Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E1D2A6735118587F317BC7D8F928BF85B09B560ACB4A4AC0F2E982AD97C0F166E71349 |
|
CONTENT
ssdeep
|
384:jVjvMsy9BRTgyKnaHdbAxBvlfGgBiW3GBd2dD9rLyhdSSoZb:1/uRTgEHdktZBiWWBd284 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
993b339899333399 |
|
VISUAL
aHash
|
0818181818181800 |
|
VISUAL
dHash
|
323232b2b2b2b068 |
|
VISUAL
wHash
|
1c3c181c3c3c3cff |
|
VISUAL
colorHash
|
38200018000 |
|
VISUAL
cropResistant
|
d2cb23234c4c0d9c,323232b2b2b2b068 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 935 techniques to evade detection by security scanners and make reverse engineering more difficult.