Trojan Horse: A Fake PDF Editor Is Actually a Malware-Laden Backdoor

Security researchers at G DATA Security Lab have exposed the AppSuite PDF Editor as a malware-laden backdoor masquerading as a legitimate productivity tool, following the threat actors’ bid to get antivirus vendors to whitelist it. The investigation shows the backdoor is delivered via a deceptively functioning PDF management tool and is spread through high-ranking websites that lure users with a supposedly legitimate product.

Once installed, it creates persistence through autorun entries and scheduled tasks and operates behind a partially functional Electron-based PDF editing interface. The main component, pdfeditor.js, contains heavily obfuscated JavaScript that interprets command line switches such as the –install, –ping, –check and –reboot routines to trigger backdoor activity, including data encryption with AES-128-CBC and communication with a command-and-control server.

G DATA notes that the backdoor can exfiltrate data, manipulate the registry, and deploy additional malware, targeting browsers like Chrome and Edge; any infection contacting the C2 should be considered unrecoverable and require repaving the system. The AppSuite PDF Editor is described as a classic Trojan horse with a backdoor that is currently massively downloaded.