Benign Download

win_sus_InternetShortcutFile.yar

Windows InternetShortcut file

SHA-2566098bf5979089afc9cb592cfe7aa941dd5f8ae985dd45ba2c3da656b1ac008b1

MaleculeO(C)

Evidence

Windows InternetShortcut file lines 3–13

19… n = "Detects suspicious Internet Shortcut Files that are often used to retrieve malware"
      author = "RussianPanda"
      date = "2024-02-17"
6
  strings:
      $s1 = "[InternetShortcut]"
      $s2 = {55 52 4C 3D 66 69 6C 65 3A 2F 2F}
      $a1 = ".exe"
      $a2 = ".dll"
      $a3 = ".js"
      $a4 = " …

English function-word token "and" lines 16–19

10… a7 = ".cmd"
  condition:
      all of ($s*) and any of ($a*)
19}