.LNK file signature
A MS Windows shortcut file begins with the bytes 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 at the start of the file. The signature is the same whatever the file is named, which is why a renamed or extensionless LNK file is still recognisable.
Signature
| Offset | Hex | ASCII |
|---|---|---|
| 0 | 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46Header size 0x4C then the shell link CLSID. |
MIME type: application/x-ms-shortcut · usual extensions: .lnk
How to check a file's signature
Without installing anything: drop the file on our detector. It reads the bytes in your browser and shows the hex dump alongside the verdict; nothing is uploaded.
macOS and Linux (Terminal):
xxd -l 32 file.lnk
file file.lnkWindows (PowerShell):
Format-Hex -Path file.lnk -Count 32If the bytes do not match
A file named .lnk whose first bytes are something else is not a LNK file. The common explanations are a wrong or deliberately misleading extension, a download that saved an HTML error page instead of the file, or a container such as ZIP wrapping the real content. The detector reports what the bytes say; the LNK guide explains what a genuine file should contain.