PDF_MALPHISH.AUSJEQH

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It steals certain information from the system and/or the user.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Information Theft

This Trojan steals the following information:

• Email Address
• Password

Other Details

This Trojan does not exploit any vulnerability.

NOTES:
This Trojan presents the user a fake message tricking them to click on the following link:

https://{BLOCKED}invscanelolivestream.com/security/drive17/drive/index.php

After clicking on the link, it shows a spoofed OneDrive page:

Choosing an email provider from the spoofed page will display the following fake login windows:

For Office:



For Outlook:



For Outlook Web App:

This Trojan sends the gathered information to the following URL:

https://{BLOCKED}invscanelolivestream.com/security/drive17/drive/padding.php

After entering the login information, it will display a document to trick the user that they have successfully accessed the document.