It depends on what they say. If they don't specify, you can do whatever you want, and they'll correct you if it's wrong. However, a lot of places don't want attachments because of the fear they'll get a virus. OR, some workplaces have automatic blocks that'll remove your attachment. Especially true if it's a corporate set-up.

And, yeah, in your e-mail/cover letter, you'd want to mention that you're legal to work there.