Use a tool like 7z l pill01.7z (list command) to view internal file names without extracting them. Look for: .exe , .dll , .vbs , or .ps1 files.
Files with double extensions (e.g., invoice.pdf.exe ) or hidden attributes. pill01.7z
A small archive that extracts into a massive file (a "decompression bomb"). 3. Dynamic Analysis (Sandbox) Use a tool like 7z l pill01