Checking if the "collection" attempts to add itself to Startup folders or Registry Run keys. 4. Forensic Findings

Checking timestamps or "Created By" properties which can sometimes leak information about the author or the tool used to create the archive.

The archive is inspected without running any of the contained files.

High entropy usually suggests the contents are compressed, encrypted, or packed. 2. Static Analysis