{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2,
        "threshold": 1.0
      }
    ],
    "prob": 1.0,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/lnk",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 1.0,
    "analyzed_at": "2026-05-31T10:13:38Z"
  },
  "path": "bd3bd605dfdc2cfef45c7481752fb643fbcc06ec80e2d479551fff7ade7f050b.lnk",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 64,
        "ff": {
          "m": {
            "lnk": {
              "file_size": 5600.0
            },
            "file": {
              "size": 1130.0,
              "entropy": 4.28,
              "size_bytes": 1130.0
            }
          },
          "s": [
            [
              211,
              "u8",
              "parcel-label_receipt.vbs"
            ],
            [
              381,
              "u8",
              "p-label"
            ],
            [
              389,
              "u8",
              "D:\\FAQ\\parcel-label_receipt.vbs"
            ],
            [
              582,
              "u8",
              "ec2amaz-ibj3u23"
            ]
          ],
          "v": {
            "file.stem": "bd3bd605dfdc2cfef45c7481752fb643fbcc06ec80e2d479551fff7ade7f050b",
            "file.basename": "bd3bd605dfdc2cfef45c7481752fb643fbcc06ec80e2d479551fff7ade7f050b.lnk",
            "lnk.blocks[0]": "tracker",
            "lnk.blocks[1]": "property_store",
            "lnk.target_path": "D:\\FAQ\\parcel-label_receipt.vbs",
            "lnk.volume.name": "p-label",
            "lnk.icon_location": "%SystemRoot%\\System32\\SHELL32.dll",
            "lnk.relative_path": ".\\FAQ\\parcel-label_receipt.vbs",
            "lnk.volume.serial": 4233600748,
            "lnk.header.flags[0]": "has_link_target_id_list",
            "lnk.header.flags[1]": "has_link_info",
            "lnk.header.flags[2]": "has_relative_path",
            "lnk.header.flags[3]": "has_working_dir",
            "lnk.header.flags[4]": "has_icon_location",
            "lnk.header.flags[5]": "is_unicode",
            "lnk.header.flags[6]": "enable_target_metadata",
            "lnk.header.file_size": 5600,
            "lnk.header.icon_index": 97,
            "lnk.header.write_time": 133564679534053304,
            "lnk.volume.drive_type": "fixed",
            "lnk.working_directory": "D:\\FAQ",
            "lnk.header.access_time": 133564753760936439,
            "lnk.tracker.file_droid": "6cd0a65f-eed1-11ee-ba59-0a36b809510f",
            "lnk.tracker.machine_id": "ec2amaz-ibj3u23",
            "lnk.header.show_command": "normal",
            "lnk.tracker.mac_address": "0a:36:b8:09:51:0f",
            "lnk.header.creation_time": 133564753760936439,
            "lnk.tracker.volume_droid": "00000000-0000-0000-0000-000000000000",
            "lnk.header.file_attributes[0]": "archive"
          },
          "id": "lnk"
        },
        "id": 0,
        "sz": 1130,
        "ts": [
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "LNK working directory is System32",
            "e": [
              "25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52 00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/conhost-curl::working-directory-system32",
            "l": 1,
            "el": [
              "0x1f4"
            ]
          },
          {
            "a": "T1204.002",
            "c": 0.699999988079071,
            "d": "LNK uses shell32.dll icon lure (likely photo/folder)",
            "e": [
              "%SystemRoot%\\System32\\SHELL32.dll"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::lnk-icon-lure-shell32",
            "l": 4,
            "el": [
              "value:lnk.icon_location"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies scripting artefacts in shortcut (LNK) files.",
            "e": [
              "$",
              ".vb"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/script_in_lnk",
            "l": 4,
            "el": [
              "offset:0x377",
              "offset:0xe7"
            ]
          }
        ],
        "sha": "bd3bd605dfdc2cfef45c7481752fb643fbcc06ec80e2d479551fff7ade7f050b",
        "path": "bd3bd605dfdc2cfef45c7481752fb643fbcc06ec80e2d479551fff7ade7f050b.lnk",
        "type": "lnk"
      }
    ],
    "tv": "52045"
  }
}