Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1AC63A532D26A1503A10FB4D8F1659B4A7753C786C6034FF562BC17E4AACECB86D2329D |
|
CONTENT
ssdeep
|
1536:60JQEEhufT1bdeu49jpDfx8P2dc4hVzlY/sV1UjEKo+5pRpp0xbQtdkepZACEFbp:60JQEEWx4NpD+yvl5U8KjpSifZDq |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c12e3e30d98bccab |
|
VISUAL
aHash
|
62027e7c40407c78 |
|
VISUAL
dHash
|
c2a6e0d89a8cc8d0 |
|
VISUAL
wHash
|
72027e7c42707e7c |
|
VISUAL
colorHash
|
03200038000 |
|
VISUAL
cropResistant
|
c2a6e0d89a8cc8d0,49d964f131272b2b,a639fe0d4983b283,8c39fe0d4983b283,6124646cc3c77473,4b4b7198d8d08c4d,3e92db4bd31a2b2b,8e39fe0d4993b2c1,47695d696b3121c6,8c39fe0d4983b2c1,0b2b312c30a8a0f1 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.