.pdf or .docx files that may contain exploits (e.g., Follina) or serve as a distraction while a payload runs in the background. 3. Static & Dynamic Analysis
Does it create a registry key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run or a Scheduled Task?
Is it a Downloader (e.g., GuLoader), an Infostealer (e.g., RedLine), or Ransomware?
List every file found inside the RAR archive. Look for suspicious combinations: .exe , .scr , .vbs , .js , or .pif files.
Malicious shortcuts used to execute hidden PowerShell commands.
Block the identified C2 IPs at the firewall and delete the persistence mechanisms identified in Step 3.
