Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11E535422D362251394B7D1C5F1625B4B26938389C6070BF0B7FC67BEE9CECB52912399 |
|
CONTENT
ssdeep
|
1536:I7et7reOAVeOAAefneeUDeeIeVeee4eOeGeqeebvMeReKUWeBSU/eeeDx1eeeeeY:FSqR0IxqRtwPIhiZZ4mq |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e93c34c9939396cc |
|
VISUAL
aHash
|
c181c3edf9f9f9e1 |
|
VISUAL
dHash
|
2b23a6dbabcbb38b |
|
VISUAL
wHash
|
818181e9f9f9f9c1 |
|
VISUAL
colorHash
|
07000030000 |
|
VISUAL
cropResistant
|
2b23a6dbabcbb38b,999964f131272b2b |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.