Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CE23132483241D3F662642FCF36F3625357A41D9861E7244585B5B3EA108E8FFC3B6BA |
|
CONTENT
ssdeep
|
384:u3ygI2IkAZuZ33I9mTm2uJBnqlxU+nBTfktaAQBZ1Y3HIIa:u3Yl3ZUnKmJlvktb53oIa |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
999672787493c5c6 |
|
VISUAL
aHash
|
46087e1e3c180000 |
|
VISUAL
dHash
|
dc32f0f0b2b2a800 |
|
VISUAL
wHash
|
461f7f1fff181800 |
|
VISUAL
colorHash
|
38400000180 |
|
VISUAL
cropResistant
|
dc32f0f0b2b2a800 |
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.