Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15364FAF5539861ED9507CBD4EB329920734F74BFBB52C68446AC8BA4E6578B8DC0EC80 |
|
CONTENT
ssdeep
|
3072:bShUDMXXJ2MmrzWm+keGy7xHd85nK2DZ5XiyFcG:W/J2r+keGy1c |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
99b560121b379737 |
|
VISUAL
aHash
|
00dbffff1c3c0000 |
|
VISUAL
dHash
|
94b24e7379f13933 |
|
VISUAL
wHash
|
00dbffff3d3c0010 |
|
VISUAL
colorHash
|
00200008006 |
|
VISUAL
cropResistant
|
6af8faa6ed69e464,9998a4aeab999a18,828aa22a4e8e9282,5555d15195381830,94b24e7379f13933 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 11241 techniques to evade detection by security scanners and make reverse engineering more difficult.