Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18B34EA60D439997A00934AD670742F787664A384C6534E81E7F4232E4BE9DDBEF0F62E |
|
CONTENT
ssdeep
|
6144:DdukcGW1c+Bo9YqGyiXbttfwel0KT5FMLMSx5CesW+fGhkuT7bkMzo2XUX:D9UX |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
da53bea4c169b0ac |
|
VISUAL
aHash
|
3c1c0800ffffd3ff |
|
VISUAL
dHash
|
f87838d8e02b2323 |
|
VISUAL
wHash
|
1c180800fcffc3ff |
|
VISUAL
colorHash
|
0ec00018000 |
|
VISUAL
cropResistant
|
f8f87879b8d8c8f0,f0e0083b2b232b27,f8f879b9b0d8d8f0,2a391949eae433b1,4ccea331d1712183 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 67 techniques to evade detection by security scanners and make reverse engineering more difficult.