Attachments are a classic way to deliver malware, especially when they arrive unexpectedly. Before opening any file you weren't expecting, verify with the sender through a separate channel that they actually sent it.
“Didn't expect the file? Don't open the file.”