Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C8850A51F1A12832312F82E5E07837056193F76ADB420BC2E7F44BB95BF7C6A781A19D |
|
CONTENT
ssdeep
|
12288:0/izO5phfqvjaVGEGEwEQEiP8+NPVP9+7B2K17HYp7o4KIqvjSrarl8cgrTW9NSe:0azuhfqvmBJHwr2IW |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
820b75f56e4a19b9 |
|
VISUAL
aHash
|
007f1800ffffffff |
|
VISUAL
dHash
|
12e5f9e9cf704dc0 |
|
VISUAL
wHash
|
003f0000ffff81ff |
|
VISUAL
colorHash
|
07003008200 |
|
VISUAL
cropResistant
|
8000c082a2820082,e5f9e9ed80698dc0,4141808280c22120,013cead9b9fb752b,a0d353b273521636,64640406d657d3db |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2749 techniques to evade detection by security scanners and make reverse engineering more difficult.