Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of interoperability, I would like to know whether there are arguments against this. Has the concept of winmail.dat encapsulation been used by existing malware for their dissemination? Something masquerading as a winmail.dat container, or exploiting regular encapsulation in a winmail.dat? Or is the concept desperately secure/impossible to exploit?

  • I think you are confusing TNEF with the convention used for naming the files. Without some undersanding of the protocols involved, a discussion of the merits or defficiencies of various approaches is moot.
    – symcbean
    Feb 12, 2014 at 14:02
  • @symcbean : as I said, I'm interested in malware exploiting either (naming convention or encapsulation format).
    – Eusebius
    Feb 12, 2014 at 14:45

1 Answer 1


Long answer: According to Microsoft, Winmail.dat is a file that keeps the rich-text formatting readable if sent by Outlook. I have sniffed around a bit and found out that attachments that 'act' like the way Winmail.dat does exist.

Then again, since it's an attachment (and I hope you don't auto-open attachments from emails), you should only open it if you trust the person that send it to you, or have a good anti-virus that can scan your mail too.

Short answer: yes, attachment malware called winmail.dat exists, exploitation of a valid file is possible, because it basically contains theming.

More info on winmail.dat can be found on this website: http://support.microsoft.com/kb/278061

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.