Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15B1353326A5C543E4AA38BD0F995B3343436B33CF116545EFFAC20260785BD1BA26DDA |
|
CONTENT
ssdeep
|
768:MAkvj5oXTOMdB6/rp/3SVCCNZ2UjGGvmNLx:MboXTOgB6F/3T |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
91652fb4a5c3f03c |
|
VISUAL
aHash
|
02006e6e4e4e0000 |
|
VISUAL
dHash
|
861098d89c886840 |
|
VISUAL
wHash
|
0300fe7efefe0e00 |
|
VISUAL
colorHash
|
380006000c0 |
|
VISUAL
cropResistant
|
861098d89c886840 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.