Screen recording of downloaded LNK file with the "trailing character" strategy. First double-click strips off the MotW. Second double-click runs the target EXE (with arguments).

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Thursday, 12-Sep-2024 01:47:43 JST Will Dormann

   in reply to

   Note that with variant 2 ("Target File DOS Name" ends with a '.'), it's worth noting that there's nothing special about the '.' character. It can be just about anything. It could be a space, or a newline, or probably a wide number of characters.

   But to fall victim to this requires double-clicking on the LNK file twice. The first time Windows will normalize the path and strip the MotW. The second time will invoke the target.