SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-malicious-lnk-files
0
Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure for the target command, arguments, icon, and working directory, and recovering hidden PowerShell/cmd payloads and embedded content used in phishing. Activates for requests to analyze a malicious LNK, parse a shortcut file, or extract a command from a .lnk.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Malicious LNK Files ## When to Use - You have a `.lnk` delivered via phishing (often in an archive or ISO) and need its real action. - You must recover the target command line, arguments, and any embedded/hidden payload. - You are extracting IOCs (commands, URLs, file paths) from a shortcut. **Do not use** Windows Explorer to inspect or double-click the shortcut — that executes its target. Parse the binary structure statically. ## Prerequisites - An LNK parser (Python `struct`, or `lnkparse`/`LECmd`); the sample handled inertly. ## Safety & Handling - Never double-click or hover-load the shortcut in Explorer; parse raw bytes only. - Defang recovered URLs and store any embedded payload password-protected. ## Workflow ### Step 1: Confirm and parse the header Verify the LNK magic (`4C 00 00 00` + the link CLSID) and read `LinkFlags` to know which optional structures are present. ```bash python scripts/analyst.py parse sample.lnk ``` ### Step 2: Recover the target and arguments Extract the relative/local path and, crucially, the `COMMAND_LINE_ARGUMENTS` string — malicious LNKs hide `powershell -enc ...` or `cmd /c ...` here. ### Step 3: Inspect icon and metadata Read the icon location (often spoofed to look like a document) and metadata (machine ID, timestamps) useful for attribution/clustering. ### Step 4: Find appended/embedded payloads Check for data appended after the LNK structure (some campaigns embed scripts/binaries past the parsed end) and extract it. ### Step 5: Decode and extract IOCs Decode encoded commands (UTF-16LE base64), defang URLs, and route extracted payloads to the right analysis workflow. ## Validation - The full command line, including arguments, is recovered (not just the target path). - Encoded commands are decoded to cleartext. - Appended/embedded payloads are detected and extracted, and IOCs are defanged. ## Pitfalls - Reading only the target path and missing the malicious arguments. - Inspecting in Explorer and executing the shortcut. - Ignoring data appended past the LNK structure. ## References - See [`references/api-reference.md`](references/api-reference.md) for the LNK parser. - MS-SHLLINK and the liblnk format notes (linked in frontmatter).