Indicators of Compromise (IoCs) Identified in Northwave's Malvertisement Investigation
Reported August 2025 - January 2026
HuFiCon Management Memo:
Journey with the CISO
A mountain climb to cyber security resilience. Find out how to get to the summit of cyber security resilience in Inge van der Beijl's management memo, from her presentation at the Human Firewall Conference (HuFiCon) on the 14.11.2024.
The climb will take you from the base camp of foundational security to the high-camp of a security conscious culture, all the way to the summit consisting of strategic security integration.
Inge van der Beijl
Director Innovation
Since August 2025, Northwave’s Security Operations Center (SOC), Computer Emergency Response (NW-CERT) and Cyber Threat Intelligence (CTI) teams have been investigating a widespread malware campaign connected to digital productivity tools downloaded through Search Engine Advertising (SEA) campaigns. Below is a table of the Indicators of Compromise (IoCs) that we have uncovered in our investigation and shared with security partners in Europe.
We recommend using them to help validate whether any of these indicators appear in your environment.
|
Signer |
File with hash |
download domain |
C2 |
|
Sherlock Tech Ltd, |
PDFclick.exe 09474277051fc387a9b43f7f08a9bf4f6817c24768719b21f9f7163d9c5c8f74 |
pdfclickapp[.]com |
oblifagi[.]com |
|
PDFDoc.exe: cb42e3a751ff526912bb41337a9205cbe145f5fe80869341c79d5358c863c549 |
pdfdocapp[.]com |
||
|
WHATECH MOBILE CO., LIMITED |
NotAWord.exe |
notawordapp[.]com |
oblifagi[.]com |
|
My Tech Media LTD |
ZapPDF.exe |
zappdfapp[.]com |
oblifagi[.]com |
|
Sorbet Live LTD |
InfiniteDocs.exe |
infinitedocsapp[.]com |
oblifagi[.]com |
|
PowerDoc.exe |
getpowerdoc[.]com |
ulinikio[.]com |
|
|
BLUE TAKIN LTD |
Easy2Converter.exe |
xilopra[.]com |
confetly[.]com |
|
CANDY TECH LTD |
Onezip.exe e8b89b9fc60dc8ddb861369a7ab2cc319f23495022c4d1feb6e0cc4f3a87214c |
onezipapp[.]com |
lolidwni[.]com |
|
Convertmate.exe UpdateRetreiver.exe Uninstaller.exe conmate_update.ps1 Convert Mate.exe d9f9584f4f071be9c5cf418cae91423c51d53ecf9924ed39b42028d1314a2edc |
conmateapp[.]com |
dcownil[.]com |
|
|
Red Root LTD |
ConvertyFile.exe |
convertyfileapp[.]com |
lukgiop[.]com |
|
A1A Marketing Ltd. |
|
crystal-pdf[.]com |
|
|
PDFConfigurator.dll |
free-pdf-creator[.]com |
api[.]free-pdf-creator[.]com |
|
|
PDFStar.dll |
pdf-star[.]com |
api[.]pdf-star[.]com |
|
|
powerdoc.exe |
powerdocapp[.]com |
yablinov[.]com |
|
|
CROWN SKY LLC |
7ZSfxMod_x64.exe calendaromatic-win_x64.exe downloaded ZIP archive |
Calendaromatic[.]com |
|
|
Crowd Sync LLC |
PDFSparkOnSoft_82046.exe, setup.exe PDF spark setup setup.tmp |
SparkSoftinc[.]com |
getappsgroups[.]com |
|
GLINT SOFTWARE SDN. BHD. Summit Nexus Holdings LLC. Echo Infini Sdn Bhd. Apollo Technologies Inc. |
ManualFinder-v2.0.196.msi ManualFinderApp.exe AppSuite-PDF.msi pdfeditorsetup.exe PDF Editor.exe PDF Editor.exe |
pdfmeta[.]com |
y2iax5[.]com |
|
International Holdings, LLC |
ConverKit.exe/pdfeditor |
cleareditpdf[.]com |
paperappsetup[.]com |
|
Byte Media Sdn. Bhd. |
smartopenpdf.msi / gopdfmanuals.msi / propdfhub.msi / easypdfmanuals.msi Epi-PDF.msi |
|
potential C2 api[.]epibrowser[.]com |
|
Mainstay Crypto LLC |
pdfsetupapp.exe |
|
|
|
Tropical RIiff Ltd |
PDFly.exe |
|
https[://]gomeetpdfly[.]llc |
|
Unsigned |
RapiDoc.exe |
doctwoli[.]com/ |
|
We are here for you
Need help with your cyber security or wondering how secure your business really is?
Get in touch and we will help you find the best solution.