Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T186155471BB1210339177EAD974A5BBDC59E3E21FE9C29588B1EC93458FC7C62BD02068 |
|
CONTENT
ssdeep
|
3072:6XWCJ9AT3Z9jg1Hi87ZrSghbZiQfAFy2xQ+BzgamRnwocr2DDrigBdD:6XlJ9UZ9jg1Hb3Ziwo36k3mwoa+D |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
857eaa7895956962 |
|
VISUAL
aHash
|
00013efe40007f7f |
|
VISUAL
dHash
|
037de67ed8d3c6c4 |
|
VISUAL
wHash
|
00173efe40407f7f |
|
VISUAL
colorHash
|
38200008040 |
|
VISUAL
cropResistant
|
868692d58ec421ab,8993eecdcdc9d8de,4f0c4c8c8e0a08aa,a0c5c85261a6d679,6b5b1b86c6879773,ccec9c8e0c2ccc49,037de67ed8d3c6c4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 11595 techniques to evade detection by security scanners and make reverse engineering more difficult.