Are LNK shortcut files dangerous?
Yes, more than they look. A Windows shortcut can run any command with arguments, show any icon, and hide its target in a field most people never see. Since Office began blocking macros, .lnk files have become a favourite malware delivery method.
How a .LNK file can do harm
- A command line that launches PowerShell, cmd, mshta or wscript with an obfuscated script, while the icon shows a PDF or folder
- A target that downloads and runs a payload from the internet in one step
- Hidden arguments: Explorer's Properties dialog truncates long target fields, so the malicious tail is invisible
- Exploits for shortcut-parsing bugs, including ones that triggered merely by displaying the icon in a folder (Stuxnet's CVE-2010-2568)
What it cannot do
- Do anything inside a ZIP until extracted and double-clicked
- Hide from inspection: the target command is stored in the file and tools can print it in full
Signs of a suspicious .LNK file
- A .lnk file arriving by email or inside an archive; shortcuts have no reason to travel between machines
- A shortcut with a document or folder icon but a small arrow overlay in the corner
- A target field starting with powershell, cmd, mshta, wscript or rundll32 when you open Properties
- A file named like a document (Invoice.pdf.lnk) where Explorer hides the .lnk part
Before you open it
- Never open a shortcut you received; open the real document or program it claims to point to instead
- Inspect the target with a dedicated LNK parser that shows the full command, rather than the Properties dialog
- Block .lnk at the mail gateway and in archive scanning; legitimate workflows do not need them
- Show file extensions and the shortcut arrow overlay in Explorer
Check that it really is a .LNK file
The first question for any suspicious file is whether it is what its name says. Drop it on the detector: it reads the bytes in your browser, reports the real type, and computes the SHA-256 you can look up on VirusTotal, all without the file leaving your machine. A common LNK signature is 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46; see the signature reference.