Security Magic

Technical analysis of SupremePDFApp PowerDoc malware: Chrome profile targeting, XOR config decoding, Web Data manipulation, and C2 emulation technique In another YAPA investigation, I began by "hunting" around keywords using Google's ad transparency, and came across supremepdfapp[.]com . I went the website and downloaded the sample, now found on VirusTotal . As pointed out to me by MalasadaTech , this advertiser is based in Hong Kong, while the "company signer" is an Israel based company that is only a few days old at the time of this writing. While pivoting around on various strings, and the icon hash, I noticed that other related samples actually flagged under my powerdocapp hardcoded XOR key YARA rule . Some examples of previous variants under the old YARA rule include: PowerDoc.exe  and NotAWord.ex e. This time however, the hard-coded XOR key has been changed (this change is now reflected in my YARA rule).  Observed Obfuscated Strings string text = ...

UPDATE: September 18, 2025  Another variant of what I've been looking at over the past week caught my eye today. Just wanted to give a real quick review of this, showing the POST encoding/decoding process. OpenMyManual.exe (9f948215b9ee7e7496ce3bc9e46fda56b50cc8905b88535225c7651007f660d5) Drops a copy of node.exe as well as a malicious JS file (2cd68ea7f02e8cfaded52d64c2cb71b64560b3799c948960db37e827618ff22d) Like in my last post, you can run this through a js deobfuscato, make a couple quick edits, and the run node.exe with the --insert-brk to set breakpoints and step through the program: What you eventually get is the C2 (api.evil.com/nss), the POST data, and how that POST data is being encoded and sent out to the C2. The 16 byte buffer is the XOR key, the 176 byte buffer is what becomes the Base64 (shown here as _0xda4df9).  To date, I have not got a response back from any of these C2's. I've looked at several of these, they all so far have a pattern like ^api.[a-zA-...

Quick post, ran across a JS/BONDAT Worm variant and thought I would highlight some analysis and detection opportunities. The file I came across can be found here:  https://app.any.run/tasks/b3654b29-8858-4769-90ae-4f45a5f27c5d/ First Detection Opportunity This is a JavaScript file being executed via wscript, while this does not always mean "malicious", I find that detecting on Wscript.exe with a command line of .js does catch a fair number of malware families.  Of course, you may need to negate some false positives as you run across them, but this is a good start. Second Detection Opportunity From the above image, you can see Wscript.exe writing a .JS file. This may be a good item to key in on as well. Again, some minot false positive may exist, but those should be easy to negate. Understanding the Javascript The first thing to day with the JS is to beautify it... We can go from This: To This: right away we can see that some data about the victim is being coll...