Fake PDF converter hides a dark secret

PDF Goes Super Nova!

Analyzing PDFSupernova has been interesting, this is, at the time of this writing, a fully undetected browser hijacker. There also appears to be some information stealing/gathering capabilities.

When I first looked at this last week, I set it aside since I was already looking at SystemShock Loader. This sample had some glaring red flags, at first glance I thought it was most likely a PUP .

Red Flags

1. A ~50MB file really results in what looks to be just a desktop shortcut to a pdf conversion website.
2. The “installer” takes focus of the screen, not allowing the user to interact with other tools or the desktop.
3. YAPA (Yet Another PDF APP), I’ll work on that acronym.
4. Strings show what appears to be .NET code in parts of the file, but do not load as .NET in dnspy or decompress .NET binaries using 7Zip.
5. A recent sandbox run shows a lot of interesting indicators
6. Finds chrome.exe and performs taskkill
7. novaserv[.]vanmirop.com/api/v1/van contains the Web Data file (SQLite file)
8. api.vanderconf[.]com/api/v1/message contians ICO, and code to find and kill chrome process

My Ongoing Analysis

My own analysis of this file doesn’t really turn up much more than what the sandbox and virustotal provide. I observed the 3 DLL files being dropped, which can be seen in the sandboxes as well.

Algorithm : MD5
Hash : 11A4A07F31E4A91FFF678C019B7736AF
Path : pdfsupernova\Jaf36KMCn_cwdNfe6bGTyrolscwl21E=\av_libglesv2.dll

Algorithm : MD5
Hash : E0C86BBD88D6B8F5643C1AB1C050A4EE
Path : pdfsupernova\Jaf36KMCn_cwdNfe6bGTyrolscwl21E=\libHarfBuzzSharp.dll

Algorithm : MD5
Hash : EF1FABCE43FE32CA83260481253F5476
Path : pdfsupernova\Jaf36KMCn_cwdNfe6bGTyrolscwl21E=\libSkiaSharp.dll

These seem to be legit files, possibly used for PDF dependencdies per this OpenTap forum posting. So, zero detections for a month on VirusTotal, some likely clean DLLs, and a desktop link. What am I to make of this? Well, I did notice another file in my AppData\Local\Temp directory, and this was a “Web Data” file. Which is a SQLite chromium based profile data file that stores auto-fill information, login details, and more.

Update on the dlls listed above:

The are likely being used because this EXE uses AvaloniaUI, and as listed on this reddit post, these are dlls used for Avalonia.

I figured at this point it probably overwrote my own Chrome profile “Web Data” file. I was right. I created a fresh profile with the default web data file, and compared that to the web data file after I ran pdfsupernova.exe. Sure enough, it overwrote me file with the one that was found in temp. Here’s a look at that file.

It’s interesting that there are multiple financial institutions referenced, additionally the keywords table contains the interesting filters for the vanmirop[.]com site.

Get Luke Acha’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I found that vanmirop hijacks my searches when using the address bar on my browser. Here is a listing of sites/redirects I observed before the search parameter finally passed off to a legit search engine (Yahoo).

withgoogle[.]com
van.vanmirop[.]com
eusrchrdr[.]com
undertone[.]com
cdn.searchontec[.]com
sync.cootlogix[.]com
os.gotosearch[.]co

Interesting observed strings:
Avalonia
C:\Users\JohnnyD\Supernova TO\obj\Release\net8.0\win-x64\Supernova.pdb
agree to set my default search settings to vanmirop and I agree to thePrivacyand

So, my address bar has been hijacked, and some interesting form fill information has been added with specifics to banking and credential logins. This smells like a bit of browser hijacking with a mix of credential stealing capabilities to me. A large theme lately continues, beware of free PDF and Converter applications.

Subject: CN=Trivolead LTD, O=Trivolead LTD, L=Tel Aviv-Yafo, C=IL, SERIALNUMBER=517161592, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IL

ProcMon

Updates:

November 8, 2025: Malasada Tech has written a fantastic article on a related sample: PDFChampions.

Inspired by this, I went back and reviewed the .NET code being passed from the server side from PDFSupernova. Here are the .NET code samples:

• MShort:
• Detail:
• Cheers:

I have to note that none of the .NET code I observed in my sample (at least not so far), has the same kind of loader code that Malasada Tech had observed.

Inspired by this, I went back and reviewed the .NET code being passed from the server side from PDFSupernova. Here are the .NET code samples:

I have to note that none of the .NET code I observed in my sample (at least not so far), has the same kind of loader code that Malasada Tech had observed.

11/19/2025: Today I observed a new variant PrimePDFConvert that not only hijacks the Web Data file (search hijack points to api[.]fuzzsearch[.]com), but also drops a scheduled task for persistence. The full write-up on blog.lukeacha.com

11/24/2025: Thanks to Squiblydoo for pointing me to dotnetdebloat I was able to extract Supernova.dll from the executable.

12/5/2025: Hunting through ad transparency found “ Trivolead LTD” with ads for PDFParade[.]com. A look at the site reveals relationships with PDFSupernova. Additionally, pdfrogger[.]com, also has this uninstall page at the time of this writing.

IOCs:

SecurityMagic-Github

pdfsupernova 438bffa2420a6a0a17344135160c635d16c029d267d441de539fd45f5c17f551pdfsupernova ccfa3fd8900bebd034cb623e77f108c77a31acd306f5bf58d6f5d8ea4d24d38a Web Data file9b1df83a0a682c009d1a4ddb3adc4aef5e4ba7c9cc84c5b3f76fbe9f524291df

Originally published at https://blog.lukeacha.com on November 4, 2025.