{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.8985075,
        "class": 0
      },
      {
        "m": "az/lnk",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-18T07:57:38Z"
  },
  "path": "e6b71fb954c15afdeb377e6b65389a8182fc0bb7c14453f19d95e7fa1ab8310d.lnk",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Th",
        "x": 68,
        "id": 0,
        "ms": {
          "lnk": {
            "has_name": true,
            "icon_index": 3.0,
            "target_size": 335872.0,
            "has_exp_icon": true,
            "has_arguments": true,
            "has_link_info": true,
            "has_working_dir": true,
            "has_tracker_data": true,
            "has_icon_location": true,
            "has_relative_path": true,
            "target_attributes": 32.0,
            "args_whitespace_total": 33.0,
            "has_known_folder_data": true,
            "args_max_whitespace_run": 2.0,
            "has_link_target_id_list": true,
            "has_property_store_data": true,
            "has_special_folder_data": true,
            "args_excessive_whitespace": false,
            "has_icon_environment_data": true
          },
          "file": {
            "size": 2876.0
          }
        },
        "ss": [
          [
            0,
            "C:\\Windows\\System32\\cmd.exe"
          ],
          [
            0,
            "Carla Mendes"
          ],
          [
            0,
            "..\\..\\..\\..\\Windows\\System32\\cmd.exe"
          ],
          [
            0,
            "/WHBN:TD7R /WVESFK:8HQKMK /D/C \"for %L in (j) do for %S in (avASCrI) do for %O in (PT) do  for %D in (HTA) do for %E in (Ms) do "
          ],
          [
            0,
            "C:\\Windows\\System32"
          ],
          [
            0,
            "C:\\Windows\\System32\\imageres.dll"
          ],
          [
            0,
            "%SystemRoot%\\System32\\imageres.dll"
          ],
          [
            0,
            "1ac14e77-02e7-4e5d-b744-2eb1ae5198b7"
          ],
          [
            0,
            "win-e9g5ml1eucq"
          ],
          [
            0,
            "00:25:90:e6:96:0d"
          ],
          [
            0,
            "64b19cc4-6c1b-40cb-bf13-ff589b1ea077"
          ],
          [
            0,
            "f8008678-2bf4-11f0-8f30-002590e6960d"
          ],
          [
            137,
            "Windows"
          ],
          [
            313,
            "cmd.exe"
          ],
          [
            439,
            "C:\\Windows\\System32\\cmd.exe"
          ],
          [
            1746,
            "%SystemRoot%\\System32\\imageres.dll"
          ],
          [
            2586,
            "win-e9g5ml1eucq"
          ]
        ],
        "sz": 2876,
        "ts": [
          {
            "a": "T1204.002",
            "c": 0.699999988079071,
            "d": "LNK targets cmd.exe",
            "e": [
              "C:\\Windows\\System32\\cmd.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::cmd-target",
            "l": 4
          },
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "LNK runs minimized without activation",
            "e": [
              "7"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::minimized-window",
            "l": 4
          },
          {
            "a": "T1204.002",
            "c": 0.8999999761581421,
            "d": "LNK has command-line arguments",
            "e": [
              "lnk.has_arguments = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::has-arguments",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "LNK working directory is System32",
            "e": [
              "25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52 00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/conhost-curl::working-directory-system32",
            "l": 1
          },
          {
            "a": "T1564.003",
            "c": 0.699999988079071,
            "d": "LNK contains cmd.exe target string",
            "e": [
              "cmd.exe"
            ],
            "i": "objectives/command-and-control/dropper/lnk/window-hiding::lnk-text-cmd-target",
            "l": 1,
            "m": "F0008"
          },
          {
            "c": 0.800000011920929,
            "d": "LNK contains UTF-16 parent traversal",
            "e": [
              "2E 00 2E 00 5C 00 2E 00 2E 00 5C 00"
            ],
            "i": "micro-behaviors/fs/traversal/parent::lnk-utf16-relative-parent-chain",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.800000011920929,
            "d": "LNK targets cmd.exe with arguments",
            "e": [
              "C:\\Windows\\System32\\cmd.exe",
              "lnk.has_arguments = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/lnk/target::cmd-with-args",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Identifies execution artefacts in shortcut (LNK) files.",
            "e": [
              "cmd.exe",
              "$"
            ],
            "i": "third_party/bartblaze/generic/LNK_Ruleset/execution_in_lnk",
            "l": 4
          }
        ],
        "sha": "e6b71fb954c15afdeb377e6b65389a8182fc0bb7c14453f19d95e7fa1ab8310d",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-09/e6b71fb954c15afdeb377e6b65389a8182fc0bb7c14453f19d95e7fa1ab8310d.lnk",
        "type": "lnk"
      }
    ],
    "tv": "60127"
  }
}