Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D48331E897B5B12F53BA71CFFA021D56E4C680BE811F1C63FB5C941E2EC3A5A96D1408 |
|
CONTENT
ssdeep
|
768:DQ9m4IGKKbNZSJhNewtBJOicqNXXXrJBv9SkrMs9ckVMWCQyYUwSF:09m4IGDbHgrVt22bIkrFeSSF |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bc3c2dc3c3729269 |
|
VISUAL
aHash
|
938381c7ffffc3c3 |
|
VISUAL
dHash
|
32333b2b16280717 |
|
VISUAL
wHash
|
93818181cfff81db |
|
VISUAL
colorHash
|
072c0000080 |
|
VISUAL
cropResistant
|
32333b2b16280717,fbffffbffff75e4d,19dddf0b23948d4d,0000243232100810 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 40 techniques to evade detection by security scanners and make reverse engineering more difficult.