Productivity software has become one of the most indispensable and exploited delivery vectors in modern threat campaigns. The popularity of free productivity tools makes it easier for Projextor to spread, as users often trust and download these applications without verifying where they came from. This is not a new observation, on previous malware campaigns, like TamperedChef, threat actors are leveraging websites, which have high-ranking search results, to lure users into downloading a deceptively functioning 'productivity tool' or 'command center' for PDF management.
Based on the samples we gathered, we identified a cluster of Electron-based applications such as Kitchen Canvas, Food or Meal Formula, DocConvertWizard, and other PDF conversion tools under different names, each concealing the same malware beneath a working user interface. The applications silently gain the ability to dynamically execute injected scripts and access desktop capture functionality through Electron APIs.
Infrastructure Impersonation and Delivery Mechanism
The malware was distributed through multiple websites and download URLs for applications that are document converters, meal planners and recipe formulators.
One notable URL is, hxxps://doceditorinc[.]com/
The domain appears intentionally crafted to impersonate the legitimate online document and image processing service: hxxps://doceditor[.]in
Installation and Infection Chain
Creating output, interacting with local content and using system resources is expected behavior of a productivity application. This enables malicious behavior to blend into a stream of legitimate activities, which makes the compromise more difficult to recognize.
The first stage of the campaign is an installer or downloader used to retrieve the main application. Some samples are packaged using NSIS (Nullsoft Scriptable Install System), while others use Squirrel Installer and Inno Setup formats. Regardless of the packaging method, the first-stage file serves the same purpose: it delivers the second-stage Electron-based productivity application.
For instance, PDFGrip_646990.exe (SHA-256 71656539cc644513396f56100ffb56f9ef9eaa5b7a16b0773d6e5d370a912a88) contains a download link ‘hxxps://conv.doceditorinc[.]com/latest/part’ in its NSIS script.
At the time of analysis, the link downloaded SHA-256 4ce5e5768d2f9f71e2835ab8ebc4a2191d436ca3a990a56e9bc264235c7b5b55 as the second stage. It contains the main.js and preload.js functionality discussed in the following sections.
Electron Preload Layer Abuse
Electron is a cross-platform application framework that combines Chromium and Node.js, allowing developers to build desktop applications using web technologies such as HTML, CSS, and JavaScript. Unlike traditional web applications, Electron applications can access native operating system functionality through Node.js APIs, providing capabilities such as file system access, process execution, inter-process communication (IPC), and interaction with local system resources.
To facilitate communication between the Chromium renderer process and privileged Node.js functionality, Electron uses a component known as a preload script. Executed before the renderer process is fully initialized, the preload script serves as a bridge between the browser environment and Node.js APIs, enabling application developers to selectively expose privileged functionality to web content.
The main and preload scripts are installed within the application resources directory and executed automatically during application startup.
%AppData%\{Application Name}\resources\app\lib\preload.js
%AppData%\{Application Name}\resources\app\lib\main.js
The code snippet below shows the PDF Grip application's main.js file, which instructs Electron to automatically load and execute preload.js whenever the application starts. Because preload.js runs before the user interface is displayed, it becomes the application's entry point for loading additional JavaScript modules.
Its settings in main.js are very insecure, it uses contextIsolation: false in the Electron app, meaning the remote website gets access to the system via Node.js which are added by the preload script. It is set to true by default in modern Electron versions. You only see or write contextIsolation: false if it was explicitly turned off by a developer.
Warnings have been turned off on purpose via disableOldBuildWarning, this disables warnings from using outdated and insecure Electron versions. The application was made insecure on purpose as we have seen in developer's comments in the code.
One of the most concerning findings is the application's ability to dynamically load and execute arbitrary JavaScript modules. This allows threat actors to add new functionality after the application has been installed, giving them the flexibility to execute remotely any action without modifying the original application code.
Desktop Capture Capability
The application also implements Electron desktop capture functionality. The preload script implements a custom screen-share picker interface that enumerates available desktop and application windows, displays thumbnail previews, and allows users to select a capture source.
The security implications of this capability are significant. If abused, desktop capture functionality could allow threat actors to monitor user activity, capture sensitive documents, observe authentication workflows, and collect information displayed within business applications, browsers, email clients, and collaboration platforms. Unlike traditional credential theft mechanisms that target stored secrets, screen capture can expose information that is only visible during active user sessions.
This shows how the preload script requests desktop capture sources through Electron IPC communication. This gives the application visibility into the user's active desktop environment, including available monitors and open application windows.
Although desktop capture functionality itself is not inherently malicious, its presence inside productivity tools significantly increases the risk profile of the software, especially when combined with arbitrary JavaScript execution capabilities.
Final Thoughts
These applications are not fake; they do what they promise to do. The concern is that they also include functionality that allows additional JavaScript code to be loaded and executed at runtime, giving the application capabilities far beyond those expected of a productivity tool.
Although the applications have different names and purposes, our analysis found that they share the same Electron framework, the same main.js and preload.js implementation. This suggests they are part of the same campaign or were built from the same code base. However, we do not have enough evidence to conclude that they were created or operated by the same threat actor.
This is a reminder that even fully functional applications should only be downloaded from trusted sources and verified before installation.
MITRE ATT&CK Mapping
Technique | ID | Description |
User Execution: Malicious File | T1204.002 | User downloads and executes the installer |
Masquerading | T1036 | Applications present themselves as legitimate productivity tools |
JavaScript | T1059.007 | Dynamically loads and executes injected JavaScript files |
Screen Capture | T1113 | Implements Electron desktop capture functionality |
Inter-Process Communication | T1559 | Uses Electron IPC channels
|
Match Legitimate Resource Name or Location | T1036.005 | Lookalike domain and branding imitate legitimate services |
IOCs:
Hashes | G DATA Detection |
A799417BD79060D63E93682F339FBE2868DE3881F9C5865D9B583F5B715C70A9 | Win32.Malware.Projextor.E |
71656539CC644513396F56100FFB56F9EF9EAA5B7A16B0773D6E5D370A912A88 | Win32.Malware.Projextor.E |
e7bc36c7345b3894bc1da3d18ff3dbf0a20713d17b93a585ac0da65776d29027 | Win32.Malware.Projextor.E |
3C1DBC3F56E91CC79F0014850E773A7F12BBFEF06680F08F883B2BF12873ECCC | Win32.Malware.Projextor.E |
D50CA2FA212DF1C1FF69B5D26BA594BD39BFD86A71B068A650CC577E5DC9A94E | Script.Malware.Projextor.B |
C21EB14BA63E943DB5EA9AB64AF02A50A17260C7D8538A133C4F6E0957D36F47 | Script.Malware.Projextor.% YWJ8N9 |
4ce5e5768d2f9f71e2835ab8ebc4a2191d436ca3a990a56e9bc264235c7b5b55 | Script.Malware.Projextor.B |
hxxps://doceditorinc[.]com | |
hxxps://conv.doceditorinc[.]com/latest/part | |
hxxps://meal-formula[.]com/ | |
hxxps://kitchen-canvas[.]com/ | |
hxxps://flipformatpdf[.]com/ | |
hxxps://pdfgrip[.]com/ |