Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1581242B1D2165C3B535BD5F260A90B2B39F84745DA87162663FD035C6FCACA1EF02392 |
|
CONTENT
ssdeep
|
192:lfJP+1jdCzukqqfqhW50Eer88h9VQ/g7vLP+5i3cf4x4JWfGwW/bLHnFCsyDsaIL:HPAjdCzukqPhi0Eer88h9Vkyj+5i3cfr |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cccd33372672b988 |
|
VISUAL
aHash
|
90187838180e0401 |
|
VISUAL
dHash
|
69b2b2a0a0383c0d |
|
VISUAL
wHash
|
ff78f8781e1e0601 |
|
VISUAL
colorHash
|
38000000086 |
|
VISUAL
cropResistant
|
69b2b2a0a0383c0d |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.