Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CEF285B062585E3EA24343E4E325733E33959389CE9F521892FA437A1AC7CD8EC27585 |
|
CONTENT
ssdeep
|
384:qrAIjDunTvKr47jDunTvKGWsSc015G1GOBZwFs8pDwmOHp647KDayaHXxHOKWAHW:qdANHG1GOPwFswpOH847KDa/HBHlHYlF |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c3c33c3c39393d86 |
|
VISUAL
aHash
|
4074746c74240400 |
|
VISUAL
dHash
|
dcccccc8ccccd4d4 |
|
VISUAL
wHash
|
607c7e6e7e363c00 |
|
VISUAL
colorHash
|
38000038000 |
|
VISUAL
cropResistant
|
dcccccc8ccccd4d4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 6404 techniques to evade detection by security scanners and make reverse engineering more difficult.