As most email services, including Office and Gmail, block "executable" attachments, malware distributors will send them in password-protected archives and include the password in the email.