Security Magic

Deep dive into YAPA malware using a new WiX installer technique, analyzing PDFRefresh, updater abuse, UUID fingerprinting, and stealth persistence. YAPA (Yet Another PDF Application), EvilaAI, MediaArena, or whatever you want to call these, are continuously trying new tactics/techniques to evade detection. In this latest YAPA, I look at PDFizer, which uses Wix MSI installer to assist with making detection more difficult. I first posted a similar file,  FlyPDFy   on this  X post   PDFizer: MD5: 5843ff0c676bcf99039b2b46035fdf8e Signer: Shappi Corp Download: https://pdf-izer[.]com/ SandBox Run : File Extraction: Since this is a Wix installer, we can use Dark.exe to extract the MSI Then we can use a tool like less-msi to further extract all the remaining files: PDFCoreLibrary.dll  (.NET) PDFizer.exe  (.NET) PDFRefresh.exe (GO) It does appear that the .NET files are benign. However the MSI does create a scheduled task to run the PDFRefresh...

GalacticPDF poses as a PDF converter while hiding XOR-encoded telemetry, browser profiling, and search hijacking infrastructure. GalacticPDF is another PDF reader/converter application I ran across that has the look and feel of EvilAI and YAPA programs I've observed over the past year. Many of these programs have websites that have a similar look and feel to the image below: Certificate Signer: As with many of these programs, there is a valid certificate signer "MONKEY DIGITAL LTD". These do tend to have interesting names. Also, as far as I can tell, this one has only been used with GalacticPDF. Google Ads: One place I've started looking with these is in Google's Ad Transparency to see if it looks a little off, or maybe to pivot to other programs being advertised by the same advertiser. GalacticPDF is adverstied by " Kiruguard Ltd ". This doesn't tell me much, but it does give me some visuals that again, look very similar to other EvilAI campaigns...

Technical analysis of SupremePDFApp PowerDoc malware: Chrome profile targeting, XOR config decoding, Web Data manipulation, and C2 emulation technique In another YAPA investigation, I began by "hunting" around keywords using Google's ad transparency, and came across supremepdfapp[.]com . I went the website and downloaded the sample, now found on VirusTotal . As pointed out to me by MalasadaTech , this advertiser is based in Hong Kong, while the "company signer" is an Israel based company that is only a few days old at the time of this writing. While pivoting around on various strings, and the icon hash, I noticed that other related samples actually flagged under my powerdocapp hardcoded XOR key YARA rule . Some examples of previous variants under the old YARA rule include: PowerDoc.exe  and NotAWord.ex e. This time however, the hard-coded XOR key has been changed (this change is now reflected in my YARA rule).  Observed Obfuscated Strings string text = ...

Analysis of PDFSupernova, a malicious application that hijacks your browser searches and your auto-fill forms. PDF Goes Super Nova! Analyzing PDFSupernova  has been interesting, this is, at the time of this writing, a fully undetected browser hijacker. There also appears to be some information stealing/gathering capabilities. When I first looked at this last week, I set it aside since I was already looking at SystemShock Loader . This sample had some glaring red flags, at first glance I thought it was most likely a PUP  . Red Flags  A ~50MB file really results in what looks to be just a desktop shortcut to a pdf conversion website.  The "installer" takes focus of the screen, not allowing the user to interact with other tools or the desktop. YAPA (Yet Another PDF APP), I'll work on that acronym. Strings show what appears to be .NET code in parts of the file, but do not load as .NET in dnspy or decomp...