Skip to content
LNK Parser

Posts tagged: #lnk

← Back to all posts
How to open a .lnk file (and read what's inside)
Opening a Windows .lnk file usually runs its target, not the shortcut itself. Here is how to inspect the .lnk's actual binary contents safely, in your browser, with PowerShell, or with a hex viewer.
lnklnk file extensionopen lnk filewindows shortcut
Forensic analysis of .lnk files: what investigators look for
A field guide to the artifacts inside Windows shortcuts — NetBIOS name, droid GUID, target FILETIMEs, volume serials — and how DFIR teams use them.
lnklnk forensicsdfirwindows artifacts
LNK file malware: how Windows shortcuts get weaponized
Why .lnk shortcut files are an attacker's preferred delivery vector, from Stuxnet's CVE-2010-2568 to today's ISO+LNK phishing campaigns, and how to spot a malicious one before it runs.
lnklnk malwareshortcut malwarephishing
MS-SHLLINK: the .lnk binary format, field by field
A practical walkthrough of every section of a Windows .lnk file: ShellLinkHeader, LinkTargetIDList, LinkInfo, StringData and ExtraData, cross-referenced to the MS-SHLLINK specification.
lnkms-shllinkshell linkbinary format
What is a Windows .lnk file?
A short, technical tour of the Windows Shell Link (.lnk) binary format: its header, link flags, LinkInfo, StringData and ExtraData blocks, plus what this client-side parser extracts from each one.
lnkwindows shell linkshortcutbinary format