Windows shell link
application/octet-stream
Magic Bytes
Offset: 0
4C 01
Windows Shell Link, commonly known as a shortcut, is a binary file format created by Microsoft for the Windows operating system. These files serve as pointers to local executables, directories, or network resources, enabling users to access targets without navigating the file system hierarchy. While the format itself is benign, these shortcuts are frequently exploited by malware to hide malicious command execution, requiring caution when handling unexpected files.
Validation Code
How to validate .lnk files in Python
Python
def is_lnk(file_path: str) -> bool:
"""Check if file is a valid LNK by magic bytes."""
signature = bytes([0x4C, 0x01])
with open(file_path, "rb") as f:
return f.read(2) == signatureHow to validate .lnk files in Node.js
Node.js
function isLNK(buffer: Buffer): boolean {
const signature = Buffer.from([0x4C, 0x01]);
return buffer.subarray(0, 2).equals(signature);
}
Go
func IsLNK(data []byte) bool {
signature := []byte{0x4C, 0x01}
if len(data) < 2 {
return false
}
return bytes.Equal(data[:2], signature)
}API Endpoint
GET
/api/v1/lnk
curl https://filesignature.org/api/v1/lnk