From Google Ads to a Suspicious EXE: Investigating a PDF Download Campaign

1. Executive Summary

A PDF-themed advertisement reported on a French travel article led to a download associated with two unfamiliar domains and a Windows executable. The observation, dated 13 October 2026, was supplied to News4Cyber for investigation. The reported route passed through Google's advertising click infrastructure before reaching pdf-nexus[.]com and an executable endpoint on source-moonlig[.]com.

The central concern is the transition from a PDF-related offer to an EXE, accompanied by preliminary binary observations that warrant scrutiny. That mismatch is a lead, not a malware diagnosis: a PDF viewer can legitimately use a Windows installer. This report preserves the reported indicators, checks available public metadata and outlines reproducible SOC hunts without attributing an actor or malware family.

2. Discovery and Initial Context

The report identifies Top 13 des plus belles randonnées à faire dans les Pyrénées on www.petitfute.com as the page hosting the advertisement. The publisher's currently indexed title includes “en 2026”. We verified the referenced article's existence, not the advertisement's appearance to a particular visitor on 13 October. Advertising varies with time, location, browser context and targeting; a later visit would not reproduce the original event by itself. Petit Futé: the referenced hiking article.

Petit Futé is the legitimate publishing context, not a campaign IOC. A third-party advertisement does not establish that the publisher's site was compromised. No original screenshot, HAR, response headers or binary was supplied to the editorial workspace; these missing artifacts constrain all campaign-specific conclusions.

For background on deceptive acquisition paths, see News4Cyber's existing Phishing Techniques article. The mechanism under review here is advertising-led delivery, not a demonstrated email phishing incident.

3. Reconstructing the Redirect Chain

No response codes, HTTP schemes, exact redirect URLs or individual click tokens were provided. The diagram therefore deliberately avoids inventing 301/302 responses or connecting the download to a verified byte stream. Domains are neutralized and no suspicious endpoint is clickable.

4. Advertising Infrastructure

Google's own documentation identifies adclick.g.doubleclick.net in advertising click strings. That independently establishes its legitimate infrastructure role, not the provenance of this particular campaign. Google Ad Manager and Campaign Manager click handling can be present in different ad-delivery arrangements; this host alone does not establish the exact Google Ads account or buying platform. Google Ad Manager: finding an ad click string.

These identifiers were supplied as values observed in the advertising chain. They can help a platform investigate an abuse report, but do not prove advertiser identity, account ownership or authorization. Individual click identifiers, transient tokens and unnecessary tracking parameters have been excluded.

Blocking Google click infrastructure or the travel publisher would create substantial collateral damage. Any defensive action should focus on the two reported suspicious domains and sample identifier, with scope and expiry reviewed by an analyst.

5. Suspicious Domain Analysis

pdf-nexus[.]com is the reported intermediate domain; source-moonlig[.]com is the reported distribution host. Their appearance in the supplied sequence is the basis for investigation. Registry dates and nameservers were checked as described below. Registrant identity, historical ownership, hosting relationships, certificate history and common control were not verified. A software-themed label is not an attribution signal.

Registry context: independently checked at 21:14 UTC

The distribution domain's registry registration event is approximately one week before the reported observation date. This is contextual information, not proof of maliciousness or of the campaign's start. The domains list different nameserver pairs at a widely used DNS provider; this establishes neither shared ownership nor a common origin server. A current registry record does not reconstruct every historical ownership change. Sources: Verisign .com registry: pdf-nexus[.]com RDAP record and Verisign .com registry: source-moonlig[.]com RDAP record.

Read-only public checks: 13 October 2026, approximately 21:00 UTC

The dates above are scan-record timestamps, not domain creation dates or the beginning of this campaign. These checks searched existing information only: we submitted neither a URL for scanning nor a binary. Search absence and missing access cannot establish safety. Sources: urlscan.io: existing records for pdf-nexus[.]com, urlscan.io: existing scan search and API documentation, OTX: domain metadata for pdf-nexus[.]com, OTX: domain metadata for source-moonlig[.]com and OTX: metadata for the supplied SHA-256.

6. Payload Identification

The reported local filename is PDFConvertSetup_83179.exe. The supplied SHA-256 is:

b280a0ac0810698e57425d86141fac8985d92aa424b755f2c4010be2027d3ec9

A cryptographic hash is a strong identifier only once calculated over the actual bytes. Here it is a supplied identifier, not a freshly computed digest. File length, SHA-1/MD5, Authenticode signer, certificate chain and signing time are unknown. No binary was executed, downloaded from the reported endpoint, uploaded to Ghost or submitted to a sandbox.

The requested resource ends in PDFDailyViewer.exe, whereas the reported local file has a different name. HTTP download headers could legitimately supply that filename, but without the original response or identical hashes this linkage cannot be independently asserted. Filename-only alerts are weak signals and should be corroborated with hash and origin telemetry.

7. Preliminary Static Analysis

The PE structure and manifest semantics provide a way to interpret the report, but are not substitutes for inspecting this file. See Microsoft: PE and COFF format and Microsoft: application manifests. Obfuscation, encoded resources and embedded payloads cannot be determined from the supplied entropy value alone.

References needing context, not behavior verdicts

• VirtualAlloc: a memory-allocation API. A real P/Invoke declaration, call site and cross-process execution evidence would need inspection. Its name alone does not establish injection. Microsoft: VirtualAlloc.
• HttpClient: a managed HTTP client class. No embedded destination, request or C2 exchange has been verified.
• RegistryKey: registry access support. A specific key, value, write operation and purpose are required before claiming persistence.
• ProcessStartInfo: process-launch configuration. Arguments, target executable and an executed call path are needed to characterize behavior.

All four names were previously reported. Their presence, origin and usage remain unverified: they may be strings, managed metadata, native imports, bundled-library references or reachable code. The next analysis should map metadata tokens and P/Invoke entries to IL call sites, inspect resources and recursively identify embedded objects without executing them. A separate isolated Windows lab would be required for any approved dynamic analysis.

8. MITRE ATT&CK Mapping

These are investigation candidates, not a list of observed adversary behaviors. ATT&CK labels should be promoted only when supporting artifacts exist.

9. Indicators of Compromise

Documented investigation indicators; inclusion does not certify maliciousness. The two legitimate infrastructure hosts are deliberately excluded. Values are neutralized for reading. Copy raw restores the original indicator to your clipboard for authorized tooling; it never opens a destination. Domain/path schemes were not supplied and are not invented.

Exports contain only these documented indicators, neutralized where relevant, with provenance and confidence. They are not a feed of confirmed malicious infrastructure. Without JavaScript, select an indicator manually or use the static export text below.

type,indicator,role,confidence,evidence
Domain,pdf-nexus[.]com,Reported intermediate landing domain,Reported association; maliciousness unconfirmed,Investigation brief supplied to News4Cyber
Domain,source-moonlig[.]com,Reported executable distribution host,Reported association; maliciousness unconfirmed,Investigation brief supplied to News4Cyber
Host/path,pdf-nexus[.]com/nexus/download,Reported landing/download path; scheme not supplied,Reported; not independently replayed,Investigation brief supplied to News4Cyber
Host/path,source-moonlig[.]com/PDFDailyViewer[.]exe,Reported executable endpoint; scheme not supplied,Reported; bytes not retrieved,Investigation brief supplied to News4Cyber
Filename,PDFDailyViewer.exe,"Endpoint basename, not a verified local sample name",Low specificity; filename only,Investigation brief supplied to News4Cyber
Filename,PDFConvertSetup_83179.exe,Reported downloaded sample filename,Low specificity; identity unverified,Investigation brief supplied to News4Cyber
SHA-256,b280a0ac0810698e57425d86141fac8985d92aa424b755f2c4010be2027d3ec9,Supplied sample identifier,Limited: supplied hash; not independently recomputed,Investigation brief supplied to News4Cyber

[
  {
    "type": "Domain",
    "indicator": "pdf-nexus[.]com",
    "role": "Reported intermediate landing domain",
    "confidence": "Reported association; maliciousness unconfirmed",
    "evidence": "Investigation brief supplied to News4Cyber"
  },
  {
    "type": "Domain",
    "indicator": "source-moonlig[.]com",
    "role": "Reported executable distribution host",
    "confidence": "Reported association; maliciousness unconfirmed",
    "evidence": "Investigation brief supplied to News4Cyber"
  },
  {
    "type": "Host/path",
    "indicator": "pdf-nexus[.]com/nexus/download",
    "role": "Reported landing/download path; scheme not supplied",
    "confidence": "Reported; not independently replayed",
    "evidence": "Investigation brief supplied to News4Cyber"
  },
  {
    "type": "Host/path",
    "indicator": "source-moonlig[.]com/PDFDailyViewer[.]exe",
    "role": "Reported executable endpoint; scheme not supplied",
    "confidence": "Reported; bytes not retrieved",
    "evidence": "Investigation brief supplied to News4Cyber"
  },
  {
    "type": "Filename",
    "indicator": "PDFDailyViewer.exe",
    "role": "Endpoint basename, not a verified local sample name",
    "confidence": "Low specificity; filename only",
    "evidence": "Investigation brief supplied to News4Cyber"
  },
  {
    "type": "Filename",
    "indicator": "PDFConvertSetup_83179.exe",
    "role": "Reported downloaded sample filename",
    "confidence": "Low specificity; identity unverified",
    "evidence": "Investigation brief supplied to News4Cyber"
  },
  {
    "type": "SHA-256",
    "indicator": "b280a0ac0810698e57425d86141fac8985d92aa424b755f2c4010be2027d3ec9",
    "role": "Supplied sample identifier",
    "confidence": "Limited: supplied hash; not independently recomputed",
    "evidence": "Investigation brief supplied to News4Cyber"
  }
]

10. Detection and Hunting

Use the reported domains and hash to identify exposure, then correlate browser, DNS/proxy and endpoint telemetry by asset, user and time. A DNS hit is not a download; a download is not execution; execution is not proof of a particular malware behavior. Preserve the original event records and validate the file's identity before assigning incident severity.

The following SPL searches use standard Splunk syntax and example index names. They have not been executed against a Splunk deployment. Adapt extraction, timestamps, indexes and field mappings before operational use; empty results may reflect missing telemetry. Splunk: comparison and conditional evaluation functions.

index=dns earliest=-7d
| eval queried=lower(replace(coalesce(query,query_name,QueryName),"[.]$",""))
| where match(queried,"(^|[.])(pdf-nexus[.]com|source-moonlig[.]com)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(queried) as domains by src
| convert ctime(first_seen) ctime(last_seen)

index=proxy earliest=-7d
| eval observed_url=coalesce(url,uri,request_url)
| rex field=observed_url "(?i)^(?:https?://)?(?<parsed_host>[^/:?#]+)"
| eval ioc_host=lower(coalesce(dest_host,url_domain,parsed_host))
| where in(ioc_host,"pdf-nexus.com","source-moonlig.com")
| stats count min(_time) as first_seen max(_time) as last_seen values(observed_url) as requested_urls by src ioc_host
| convert ctime(first_seen) ctime(last_seen)

index=endpoint earliest=-7d
| rex field=Hashes "(?i)(?:^|,)SHA256=(?<sysmon_sha256>[a-f0-9]{64})(?:,|$)"
| eval observed_sha256=lower(coalesce(SHA256,sha256,sysmon_sha256))
| where observed_sha256="b280a0ac0810698e57425d86141fac8985d92aa424b755f2c4010be2027d3ec9"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as images values(TargetFilename) as files by host
| convert ctime(first_seen) ctime(last_seen)

Triage actions

1. Review scoped domain matches, recording the actual URL, response and originating process where available. Preserve click identifiers privately; redact them in shared reports.
2. Obtain endpoint file telemetry and recompute the supplied hash in an authorized offline analysis environment. Verify Authenticode, Mark-of-the-Web and whether the file was launched.
3. If execution is established, collect child processes, subsequent downloads and registry writes. Do not infer persistence from a class name or injection from an allocation API.
4. Consider time-bounded domain blocking pending review, subject to business impact. Avoid blocklisting Google advertising infrastructure or Petit Futé.
5. Report the specific ad to the publisher and advertising platform with campaign-level identifiers and private supporting captures through their approved channels.

11. Limitations and Unanswered Questions

• No original HAR, ad screenshot or sample bytes: the observed campaign sequence, hash and static properties cannot be independently reproduced.
• No live suspicious-site requests or sample execution; no Authenticode check, extracted strings, imports, resources, embedded URLs or payload analysis completed.
• Current registry registration events and nameservers were verified; historical WHOIS/registrant changes, passive DNS, certificate linkage, infrastructure ownership and actor attribution remain unverified.
• Public reputation visibility is incomplete and time-dependent. Zero pulses/search results do not exclude malicious activity or private records.
• No evidence establishes exploit-based entry, user execution, process injection, persistence, C2, data theft or a malware family.

The priority next artifacts are a timestamped redacted HAR, screenshot of the ad, original download response and the preserved sample from an authorized path. Hash matching, provenance and static call-path analysis should precede a stronger verdict. Any dynamic execution or third-party sample submission requires separate authorization and a dedicated laboratory.

12. Conclusion

The supplied observation describes a plausible advertising-led PDF download funnel ending in a Windows executable. Public references corroborate the publisher page and the legitimate role of Google's click infrastructure; read-only lookups confirm limited indexed information about the intermediate domain and registry registration events for both domains. They do not corroborate the complete redirect chain or establish that the file is malware.

The filename change, future timestamp and high reported entropy are useful investigative leads. They remain reported observations until the original artifacts can be inspected. News4Cyber's current position is therefore a preliminary suspected malvertising investigation, with actionable hunting indicators and explicit evidence gaps, rather than a claim of a confirmed infection or compromise of Google or Petit Futé.

13. References

Primary technical documentation and public metadata checked on 13 October 2026. The original investigator's supplied brief is the source for campaign identifiers, redirect order and sample-specific properties; it is not an independently verified forensic artifact. No private click tokens are included.

1. Petit Futé: the referenced hiking article
2. Google Ad Manager: finding an ad click string
3. Verisign .com registry: pdf-nexus[.]com RDAP record
4. Verisign .com registry: source-moonlig[.]com RDAP record
5. Microsoft: PE and COFF format
6. Microsoft: application manifests
7. Microsoft: VirtualAlloc
8. MITRE ATT&CK: T1189
9. MITRE ATT&CK: T1204.002
10. MITRE ATT&CK: T1105
11. MITRE ATT&CK: T1055
12. urlscan.io: existing scan search and API documentation
13. urlscan.io: existing records for pdf-nexus[.]com
14. OTX: domain metadata for pdf-nexus[.]com
15. OTX: domain metadata for source-moonlig[.]com
16. OTX: metadata for the supplied SHA-256
17. Splunk: comparison and conditional evaluation functions
18. VirusTotal: retrieving an existing file report
19. URLhaus: community API
20. ThreatFox: community API

Revision policy: update the evidence labels and last-review date when new artifacts are verified. Ghost manages publication dates, canonical URLs and Article metadata natively; the draft has no publication timestamp.