PDF_MALPHISH.AUSWV

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It steals certain information from the system and/or the user.

Arrival Details

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Information Theft

This Trojan steals the following information:

• Email address
• Password

Stolen Information

This Trojan sends the gathered information via HTTP POST to the following URL:

• http://testing.{BLOCKED}ldgroup.com/testpanoramic1/textures/Office-outlook/index.php
  Sends the gathered/stolen information using this data format:
  • login={email address}&password={password}

Other Details

This Trojan presents the user a fake message tricking them to click on the following link:

• The link can be found inside the PDF:

• 

• After clicking on the link, it will redirect to the following website to show a spoofed Office365 login page:
  http://testing.{BLOCKED}ldgroup.com/testpanoramic1/textures/Office-outlook/index.php
  

• However, as of this writing, the said site is inaccessible.