Record the MD5 , SHA-1 , and SHA-256 hashes to uniquely identify the file.
Check for creation dates, original filenames, and any digital signatures. Victoria Bravo.rar
Does it launch a secondary process? (e.g., cmd.exe , powershell.exe ). Record the MD5 , SHA-1 , and SHA-256
Note if it creates "persistence" by adding itself to the Windows Registry startup keys or moving files to C:\Users\...\AppData . 4. Indicators of Compromise (IOCs) Indicators of Compromise (IOCs) List the files inside
List the files inside the RAR. Look for common malicious extensions like .exe , .vbs , .js , or double extensions like .pdf.exe . 3. Dynamic (Behavioral) Analysis
List actionable data that security teams can use to block the threat: Specific domains or IP addresses contacted. Host IOCs: File paths, registry keys, and process names. 5. Remediation & Recommendations Removal: Steps to delete the file and reverse its changes.