In SGOS 6.5 you can use the Apparent Data Type information that is sent back in the X-Apparent-Data-Types header in the ICAP response from ProxyAV 3.5 (with Kaspersky and Sophos AV engines only).
If the object being scanned is a ZIP archive, then the header will contain the Apparent Data Type information for the file inside the archive as well as the ZIP archive itself. For example, if the file is a ZIP archive that contains an EXE (but no files within the EXE) the expected response header is:
X-Apparent-Data-Types: EXE, ZIP
However, ProxyAV was returning incorrect string values such as:
X-Apparent-Data-Types: EXEEXE, ZIPEXEEXE, ZIP
Upgrade ProxyAV to 220.127.116.11