Some things other people missed:
It would be my thought that you are sending a file over the internet. I assume you are not employing key exchange since you did not explicitly state it, in which, your system is doomed. Use proper key exchange and do not send the key in plaintext, I suggest RSA since it is easy to implement in software.
Another answer addressed the possible insecurity of Encrypt & Mac. If you are paranoid, then you Encrypt Then Mac
Keep in mind, the MAC only verifies integrity of the data you are sending, and will not verify authenticity. That is, it will make sure you received the file correctly without errors, and will not make sure you are talking to a man-in-the-middle.
If you are looking for authenticity, the a way to do this is via digital certificate authentication.