agentsclimarketplace

Analyzing malicious lnk files

Skill meltedinhex/analyst-ai-pack/skills/analyzing-malicious-lnk-files

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malicious-lnk-files

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure for the target command, arguments, icon, and working directory, and recovering hidden PowerShell/cmd payloads and embedded content used in phishing. Activates for requests to analyze a malicious LNK, parse a shortcut file, or extract a command from a .lnk.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.2 KB, as published. Nobody here has run it

Analyzing Malicious LNK Files

When to Use

  • You have a .lnk delivered via phishing (often in an archive or ISO) and need its real action.
  • You must recover the target command line, arguments, and any embedded/hidden payload.
  • You are extracting IOCs (commands, URLs, file paths) from a shortcut.

Do not use Windows Explorer to inspect or double-click the shortcut — that executes its target. Parse the binary structure statically.

Prerequisites

  • An LNK parser (Python struct, or lnkparse/LECmd); the sample handled inertly.

Safety & Handling

  • Never double-click or hover-load the shortcut in Explorer; parse raw bytes only.
  • Defang recovered URLs and store any embedded payload password-protected.

Workflow

Step 1: Confirm and parse the header

Verify the LNK magic (4C 00 00 00 + the link CLSID) and read LinkFlags to know which optional structures are present.

python scripts/analyst.py parse sample.lnk

Step 2: Recover the target and arguments

Extract the relative/local path and, crucially, the COMMAND_LINE_ARGUMENTS string — malicious LNKs hide powershell -enc ... or cmd /c ... here.

Step 3: Inspect icon and metadata

Read the icon location (often spoofed to look like a document) and metadata (machine ID, timestamps) useful for attribution/clustering.

Step 4: Find appended/embedded payloads

Check for data appended after the LNK structure (some campaigns embed scripts/binaries past the parsed end) and extract it.

Step 5: Decode and extract IOCs

Decode encoded commands (UTF-16LE base64), defang URLs, and route extracted payloads to the right analysis workflow.

Validation

  • The full command line, including arguments, is recovered (not just the target path).
  • Encoded commands are decoded to cleartext.
  • Appended/embedded payloads are detected and extracted, and IOCs are defanged.

Pitfalls

  • Reading only the target path and missing the malicious arguments.
  • Inspecting in Explorer and executing the shortcut.
  • Ignoring data appended past the LNK structure.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.