reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-malicious-lnk-files/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-malicious-lnk-files	Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure for the target command, arguments, icon, and working directory, and recovering hidden PowerShell/cmd payloads and embedded content used in phishing. Activates for requests to analyze a malicious LNK, parse a shortcut file, or extract a command from a .lnk.	cybersecurity	malware-analysis	malware-analysis lnk shortcut document-malware static-analysis	1.0.0	analyst-ai-pack	Apache-2.0	T1204.002 T1059.001 T1059.003	D3-FCR D3-DA	Microsoft [MS-SHLLINK] Shell Link Binary File Format — https://learn.microsoft.com/openspecs/windows_protocols/ms-shllink/ LNK forensic structure references — https://github.com/libyal/liblnk/blob/main/documentation/Windows%20Shortcut%20File%20(LNK)%20format.asciidoc

Analyzing Malicious LNK Files

When to Use

• You have a .lnk delivered via phishing (often in an archive or ISO) and need its real action.
• You must recover the target command line, arguments, and any embedded/hidden payload.
• You are extracting IOCs (commands, URLs, file paths) from a shortcut.

Do not use Windows Explorer to inspect or double-click the shortcut — that executes its target. Parse the binary structure statically.

Prerequisites

• An LNK parser (Python struct, or lnkparse/LECmd); the sample handled inertly.

Safety & Handling

• Never double-click or hover-load the shortcut in Explorer; parse raw bytes only.
• Defang recovered URLs and store any embedded payload password-protected.

Workflow

Step 1: Confirm and parse the header

Verify the LNK magic (4C 00 00 00 + the link CLSID) and read LinkFlags to know which optional structures are present.

python scripts/analyst.py parse sample.lnk

Step 2: Recover the target and arguments

Extract the relative/local path and, crucially, the COMMAND_LINE_ARGUMENTS string — malicious LNKs hide powershell -enc ... or cmd /c ... here.

Step 3: Inspect icon and metadata

Read the icon location (often spoofed to look like a document) and metadata (machine ID, timestamps) useful for attribution/clustering.

Step 4: Find appended/embedded payloads

Check for data appended after the LNK structure (some campaigns embed scripts/binaries past the parsed end) and extract it.

Step 5: Decode and extract IOCs

Decode encoded commands (UTF-16LE base64), defang URLs, and route extracted payloads to the right analysis workflow.

Validation

• The full command line, including arguments, is recovered (not just the target path).
• Encoded commands are decoded to cleartext.
• Appended/embedded payloads are detected and extracted, and IOCs are defanged.

Pitfalls

• Reading only the target path and missing the malicious arguments.
• Inspecting in Explorer and executing the shortcut.
• Ignoring data appended past the LNK structure.

References

• See references/api-reference.md for the LNK parser.
• MS-SHLLINK and the liblnk format notes (linked in frontmatter).