Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14BC3DA3BF574472F810E83C8E9A26639979C21DEA5824FC4731D07F5A51DCAABEB2142 |
|
CONTENT
ssdeep
|
768:XK5gP4WjCw3phUdGhMsPQh28cvIgEUYSBbqhOTSR7M2kgAX0YAo6sl:FP/+w0GhMsPQo8r6BWhWkgKAki6sl |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
96953c69e26b3989 |
|
VISUAL
aHash
|
263e1e6e7e000404 |
|
VISUAL
dHash
|
ccfcfcccccaacccc |
|
VISUAL
wHash
|
267e3e7e7e264404 |
|
VISUAL
colorHash
|
38206000000 |
|
VISUAL
cropResistant
|
3b568692a3b39391,d8d2c6e9fefefefc,d1e1c8a526669c8d,ccfcfcccccaacccc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 5 techniques to evade detection by security scanners and make reverse engineering more difficult.