The sample LNK files that Elastic Security Labs made public a month ago that exploit this vulnerability were never uploaded to VirusTotal. I had to upload all 3 variants.
This to me is... unexpected?
https://www.virustotal.com/gui/file/a688c1f260fefd4cb071d268dde451fd36a7b43a92d8ee1bc5c415174f61c2d5/details
https://www.virustotal.com/gui/file/949ee5111405e5fd27d8ea422b23b88c4e4c135c1ed03174273578644a01e482/details
https://www.virustotal.com/gui/file/2c4d74eccf65d8df1961e5ead02d542d1b09eba93f4bb011d23eceb230fd02bc/details