Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15D332070A153097F9A87E1C9BB655F4AE2C68207C7120E49B3F6835F9FC2D60FC89661 |
|
CONTENT
ssdeep
|
1536:4IIIUP7xAnz+eeecnJeeecw+eeecnJeeecW+eeecnJeeecpSk:+A/k |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8847783e3986c757 |
|
VISUAL
aHash
|
0000783001ffdfdf |
|
VISUAL
dHash
|
afc1c4e2ab253512 |
|
VISUAL
wHash
|
0020783803ffdfdf |
|
VISUAL
colorHash
|
0ae80000000 |
|
VISUAL
cropResistant
|
6998818189888969,c0c048cee1381e07,5aa1b53534141213,ecbfc1c4c4c0ebbb,949a0d4e47434543 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 100 techniques to evade detection by security scanners and make reverse engineering more difficult.