Comparison of MOTW (Mark of the Web) propagation support of archiver software for Windows

October 6, 2025 · View on GitHub

English | Japanese

Background

On 3 March 2022, Microsoft announced that the default behavior of Office applications on Windows will be changed to block macros in files from the internet (such as email attachment).

An excerpt from the announcement:

VBA macros are a common way for malicious actors to gain access to deploy malware and ransomware. Therefore, to help improve security in Office, we’re changing the default behavior of Office applications to block macros in files from the internet.

...

This change only affects Office on devices running Windows and only affects the following applications: Access, Excel, PowerPoint, Visio, and Word.

The change will begin rolling out in Version 2203, starting with Current Channel (Preview) in early April 2022. Later, the change will be available in the other update channels, such as Current Channel and Monthly Enterprise Channel.

This is a great improvement of defense against malicious Office document files.

According to the announcement, whether blocking macro or not is determined based on MOTW (Mark of the Web) attribute of the file. Applications such as web browsers and email clients put MOTW on downloaded files and email attachments that come from the internet. MOTW is stored in Zone.Identifier NTFS alternate data stream.

To block macro of malicious Office document files that are extracted from archive files, an archiver software has to propagate MOTW to extracted files when an archive file has MOTW. If archiver software does not propagate MOTW, malicious Office documents in archive files can circumvent blocking.

A question came up: "What archiver software can propagate MOTW to extracted files?" So I tested some archiver software and summarized the result.

Comparison table of MOTW propagation support (as of 4 October 2025)

NameTested versionLicenseMOTW propagationEnabled by defaultNote
"Extract all" built-in function of Windows ExplorerWindows 11 24H2proprietaryYes :heavy_check_mark:Yes :heavy_check_mark:
7-Zip25.01GNU LGPLYes :heavy_check_mark:No :x: *1
BandizipStandard Edition 7.40freewareYes :heavy_check_mark:Yes :heavy_check_mark:Only for specific file extensions *2
CubeICE3.5.1freeware / proprietaryYes :heavy_check_mark:Yes :heavy_check_mark:
Explzh9.87proprietary for commercial useYes :heavy_check_mark:Yes :heavy_check_mark:
NanaZip6.0 Preview 1 (6.0.1461.0)MITYes :heavy_check_mark:Yes :heavy_check_mark:Configurable to propagate for specific file extensions *3
PeaZip10.6.1GNU LGPLYes :heavy_check_mark:Yes :heavy_check_mark:
TC4Shell21.3.0 (trial)proprietaryYes :heavy_check_mark:Yes :heavy_check_mark:
Total Commander11.56 (trial)proprietaryYes :heavy_check_mark:Yes :heavy_check_mark:
WinRAR7.13 (trial)proprietaryYes :heavy_check_mark:Yes :heavy_check_mark:Only for specific file extensions by default *4
WinZip77.0 (trial)proprietaryYes :heavy_check_mark:Yes :heavy_check_mark:
Ashampoo ZIP Free1.0.7freeware (registration required)No :x:
CAM UnZip5.25.4.0proprietary for commercial useNo :x:
Expand-Archive cmdlet of PowerShell7.5.3MITNo :x:
Express Zip11.28proprietary for commercial useNo :x:
File Compact7.02proprietaryNo :x:
IZArc4.6freewareNo :x:Despite the availability of the"Propagate Mark of the Web" option *5
LhaForge2.0.1MITNo :x:
Lhaplus1.74freewareNo :x:
PowerArchiver22.00.11 (trial)proprietaryNo :x:
StuffIt Expander15.0.8freewareNo :x:
tar.exe (bsdtar) of Windows 113.8.1BSD 2-clauseNo :x:
Universal Extractor 22.0.0 RC 3GNU GPLv2No :x:
ZipGenious6.3.2.3116freewareNo :x:
Zipware1.6freewareNo :x:

*1: Though 7-Zip has supported MOTW propagation since version 22.00, it is disabled by default. You can enable it for 7-Zip GUI with the "Propagate Zone Id stream:" option in "Tools" -> "Options" -> "7-Zip" of 7-Zip File Manager.

images/7-zip-setting.png

When you set the option to Yes, 7-Zip propagates MOTW to all extracted files. When you set it to "For Office files", 7-Zip propagates MOTW to files with the following file extensions:

  • .doc .docb .docm .docx .dot .dotm .dotx .wbk .wll .wwl
  • .pot .potm .potx .ppa .ppam .pps .ppsm .ppsx .ppt .pptm .pptx .sldm .sldx
  • .xla .xlam .xlm .xls .xlsb .xlsm .xlsx .xlt .xltm .xltx

You can also enable MOTW propagation by setting the registry HKEY_CURRENT_USER\SOFTWARE\7-Zip\Options\WriteZoneIdExtract DWORD to 1.

For 7-Zip CLI, -snz switch is required to propagate MOTW regardless of the option above.

*2: Accoring to the document of Bandizip, Bandizip propagates MOTW to files with the following file extensions:

  • .exe .com .msi .scr .bat .cmd .pif .bat .lnk
  • .zip .zipx .rar .7z .alz .egg .cab .bh
  • .iso .img .isz .udf .wim .bin .i00
  • .js .jse .vbs .vbe .wsf
  • .url .reg
  • .docx .doc .xls .xlsx .ppt .pptx .wiz

I previously tested Bandizip with a ZIP archive file that contained only text files, and I misunderstood that Bandizip does not propagate MOTW.

*3: NanaZip has enabled MOTW propagation by default since version 6.0 Preview 1, You can configure it with the "Propagate Zone Id stream" option in "Options" -> "Integration" of NanaZip GUI.

images/nanazip-setting.png

When you set it to "For unsafe files", NanaZip propagate MOTW to files with the following file extensions:

  • .doc .dot .wbk
  • .docx .docm .dotx .dotm .docb .wll .wwl
  • .xls .xlt .xlm
  • .xlsx .xlsm .xltx .xltm .xlsb .xla .xlam
  • .ppt .pot .pps .ppa .ppam
  • .pptx .pptm .potx .potm .ppam .ppsx .ppsm .sldx .sldm
  • .bat .cmd .com .exe .hta .js .jse .lnk .msi .pif .ps1 .scr .vbe .vbs .wsf
  • .7z .iso .rar .tar .vhd .vhdx .zip

NanaZip supports system-wide policies with registry. These policies override user settings.

*4: WinRAR 7.0 introduced the "Propagate Mark of the Web" option. You can choose the following values:

  • Never
  • For office files
  • For executable and office files
  • For all files
  • For user defined types

The option is supported only by WinRAR GUI. WinRAR CLI does not propagate MOTW regardless of the option.

images/winrar-setting.png

The default is "For executable and office files" and WinRAR propagates MOTW to files with the following file extensions:

  • .exe .bat .cmd .hta .lnk .msi .pif .ps1 .scr .vbs
  • .doc .docb .docm .docx .dot .dotm .dotx .wbk
  • .ppa .ppam .pot .potm .potx .pps .ppsm .ppsx .ppt .pptm .pptx .sldm .sldx
  • .xls .xlsb .xlsm .xlsx .xlm .xlt .xltm .xltx

When you set the option to "For office files", WinRAR propagates MOTW to files with the following file extensions:

  • .doc .docb .docm .docx .dot .dotm .dotx .wbk
  • .ppa .ppam .pot .potm .potx .pps .ppsm .ppsx .ppt .pptm .pptx .sldm .sldx
  • .xls .xlsb .xlsm .xlsx .xlm .xlt .xltm .xltx

You can specify file extensions when you set the option to "For user defined types".

*5: IZArc version 4.6 introduced the "Propagate Mark of the Web" option, and it is enabled by default. However, it seems that IZArc does not propagate MOTW regardless of the option.

Comparison table of MOTW propagation behavior (as of 4 October 2025)

NameTested versionMOTW propagation behavior
"Extract all" built-in function of Windows ExplorerWindows 11 24H2
  • MOTW is propagated only if ZoneId value of the MOTW is 3 (Internet) or 4 (Untrusted sites)
  • ZoneId field of the archive file is inherited
  • The absolute path of the archive file is set for the ReferrerUrl field
  • All other fields are ignored
  • Extraction of .exe .lnk .vbs files is blocked when the ZoneId value is 4 (Untrusted sites)
7-Zip25.01
  • MOTW of the archive file is propagated without modification
  • Only for specific file extensions if the "Propagate Zone Id stream:" option is set to "For Office files" *1
BandizipStandard Edition 7.40
  • MOTW of the archive file is propagated without modification
  • Only for specific file extensions *2
CubeICE3.5.1
  • MOTW is propagated only if ZoneId value of the MOTW is 3 (Internet) or 4 (Untrusted sites)
  • Only ZoneId field of the archive file is inherited and all other fields are ignored
Explzh9.87
  • MOTW is propagated only if ZoneId value of the MOTW is 3 (Internet)
  • Only ZoneId field of the archive file is inherited and all other fields are ignored
NanaZip6.0 Preview 1 (6.0.1461.0)
  • MOTW of the archive file is propagated without modification
  • Only for specific file extensions if the "Propagate Zone Id stream" option is set to "For unsafe files" *3
PeaZip10.6.1
  • MOTW of the archive file is propagated without modification
TC4Shell21.3.0 (trial)
  • Only ZoneId field of the archive file is inherited and all other fields are ignored
Total Commander11.56 (trial)
  • MOTW of the archive file is propagated except for the ReferrerUrl field
WinRAR7.13 (trial)
  • Only ZoneId field of the archive file is inherited and all other fields are ignored
  • Only for specific file extensions *4
WinZip77.0 (trial)
  • MOTW is propagated only if ZoneId value of the MOTW is 3 (Internet) or 4 (Untrusted sites)
  • ZoneId field of the archive file is inherited
  • The absolute path of the archive file is set for the ReferrerUrl field
  • All other fields are ignored
  • Extraction of .exe .lnk .vbs files is blocked when the ZoneId value is 4 (Untrusted sites)

MOTW propagation examples

In these examples, MOTW was manually set for a ZIP archive file motw-test.zip with Set-MOTW.ps1, then MOTW of an extracted file is displayed with Get-MOTW.ps1. Set-MOTW.ps1 and Get-MOTW.ps1 are available at my PS-MOTW repository.

  • MOTW of a file extracted with Windows Explorer or WinZip (except version 28.0): images/explorer.png

  • MOTW of a file extracted with 7-Zip, Bandizip, NanaZip, or PeaZip: images/bandizip.png

  • MOTW of a file extracted with CubeICE, Explzh, TC4Shell, or WinRAR: images/explzh.png

  • MOTW of a file extracted with Total Commander: images/total-commander.png

FAQ

References

Author

Nobutaka Mantani (@nmantani)