{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.9490752220153809
      }
    ],
    "prob": 0.9490752,
    "models": [
      {
        "m": "az",
        "prob": 0.9490752,
        "class": 0
      },
      {
        "m": "az/lnk",
        "prob": 0.7627119,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-01T01:33:20Z"
  },
  "path": "c326256f531b3a0c00572fd26265015779b0b74653094db04a90eb3e58f53a71.lnk",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 73,
        "ff": {
          "m": {
            "lnk": {
              "file_size": 4306.0
            },
            "file": {
              "size": 2096.0,
              "entropy": 3.4,
              "size_bytes": 2096.0
            },
            "binary": {
              "overall_entropy": 3.4
            }
          },
          "s": [
            [
              124,
              "u8",
              "\\\\178.215.224.179@9652\\DOCUMENTS"
            ],
            [
              157,
              "u8",
              "CustomerWishlist21.bat"
            ],
            [
              845,
              "u8",
              "1SPSsC"
            ],
            [
              1116,
              "u8",
              "\\\\178.215.224.179@9652\\Documents"
            ],
            [
              1149,
              "u8",
              "Web Client Network"
            ],
            [
              1312,
              "u8",
              "\\\\178.215.224.179@9652\\Documents\\CustomerWishlist21.bat"
            ]
          ],
          "v": {
            "file.stem": "c326256f531b3a0c00572fd26265015779b0b74653094db04a90eb3e58f53a71",
            "file.basename": "c326256f531b3a0c00572fd26265015779b0b74653094db04a90eb3e58f53a71.lnk",
            "lnk.blocks[0]": "property_store",
            "lnk.blocks[1]": "vista_idlist",
            "lnk.blocks[2]": "environment_variable",
            "lnk.icon_location": "%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe",
            "lnk.network.share": "\\\\178.215.224.179@9652\\DOCUMENTS",
            "lnk.header.flags[0]": "has_link_info",
            "lnk.header.flags[1]": "has_icon_location",
            "lnk.header.flags[2]": "is_unicode",
            "lnk.header.flags[3]": "has_exp_string",
            "lnk.header.flags[4]": "enable_target_metadata",
            "lnk.header.file_size": 4306,
            "lnk.network.provider": 3014656,
            "lnk.header.icon_index": 11,
            "lnk.header.write_time": 133828031100000000,
            "lnk.environment_target": "\\\\178.215.224.179@9652\\Documents\\CustomerWishlist21.bat",
            "lnk.header.access_time": 133828031100000000,
            "lnk.header.show_command": "normal",
            "lnk.header.creation_time": 133828109320000000,
            "lnk.header.file_attributes[0]": "archive"
          },
          "id": "lnk"
        },
        "id": 0,
        "sz": 2096,
        "ts": [
          {
            "a": "T1187",
            "c": 0.800000011920929,
            "d": "LNK references WebDAV client service name",
            "e": [
              "Web Client Network"
            ],
            "i": "objectives/command-and-control/dropper/lnk/command-content::lnk-webclient-service",
            "l": 4,
            "el": [
              "0x47d"
            ]
          },
          {
            "a": "T1187",
            "c": 0.9200000166893005,
            "d": "LNK WebDAV UNC path with raw IP:port",
            "e": [
              "\\\\178.215.224.179@9652\\"
            ],
            "i": "objectives/command-and-control/dropper/lnk/command-content::lnk-webdav-unc-ip-port",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies scripting artefacts in shortcut (LNK) files.",
            "e": [
              "$",
              ".bat"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/script_in_lnk",
            "l": 4,
            "el": [
              "offset:0x1f2",
              "offset:0xaf"
            ]
          }
        ],
        "sha": "c326256f531b3a0c00572fd26265015779b0b74653094db04a90eb3e58f53a71",
        "path": "c326256f531b3a0c00572fd26265015779b0b74653094db04a90eb3e58f53a71.lnk",
        "type": "lnk"
      }
    ],
    "tv": "961ce"
  }
}