Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10673E1F0124015EE0AD2F6D496A2BE076176C9E2E21F6EDA51F8954D1EC2FE5CCC13E8 |
|
CONTENT
ssdeep
|
1536:62DcVXArgpkfZFY41QTh2eEkYxp8IkI9exri2Ps/yP4bsIT:62Rbx6E1s+ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
edb616c949c99287 |
|
VISUAL
aHash
|
ffe7ffd9f1f10000 |
|
VISUAL
dHash
|
2b2f2b33331353d4 |
|
VISUAL
wHash
|
ffc3ffd1f1c10000 |
|
VISUAL
colorHash
|
0ee00000000 |
|
VISUAL
cropResistant
|
2b2f2f3333132353,4a5adacbc158584a,82808e9e968282a2,0000000000000000,49d4f5f0e8dc8473,1b6cdbd032ece402 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 31 techniques to evade detection by security scanners and make reverse engineering more difficult.