute malicious code. In practice, this means that an innocuous document may download and run malicious software when opened.
How to protect yourself? The simplest way: do not open documents with macros if you do not have 100% confidence in the sender. Word and Excel usually warn you when a file attempts to run a macro — do not click “Enable Content” if you do not know exactly what it does.
A macro is a saved set of commands that automates tasks in Word or Excel—for example, creating a report, copying data, or formatting a table. It runs in the background using the simple VBA language. It makes work easier, but because it performs actions automatically, it is worth knowing where it came from and exactly what it does before running it.
⚠️ Compressed formats (e.g. .zip, .rar):
Format | Rating | Comments |
.zip | ⚠️ Caution | A popular compression format. Safe only if you know the sender. The compressed file may hide malicious content (.exe, .js, .vbs). |
.rar / .7z | ⚠️ Caution | Less common formats. Just like .zip – it depends on what’s inside. Some of them may require a password (which can also be suspicious). |
Important: Before opening a .zip/.rar file, check what it contains. If it contains, for example, .js, .exe, .bat files, or other scripts/programs, do not open them, especially if you do not know the sender.
❌ Suspicious or inappropriate formats (for listings):
Format | Why not? |
.js / .vbs / .bat / .exe | Executable or script files – may contain malicious code. |
.dll / .msi / .scr | Technical system files or installers – they have nothing to do with offers. |
.iso / .img | Disk images – a strange way to transfer documents. |
.apk / .jar | Mobile or Java application files – not a format for listings. |
⚠️ Impersonating extensions (the last dot matters): the most common examples:
Malicious files are often created in such a way as to appear safe—for example, as text documents, PDFs, or spreadsheets. This is done by manipulating the file name and extension to deceive the recipient.
[file name] + [fake “safe” extension] + [actual malicious extension]
In Windows, file extensions may be hidden, so the user sees only “oferta.pdf” instead of the actual “oferta.pdf.exe”. This is a very common phishing technique.
False Name | Actual Extension | What It Is |
oferta.txt.js
``` | **.js** | Skrypt JavaScript – może być uruchomiony przez przeglądarkę lub system. |
umowa.pdf.exe
zamowienie.doc.vbs
lista.txt.bat
raport.rtf.scr
## Graphic File Formats
### ✅ **Safe graphic formats (for visualizations of offers, projects, and graphic materials):**
Format | Description |
**.jpg / .jpeg** | Popular raster image format – photographs, visualizations, scans. Safe, provided it has not been tampered with. |
**.png** | Lossless format with transparency – often used for graphics, logos, and offer elements. |
**.gif** | Format for simple animations or graphics. Rather rarely used in offers, but technically safe. |
**.bmp / .tiff** | Less common, but still safe. Large files, generally used in print. |
**.svg** | Vector format – often used for logos or diagrams. It may contain embedded scripts, so it is advisable to open it only from trusted sources. |
**.pdf (with graphics)** | Often used for graphic presentations of proposals – e.g. layouts, concepts, boards. Safe, but caution is advised if it contains interactive elements or embedded scripts. |
✅ **3D formats (used in CAD projects, visualizations, and product models):**
Format | Description |
**.stl** | A popular format for 3D models, e.g. for printing – purely geometric, without scripts. |
**.obj / .fbx / .3ds** | 3D model exchange formats – safe provided they come from a reliable source. |
**.dae (Collada)** | Open 3D format – like others, it may contain animations and textures. |
**.dwg / .dxf** | CAD format (AutoCAD) – used in technical projects. Common in the construction and architecture industries. |
**.blend (Blender)** | Blender project file – may contain scenes, models, and animations. Large, but not a threat in itself. |
---
### ⚠️ **Compressed graphic files (e.g., .zip files containing .jpg, .obj, etc.)**
Graphic and 3D files are **often packaged** because they contain many elements (e.g., models + textures + scenes). In such a case:
- **Check the archive contents before opening it.**
- Trust only senders you know.
- Avoid archives containing .exe, .js, or .bat files—even if they “accompany” images.
---
### ❌ **Inappropriate or suspicious graphic formats:**
Format | Notes |
**.cpl / .scr / .pif** | They often masquerade as images (e.g.
oferta.jpg.scr
). These are executable files! |
**.js / .vbs** | Sometimes disguised as image files. |
**.exe as a “model viewer”** | If someone sends you a “special program to view the model” — **do not open it**. It could be malware. |
## Sender Email Verification
What should you do when you receive an offer in a suspicious [format](https://en.wikipedia.org/wiki/Filename_extension)? This is where it is worth pausing for a moment and not acting automatically. While the file itself may raise suspicions, the **way you verify the sender** often tells us much more than the attachment’s extension.
### When You Know the Sender but Something Doesn’t Add Up
This may be the most deceptive situation. The email looks like it’s from a client you’ve worked with before. The address appears correct at first glance. But something is off—the tone of the message is different, there’s no signature, and there’s a strange file attached.
In such a case, **check the email address carefully**. Sometimes just one letter makes a difference, e.g.
@firma.com
vs
@flrma.com
, only to turn out that it was not the same person.
If you have any doubts:
- **write to this person at the address you have previously saved** (e.g. from earlier emails or contacts), rather than clicking “reply”,
- **call them** if you have their phone number – sometimes one conversation saves a lot of trouble,
- **do not open the attachment** until you are sure that the email really comes from that person.
Remember: impersonating well-known individuals is one of the most common ways of stealing data and infecting computers.
### When a message comes from a new person or company
In such a situation, verification can be even more difficult because you have no point of reference. But that is precisely when it is worth adopting the principle of limited trust.
What to pay attention to?
- **Is the message written correctly from a linguistic standpoint?** Automatic translations or strange wording are often red flags.
- **Did the sender provide their contact details, company name, and website?** If not, that is a major drawback.
- **Can you verify that the company actually exists?** Simply search for its name and check the details in the National Court Register (KRS) or on its website.
- **Does the email address domain match the company’s website domain?** If someone signs off as a representative of “Kowalski Sp. z o.o.” but sends an email from an @gmail.com address, that is at least suspicious.
And once again: **do not open the attachment until you have verified the sender’s credibility**.
## Safe Attachments – Summary:
If someone sends you a “packaged” offer containing a **.js** file, this is **not the standard way** of submitting requests for quotations—it is **probably an attempt at fraud or malware**.
**Recommended:**
- Search online to find out how a given extension works, or ask [ChatGPT or Grok](/blog/porownanie-narzedzi-ai-do-glebokiego-researchu-chatgpt-deep-search-gemini-grok-i-perplexity)
- Open only those files that make sense in the given context. An offer should be a PDF, not a program.
- Pay attention to whether the file size is appropriate for what the file is supposed to be.
- Request that the offer be resent in PDF or DOCX format.
- Do not open executable files or scripts.
- If you have any doubts, scan the file using a service such as [VirusTotal](https://www.virustotal.com).
Any of us can receive a suspicious email. Sometimes it looks completely innocent, but inside there may be something that can cause a lot of problems. Fortunately, a little attentiveness and knowledge of common file formats are enough to quickly recognize whether we are dealing with a genuine offer or a trap.
Remember: **a good offer doesn’t need to hide in the script**.
If you found this post useful, send it to someone who also sometimes receives an “offer in the attachment.” And if you have a story of your own involving a strange file that made you uneasy, get in touch with us. We’d be happy to hear about your experiences.
Because the more we talk about it, the harder it will be for anyone to surprise us.
Useful links:
[https://niebezpiecznik.pl/post/uwaga-na-e-maile-z-kancelarii-prawnych/](https://niebezpiecznik.pl/post/uwaga-na-e-maile-z-kancelarii-prawnych/)