If you're starting to learn malware analysis, static triage is a good place to begin before attempting to execute a suspicious file.

Here's a basic workflow you can practice in a lab:

1. Record the file's hash. Use SHA-256 to identify the sample and check whether it has already been analyzed elsewhere.

2. Inspect the file's metadata. Look at its type, size, timestamps, and other available information. Don't trust a file extension alone.

3. Extract readable strings. Tools like Microsoft Sysinternals Strings can reveal suspicious URLs, file paths, commands, or embedded clues.

4. Decode suspicious data offline. CyberChef is useful for examining Base64, hexadecimal data, and multiple encoding layers without executing the sample.

5. Research indicators carefully. Check known hashes and domains against reputable threat-intelligence sources. Avoid uploading confidential files to public scanning services.

6. Document your findings. Record what you observed, what you decoded, and what remains uncertain. Static analysis alone cannot prove that a file is safe or malicious.

For anyone practicing malware analysis, what tool do you recommend learning first, and what's one beginner mistake that took you a while to understand?