Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T125A31030A165952B01DFB2D6E13A071922F3D30EDA530BE9F7E883B98BCDD69D913158 |
|
CONTENT
ssdeep
|
384:9TroUa87MsJO5xVZjqTSHbxLHiz01Ox1HGRGYmaiz66rzo4ERgalR0YIzoK1RSCc:9AUf7MsIx/j9Hil66fXhhqOonXKQQ2F |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c502f53a94e647e6 |
|
VISUAL
aHash
|
000020000000ffff |
|
VISUAL
dHash
|
c4c9c4c09a048700 |
|
VISUAL
wHash
|
6e6478700200ffff |
|
VISUAL
colorHash
|
31000230040 |
|
VISUAL
cropResistant
|
0002002707000200,c4d8c8c4e08a848c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 72 techniques to evade detection by security scanners and make reverse engineering more difficult.