Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CB53BC73A2961803906BD1D5B160871E3391C789C7138B7663F917AAFFCDCB66B1229C |
|
CONTENT
ssdeep
|
1536:fVg390GoJUuoJ5loJJoJ1AoJzoR43fAmAezgenYeeee60JjrbVdIAoeTYJb5gt0a:q3uJU/JcJCJzJzFAmTnmJjrbVdIALOFg |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c12e71c19eb0792f |
|
VISUAL
aHash
|
0030307e3c6a686c |
|
VISUAL
dHash
|
e0e4e4f4d0d0d0d8 |
|
VISUAL
wHash
|
3c70307e3c6e6a6c |
|
VISUAL
colorHash
|
02000030000 |
|
VISUAL
cropResistant
|
64e7e2f4dadadada,e0e4e4f4d0d0d0d8,949836f815152d29,0101010101010100,d7697248cccc4c6c,ce6bd878696b3121,93c56931f1e1a0ac |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.