Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T168C32225C6E41333D205078AE7EB7756669BC1C7CCA2B8F8A1708178D7B9C891C77DA2 |
|
CONTENT
ssdeep
|
3072:lBKJrjylK2E6IOZuagKI3ImJS20gIYLQICeIkPksuGIyIhuBnvl6s:/KNQ5IZf3NR6s |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ed1695b24ab1562d |
|
VISUAL
aHash
|
fff1000000f1fbf8 |
|
VISUAL
dHash
|
4b22622365631212 |
|
VISUAL
wHash
|
fff0200000f1fbfb |
|
VISUAL
colorHash
|
06c08000000 |
|
VISUAL
cropResistant
|
0b22632365a31212,0020d0d0c0d02040,9696969311531b59,8202020606060606,ae8c44113b6a9a4c,9f8d8d8c8f233265 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 10 techniques to evade detection by security scanners and make reverse engineering more difficult.