file 5toxica816xzip.work If it returns Zip archive data , it’s a ZIP. If data or empty , it may be corrupted or a decoy. Use clamscan or upload to VirusTotal (if file not sensitive):
Example workflow script:
clamscan --detect-pua=yes 5toxica816xzip.work Use zipinfo or unzip -l : 5toxica816xzip work