Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1BB22A431B018292F1943C6F9B6F25EE1F6A3D721DA420B24E1FC836E5ED7DB1D822056 |
|
CONTENT
ssdeep
|
96:TFKyxiDd0NP990H1uNaqU4yDITJJsnFZ5IYeNXdw9mT7Goy0zxaEofn12SV60TDB:5KyQo9k4/lBdw9mfeCjS3 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f5ed5b9776098900 |
|
VISUAL
aHash
|
8ffbfbf2c63e0800 |
|
VISUAL
dHash
|
5a46b2262c683044 |
|
VISUAL
wHash
|
abfa7fe2e62e0800 |
|
VISUAL
colorHash
|
39c00008000 |
|
VISUAL
cropResistant
|
5a46b2262c683044 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.