LNK files are shortcut files that display an icon on the computer Desktop or in a folder, and act as a direct link to a specified folder, file or system location. Shortcuts are used to make finding specific files or system locations much more convenient for the user.
Attackers however can modify shortcut files, or drop specially-crafted ones, that point to harmful files or components that have been silently installed on the system. When the user clicks on the 'booby-trapped' shortcut, they unintentionally launch the harmful file.
Harmful LNK files will usually mimic legitimate ones by using the file icons associated with popular programs such as Notepad, Word, PDF, etc to trick the user into thinking that the shortcuts are authentic.
How they spread
Some malware will install harmful LNK files as part of their payload.
Harmful LNK files are also often spread in infected removable drives; in such cases, the harmful files they link to are hidden on the removable drive, while the LNK file is visible.
Based on the specific malware, clicking the shortcut can result in various actions. Some malware show no obvious actions after the shortcut is clicked, but will silently run malicious components in the background. Other will open a legitimate program (for example Word or Notepad) to distract the user, while still silently launching other components in the background.
Some LNK malware will also open the command prompt (cmd.exe) and execute malicious scripts in the background, so that several different malicious routines can run at the same time. Examples of such scripts include:
- c start crack.vbs & start explorer ASA & exit
- c start ..\Skypee\AutoIt3.exe /AutoIt3ExecuteScript ..\Skypee\googleupdate.a3x explorer "%CD%" & exit
- c start COOL.vbs & start document.doc & exit
The Trojan.LNK.Gen generic detection can also be triggered by LNK components used by malware families, particularly those that are written in the AutoIT or VBS languages, such as:
This detection will also identify malware executed from a shell and in some cases, will identify malware that contain specific parameters or instructions.