Analyzing Malicious LNK Files

When to Use

• You have a .lnk delivered via phishing (often in an archive or ISO) and need its real action.
• You must recover the target command line, arguments, and any embedded/hidden payload.
• You are extracting IOCs (commands, URLs, file paths) from a shortcut.

Do not use Windows Explorer to inspect or double-click the shortcut — that executes its target. Parse the binary structure statically.

Prerequisites

• An LNK parser (Python struct, or lnkparse/LECmd); the sample handled inertly.

Safety & Handling

• Never double-click or hover-load the shortcut in Explorer; parse raw bytes only.
• Defang recovered URLs and store any embedded payload password-protected.

Workflow

Step 1: Confirm and parse the header

Verify the LNK magic (4C 00 00 00 + the link CLSID) and read LinkFlags to know which optional structures are present.

python scripts/analyst.py parse sample.lnk

Step 2: Recover the target and arguments

Extract the relative/local path and, crucially, the COMMAND_LINE_ARGUMENTS string — malicious LNKs hide powershell -enc ... or cmd /c ... here.

Step 3: Inspect icon and metadata

Read the icon location (often spoofed to look like a document) and metadata (machine ID, timestamps) useful for attribution/clustering.

Step 4: Find appended/embedded payloads

Check for data appended after the LNK structure (some campaigns embed scripts/binaries past the parsed end) and extract it.

Step 5: Decode and extract IOCs

Decode encoded commands (UTF-16LE base64), defang URLs, and route extracted payloads to the right analysis workflow.

Validation

• The full command line, including arguments, is recovered (not just the target path).
• Encoded commands are decoded to cleartext.
• Appended/embedded payloads are detected and extracted, and IOCs are defanged.

Pitfalls

• Reading only the target path and missing the malicious arguments.
• Inspecting in Explorer and executing the shortcut.
• Ignoring data appended past the LNK structure.

References

• See references/api-reference.md for the LNK parser.
• MS-SHLLINK and the liblnk format notes (linked in frontmatter).