[mothered]

yes it is but only tests it in a VM.

A VM Is certainly the safest option.

In fact, any controlled environment Isolated from the Host physical system Is good practice to execute and analyze files.

yes I agree it is very good practice to do it in a controlled environment.

Malware Is known to circumvent virtual machines and the like.

It's best to use a dedicated Host physical machine, with a VM Installed (as the Guest) and segregated from the network.