1. Overview This post describes a PUA similar to the sample mentioned in the following article. https://www.c2server.xyz/2023/09/net-in-javascript-fake-pdf-converter.html If you would like to know more about the previous sample, the following articles are excellent. Thanks to the article for following up on the deficiency of my previous post. https://www.themalwareanalyst.com/2023/11/fake-pdf-converter-leading-to-malicious.html https://security5magics.blogspot.com/2023/10/interesting-customloader-observed-in.html 2. Sample This sample can be downloaded from the following URL. https://www.free-pdf-convert[.]com/ The this sample operations are as follows. This sample also uses WebView2 like the previous sample. The single page app works as PDF converter as follows. In other words, this sample does not run WebView2 in hidden mode. How is this single page application implemented? The main implementation of this app can be found at https://pdf.activegn.com/js/app.[xxxx