Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12342D862160069553A13C364B5A6F76CF192B05BC71FE990F3C8124B50CBEB3CEAE365 |
|
CONTENT
ssdeep
|
192:/mjKk1UryGxCB9kKhk6wyCp6MwH8JBTpoQKLTn0p:oKGUryCCBxVopbwH8JBTpF+O |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a26a822baebabb0b |
|
VISUAL
aHash
|
006000c00f0f1f3f |
|
VISUAL
dHash
|
4980112c1efefefe |
|
VISUAL
wHash
|
01e000ef0f1f3f3f |
|
VISUAL
colorHash
|
16c00600000 |
|
VISUAL
cropResistant
|
4980112c1efefefe |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 196 techniques to evade detection by security scanners and make reverse engineering more difficult.