{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/lnk",
        "prob": 0.84,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T03:36:19Z"
  },
  "path": "3dcb70eb8f0362f16fb914bc8ee2413d5bac9b03995cbd17e74ea58bbbf8299a.lnk",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 70,
        "ff": {
          "m": {
            "lnk": {
              "file_size": 25088.0,
              "args_leading_tabs": 0.0,
              "args_leading_spaces": 0.0,
              "args_whitespace_total": 1.0,
              "args_max_whitespace_run": 1.0
            },
            "file": {
              "size": 1787.0,
              "entropy": 3.24,
              "size_bytes": 1787.0
            }
          },
          "s": [
            [
              137,
              "u8",
              "Windows"
            ],
            [
              223,
              "u8",
              "System32"
            ],
            [
              313,
              "u8",
              "regsvr32.exe"
            ],
            [
              448,
              "u8",
              "C:\\Windows\\System32\\regsvr32.exe"
            ],
            [
              863,
              "u8",
              "%USERPROFILE%\\Desktop\\Icon_002\\d.ico"
            ],
            [
              1703,
              "u8",
              "desktop-h45enlm"
            ]
          ],
          "v": {
            "file.stem": "3dcb70eb8f0362f16fb914bc8ee2413d5bac9b03995cbd17e74ea58bbbf8299a",
            "file.basename": "3dcb70eb8f0362f16fb914bc8ee2413d5bac9b03995cbd17e74ea58bbbf8299a.lnk",
            "lnk.arguments": "\"C:\\Users\\HP\\Desktop\\Crypter 0012\\Uc.dll\"",
            "lnk.blocks[0]": "property_store",
            "lnk.blocks[1]": "icon_environment",
            "lnk.blocks[2]": "special_folder",
            "lnk.blocks[3]": "known_folder",
            "lnk.blocks[4]": "tracker",
            "lnk.target_path": "C:\\Windows\\System32\\regsvr32.exe",
            "lnk.icon_location": "C:\\Users\\HP\\Desktop\\Icon_002\\d.ico",
            "lnk.relative_path": "..\\..\\..\\..\\Windows\\System32\\regsvr32.exe",
            "lnk.volume.serial": 749981317,
            "lnk.header.flags[0]": "has_link_target_id_list",
            "lnk.header.flags[1]": "has_link_info",
            "lnk.header.flags[2]": "has_relative_path",
            "lnk.header.flags[3]": "has_working_dir",
            "lnk.header.flags[4]": "has_arguments",
            "lnk.header.flags[5]": "has_icon_location",
            "lnk.header.flags[6]": "is_unicode",
            "lnk.header.flags[7]": "has_exp_icon",
            "lnk.header.flags[8]": "enable_target_metadata",
            "lnk.known_folder_id": "1ac14e77-02e7-4e5d-b744-2eb1ae5198b7",
            "lnk.header.file_size": 25088,
            "lnk.header.write_time": 132201833860070344,
            "lnk.special_folder_id": 37,
            "lnk.volume.drive_type": "fixed",
            "lnk.working_directory": "C:\\Users\\HP\\Desktop\\Crypter 0012",
            "lnk.header.access_time": 133335915481432639,
            "lnk.tracker.file_droid": "4c7ccf50-11f9-11ee-ab23-c4d9873a69a1",
            "lnk.tracker.machine_id": "desktop-h45enlm",
            "lnk.header.show_command": "normal",
            "lnk.tracker.mac_address": "c4:d9:87:3a:69:a1",
            "lnk.header.creation_time": 132201833860070344,
            "lnk.tracker.volume_droid": "88ea6b82-ad2a-4faf-9cdc-d62c6e9fbda6",
            "lnk.icon_environment_target": "%USERPROFILE%\\Desktop\\Icon_002\\d.ico",
            "lnk.header.file_attributes[0]": "archive"
          },
          "id": "lnk"
        },
        "id": 0,
        "sz": 1787,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "LNK contains UTF-16 parent traversal",
            "e": [
              "2E 00 2E 00 5C 00 2E 00 2E 00 5C 00"
            ],
            "i": "micro-behaviors/fs/traversal/parent::lnk-utf16-relative-parent-chain",
            "l": 1,
            "el": [
              "0x1e4"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.8500000238418579,
            "d": "LNK targets regsvr32.exe",
            "e": [
              "C:\\Windows\\System32\\regsvr32.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::regsvr32-target",
            "l": 4,
            "el": [
              "value:lnk.target_path"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "LNK has command-line arguments",
            "e": [
              "\"C:\\Users\\HP\\Desktop\\Crypter 0012\\Uc.dll\""
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::has-arguments",
            "l": 1,
            "el": [
              "value:lnk.arguments"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies execution artefacts in shortcut (LNK) files.",
            "e": [
              "regsvr32.exe",
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/execution_in_lnk",
            "l": 4,
            "el": [
              "offset:0x139",
              "offset:0x175"
            ]
          }
        ],
        "sha": "3dcb70eb8f0362f16fb914bc8ee2413d5bac9b03995cbd17e74ea58bbbf8299a",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-07/3dcb70eb8f0362f16fb914bc8ee2413d5bac9b03995cbd17e74ea58bbbf8299a.lnk",
        "type": "lnk"
      }
    ],
    "tv": "52045"
  }
}