Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E8539973A2961803906BD1D9F260471E3341C785CB138B7567F917AABFCDCB66B1229C |
|
CONTENT
ssdeep
|
1536:BM33KrXj6oJUeoJdzoJ86HoJByoJz6Dw3fAmAezgenYeeee60JnebVhIAoeTyJ2q:C3KrXj7JUvJqJSJpJz6DKAmTnmJnebV4 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c31643d1cdb8b969 |
|
VISUAL
aHash
|
3c30347e7beb6978 |
|
VISUAL
dHash
|
e8e0e5e4d2d3d3d2 |
|
VISUAL
wHash
|
3830343c7be97978 |
|
VISUAL
colorHash
|
09000030000 |
|
VISUAL
cropResistant
|
94a2a2e42651c2c0,e5b566d1d3d1d3d2,8092c9d4e66c3132,449298c4d26c71b2,33e8caaaaea39298,f8879187b2a39488,049291c8c66c3132,249291ccd26c71b2,0101010269969e96,68e0e8e8e46464ad,86eced662cce2ea9,6de2e234766cece2,d7697048cccc446c,4e6b5868696b3121,96416931f1e1a0ac |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.