In short, I just received a nice proposal to work on a new contract, the potential customer sent me a "document" with the project specs which turned out to be a password-protected compressed file with some pictures and a ".exe" file inside.

I submitted the executable to virustotal which reports this as a trojan (https://www.virustotal.com/gui/file/088e2dabf218024d30e6899152b6a031dc30ae6f7d516492cb797292d6255d27/detection), seems like this takes screenshots and steals browser data which can be used for other purposes later.

Anyway, be cautious with proposals you receive.