Archive extraction is the process of unpacking files from a container such as a ZIP or 7z archive. It sounds routine, but it is a security-relevant step because the extractor may change more than just file names and paths. Some systems attach trust metadata to downloaded files, such as the Mark of the Web on Windows, and a poor extraction workflow can strip that metadata away.
This matters because archives are a common malware delivery method. If a malicious executable is unpacked without its original internet-origin marker, Windows warnings such as SmartScreen prompts may be less likely to appear, reducing user friction before execution. Defenders should verify that archive tools and shell integrations preserve origin metadata, inspect extracted content, and treat “cleanly unpacked” files as still untrusted until they are checked by policy, reputation, or antivirus controls.