Scanning attachments and files

Scan attachments and files

Supported files

Type	What PhishLens checks
PDF	Text and links; scanned pages are read with OCR; QR codes decoded; JavaScript, auto-run actions and forms flagged
Images (PNG, JPEG, GIF, WebP, BMP, TIFF)	Text read with OCR, QR codes decoded
Word, Excel, PowerPoint (new and old formats)	Text and links; macros, remote templates, DDE fields and ActiveX flagged
HTML	Text, links, login forms and password fields
ZIP, RAR, 7z	Every file listed; programs, scripts, shortcuts, disk images and fake extensions (invoice.pdf.exe) flagged; up to 5 documents inside are analysed
Calendar invites (.ics)	Links in the description and location, the organiser
Emails (.eml)	The whole email, with full headers

Files of 10 MB at most. Programs, scripts, shortcuts and disk images are flagged by their type and never opened.

In Gmail

Click Scan N attachments under the attachment strip. Each file gets a card:

• the verdict and the file name;
• the type, size, number of pages or of files inside, number of links;
• chips for what was found (macros, text from OCR, encrypted archive...);
• for archives, Do not open (or Check before opening) with the files that explain the verdict, then Files inside, folded.

In the popup (any file, any mailbox)

1. Click the PhishLens icon in the toolbar.
2. In File, drop a file or click to choose one: an .eml email or an attachment.
3. Click Analyze.

To get an .eml from Gmail: open the email, menu (three dots) then Download message. In Outlook on the web: open the email, then the ... menu and Download (called Save as in some versions).

Password-protected files

PhishLens cannot open them and says so (encrypted archive, encrypted document). A password given in the email body ("the password is 1234") is a classic way to blind mail scanners: be careful with these.