<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>lnk &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/lnk/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Thu, 30 Sep 2021 13:07:14 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>lnk &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>A Fun CTF-Like Malware</title>
		<link>https://blog.cerbero.io/a-fun-ctf-like-malware/</link>
					<comments>https://blog.cerbero.io/a-fun-ctf-like-malware/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 30 Sep 2021 13:07:14 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[Encrypted]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[MSCrypto]]></category>
		<category><![CDATA[OLE]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Steganography]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2224</guid>

					<description><![CDATA[From a Twitter post by InQuest, we analyzed an interesting malware: Encrypted MS Office Document, VBA, Windows Link File (LNK), OLE objects, Windows Help Files (CHM), PNG steganography and Powershell. SHA256: 46AFA83E0B43FDB9062DD3E5FB7805997C432DD96F09DDF81F2162781DAAF834 The analysis should take about 15-20 minutes in Cerbero Suite. Highly recommended! SPOILER ALERT: The images below show all the steps of our &#8230; <a href="https://blog.cerbero.io/a-fun-ctf-like-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "A Fun CTF-Like Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/a-fun-ctf-like-malware/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2224</post-id>	</item>
		<item>
		<title>Malicious Windows Link with Embedded Microsoft Cabinet</title>
		<link>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/</link>
					<comments>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 10 Sep 2020 04:28:53 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[cab]]></category>
		<category><![CDATA[Cabinet]]></category>
		<category><![CDATA[Link]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reversing]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1893</guid>

					<description><![CDATA[You can find the original analysis for this malware at malwarebytes. As a bonus, in the video we show how to improve the static analysis of the final payload by resolving API calls. This script converts the decrypted blob hashes into a call index → api name dictionary. blob = bytes([ 0x6B, 0x65, 0x72, 0x6E, &#8230; <a href="https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/" class="more-link">Continue reading<span class="screen-reader-text"> "Malicious Windows Link with Embedded Microsoft Cabinet"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1893</post-id>	</item>
		<item>
		<title>Windows Link Support</title>
		<link>https://blog.cerbero.io/windows-link-support/</link>
					<comments>https://blog.cerbero.io/windows-link-support/#respond</comments>
		
		<dc:creator><![CDATA[Alessandro Gario]]></dc:creator>
		<pubDate>Mon, 22 Oct 2012 17:19:40 +0000</pubDate>
				<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[shell link]]></category>
		<category><![CDATA[windows link]]></category>
		<category><![CDATA[windows shortcut]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=736</guid>

					<description><![CDATA[The next Profiler update, along with several new features, will also include preliminary support for the Windows Link files (also known as Shell Links). This format has been introduced with Windows 95 and is frequently taken into consideration in forensic analysis procedures to discover usage information about files and folders. In the image below, a &#8230; <a href="https://blog.cerbero.io/windows-link-support/" class="more-link">Continue reading<span class="screen-reader-text"> "Windows Link Support"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/windows-link-support/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">736</post-id>	</item>
	</channel>
</rss>
