Thread by @greglesnewich

#100DaysofYARA More LNK fun with GOLDBACKDOOR! Padding commands with spaces is a common technique used in LNK files to hide the actual intent inside of the Properties box (see images for examples of padded vs not padded in the Target field

LNK files store strings relevant to malware analysts, such as icon location and command line arguments, in unicode

This means we can look specifically for consecutive unicode spaces, which likely won't find general padding

github.com/100DaysofYARA/…

Now, if we use the lovely LNK module from @BitsOfBinary, we can get a little bit more precise by looking for padding inside of the commandline field!

note this is not in standard-issue yara yet, but check out the PR: github.com/VirusTotal/yar…

github.com/100DaysofYARA/…