analyzing-malicious-lnk-files

Name: analyzing-malicious-lnk-files
Author: meltedinhex

18stars5forks

How to install analyzing-malicious-lnk-files?

meltedinhex/analyst-ai-pack/analyzing-malicious-lnk-files

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-lnk-files

Installs into the current project.

Summary

Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious LNK Files
2
3	## When to Use
4
5	- You have a `.lnk` delivered via phishing (often in an archive or ISO) and need its real action.
6	- You must recover the target command line, arguments, and any embedded/hidden payload.
7	- You are extracting IOCs (commands, URLs, file paths) from a shortcut.
8
9	Do not use Windows Explorer to inspect or double-click the shortcut — that executes its
10	target. Parse the binary structure statically.
11
12	## Prerequisites
13
14	- An LNK parser (Python `struct`, or `lnkparse`/`LECmd`); the sample handled inertly.
15
16	## Safety & Handling
17
18	- Never double-click or hover-load the shortcut in Explorer; parse raw bytes only.
19	- Defang recovered URLs and store any embedded payload password-protected.
20
21	## Workflow
22
23	### Step 1: Confirm and parse the header
24
25	Verify the LNK magic (`4C 00 00 00` + the link CLSID) and read `LinkFlags` to know which optional
26	structures are present.
27
28	```bash
29	python scripts/analyst.py parse sample.lnk
30	```
31
32	### Step 2: Recover the target and arguments
33
34	Extract the relative/local path and, crucially, the `COMMAND_LINE_ARGUMENTS` string — malicious
35	LNKs hide `powershell -enc ...` or `cmd /c ...` here.
36
37	### Step 3: Inspect icon and metadata
38
39	Read the icon location (often spoofed to look like a document) and metadata (machine ID,
40	timestamps) useful for attribution/clustering.
41
42	### Step 4: Find appended/embedded payloads
43
44	Check for data appended after the LNK structure (some campaigns embed scripts/binaries past the
45	parsed end) and extract it.
46
47	### Step 5: Decode and extract IOCs
48
49	Decode encoded commands (UTF-16LE base64), defang URLs, and route extracted payloads to the right
50	analysis workflow.
51
52	## Validation
53
54	- The full command line, including arguments, is recovered (not just the target path).
55	- Encoded commands are decoded to cleartext.
56	- Appended/embedded payloads are detected and extracted, and IOCs are defanged.
57
58	## Pitfalls
59
60	- Reading only the target path and missing the malicious arguments.
61	- Inspecting in Explorer and executing the shortcut.
62	- Ignoring data appended past the LNK structure.
63
64	## References
65
66	- See [`references/api-reference.md`](references/api-reference.md) for the LNK parser.
67	- MS-SHLLINK and the liblnk format notes (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-malicious-lnk-files

18stars5forks

View on GitHub

How to install analyzing-malicious-lnk-files?

meltedinhex/analyst-ai-pack/analyzing-malicious-lnk-files

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-lnk-files

Installs into the current project.

Summary

Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malicious LNK Files
2
3	## When to Use
4
5	- You have a `.lnk` delivered via phishing (often in an archive or ISO) and need its real action.
6	- You must recover the target command line, arguments, and any embedded/hidden payload.
7	- You are extracting IOCs (commands, URLs, file paths) from a shortcut.
8
9	Do not use Windows Explorer to inspect or double-click the shortcut — that executes its
10	target. Parse the binary structure statically.
11
12	## Prerequisites
13
14	- An LNK parser (Python `struct`, or `lnkparse`/`LECmd`); the sample handled inertly.
15
16	## Safety & Handling
17
18	- Never double-click or hover-load the shortcut in Explorer; parse raw bytes only.
19	- Defang recovered URLs and store any embedded payload password-protected.
20
21	## Workflow
22
23	### Step 1: Confirm and parse the header
24
25	Verify the LNK magic (`4C 00 00 00` + the link CLSID) and read `LinkFlags` to know which optional
26	structures are present.
27
28	```bash
29	python scripts/analyst.py parse sample.lnk
30	```
31
32	### Step 2: Recover the target and arguments
33
34	Extract the relative/local path and, crucially, the `COMMAND_LINE_ARGUMENTS` string — malicious
35	LNKs hide `powershell -enc ...` or `cmd /c ...` here.
36
37	### Step 3: Inspect icon and metadata
38
39	Read the icon location (often spoofed to look like a document) and metadata (machine ID,
40	timestamps) useful for attribution/clustering.
41
42	### Step 4: Find appended/embedded payloads
43
44	Check for data appended after the LNK structure (some campaigns embed scripts/binaries past the
45	parsed end) and extract it.
46
47	### Step 5: Decode and extract IOCs
48
49	Decode encoded commands (UTF-16LE base64), defang URLs, and route extracted payloads to the right
50	analysis workflow.
51
52	## Validation
53
54	- The full command line, including arguments, is recovered (not just the target path).
55	- Encoded commands are decoded to cleartext.
56	- Appended/embedded payloads are detected and extracted, and IOCs are defanged.
57
58	## Pitfalls
59
60	- Reading only the target path and missing the malicious arguments.
61	- Inspecting in Explorer and executing the shortcut.
62	- Ignoring data appended past the LNK structure.
63
64	## References
65
66	- See [`references/api-reference.md`](references/api-reference.md) for the LNK parser.
67	- MS-SHLLINK and the liblnk format notes (linked in frontmatter).

People who liked this also viewed

6 picks

Type