Summary

According to the analysis of URL that was sent by people in messenger, we try to scan it for malicious detection, but it looks clean and safe.

Anyway, we’ve seen that this site was hosted behind Cloudflare network, and see a few suspicious activities by this domain such as hug of the random name of the subdomain. It drops 2 different files APK and PDF when we access the URL. These files also clean after scanning, but it actually has a lot of strange behavior such as it tries to resolve many domain names, try to contact a butch of domain name, allocate big amount of memory, and also write some files which those files are JS extension but actually they’re C# & C++ file.

Conclusion: We’re can’t identify the purpose of this scam message specifically, but we can assume as below point: It’s kind of Trojan Malware or Bot that infect devices and functioning as trojan or bot and act as the gateway for another malware to get in and attack in the future base on their need.