Assign a severity rating (Critical, High, Medium, Low) based on potential impact. 2. Static Analysis (The "Outside" Look)

If you must open the file, use a secure sandbox environment like Any.Run or Hybrid Analysis to observe its behavior in real-time.

Check for embedded URLs, IP addresses, or suspicious commands hidden within the file code using tools like Sysinternals Strings . 3. Dynamic Analysis (The "Inside" Look)

Confirm if the file is "Clean," "Malicious," or "Potentially Unwanted Application (PUA)." Action Steps: Provide clear instructions, such as: Delete the archive immediately. Isolate the affected workstation from the network. Reset credentials if data exfiltration was detected.