Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B8B2C811DA439538BF2F4AF7D054D837A314CC55BA0209B6EA6E3376F987B90CE67602 |
|
CONTENT
ssdeep
|
768:g43W6tW0mvWQWkm92ybV6bVtsIur3eTNmtbYL76XDUbgyDmUCOVaSbuGhUcq:P3W6KByR6wuNmtbYL76XDUbgyDmUCOV0 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a6669b9b9b386464 |
|
VISUAL
aHash
|
efc3c3c3ffffffff |
|
VISUAL
dHash
|
0c0e061d0a051d37 |
|
VISUAL
wHash
|
c7c3c3c38387870f |
|
VISUAL
colorHash
|
07602000000 |
|
VISUAL
cropResistant
|
0c0e061d0a051d37 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.