pandora icon indicating copy to clipboard operation
pandora copied to clipboard

[Worker] Adding a lnk parser

Open FafnerKeyZee opened this issue 3 years ago • 0 comments

Hey,

With malware using lnk file, it should be nice to have a worker to parse the lnk (for information only)

Python 3.9.2 (default, Feb 28 2021, 17:03:44) 
[GCC 10.2.1 20210110] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import LnkParse3
>>> with open('1.lnk', 'rb') as indata:
...   lnk = LnkParse3.lnk_file(indata)
...   lnk.print_json()
... 
{
    "data": {
        "description": "only",
        "icon_location": "C:\\Windows\\System32\\shell32.dll",
        "relative_path": "..\\..\\them\\worker.cmd"
    },
    "extra": {
        "ICON_LOCATION_BLOCK": {
            "size": 788,
            "target_ansi": "%SystemRoot%\\System32\\shell32.dll",
            "target_unicode": "%SystemRoot%\\System32\\shell32.dll"
        }
    },
    "header": {
        "accessed_time": null,
        "creation_time": null,
        "file_flags": [],
        "file_size": 0,
        "guid": "00021401-0000-0000-C000-000000000046",
        "hotkey": "UNSET - UNSET {0x0000}",
        "icon_index": 4,
        "link_flags": [
            "HasTargetIDList",
            "HasName",
            "HasRelativePath",
            "HasIconLocation",
            "IsUnicode",
            "HasExpIcon"
        ],
        "modified_time": null,
        "r_file_flags": 0,
        "r_hotkey": 0,
        "r_link_flags": 16589,
        "windowstyle": "SW_SHOWMINNOACTIVE"
    },
    "link_info": {},
    "target": {
        "items": [
            {
                "class": "Root Folder",
                "guid": "20D04FE0-3AEA-1069-A2D8-08002B30309D",
                "sort_index": "My Computer"
            },
            {
                "class": "Volume Item",
                "data": null,
                "flags": "0xf"
            },
            {
                "class": "File entry",
                "file_attribute_flags": 16,
                "file_size": 0,
                "flags": "Is directory",
                "primary_name": "them"
            },
            {
                "class": "File entry",
                "file_attribute_flags": 0,
                "file_size": 0,
                "flags": "Is file",
                "primary_name": "worker.cmd"
            }
        ]
    }
}

Best regards,

FafnerKeyZee avatar Jul 20 '22 16:07 FafnerKeyZee