Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12815D850F2A22933312F42D1E46D77096193F76AC6410BC2E7F047786BFBCB9781A699 |
|
CONTENT
ssdeep
|
12288:DP2ASihfqLBxPEPlPsIzIDb0PC0d70ohy0o9lomWYd:DnhfqLo8lzWO |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a834d74b55352b6a |
|
VISUAL
aHash
|
00ff030301bbffff |
|
VISUAL
dHash
|
52a5af96975b8049 |
|
VISUAL
wHash
|
00ff01030199ffff |
|
VISUAL
colorHash
|
06003008080 |
|
VISUAL
cropResistant
|
8000c082a2820082,b4ad96975353c04d,4141808280c22520,d9c3d29aadb8a926,c2c4e470cce1eeda,171b09151f278cd8,aa2a248080809093 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2719 techniques to evade detection by security scanners and make reverse engineering more difficult.