Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T140138333935749125166E5C8F1A25B1E2282878DCB030FA173FC97BD6FCECB57A52298 |
|
CONTENT
ssdeep
|
768:RkIRn98cS9iqL6RGNV+b3Al6IEqDMzMXlxtp6Hxe51+mTtWt2+zPtzMVO+eHS99v:Rt9BC/+bQl6IQwXWC1+mBQ2+LtgVO+e2 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c234338e9b3c3979 |
|
VISUAL
aHash
|
3c74403c3c3c7c2c |
|
VISUAL
dHash
|
eccc96d4f0f0f0d8 |
|
VISUAL
wHash
|
3c34427c3c7e7c2c |
|
VISUAL
colorHash
|
03000038000 |
|
VISUAL
cropResistant
|
d88c34e0d4d4f090,4a4ab4b6c64ad5d3,c8c8b5b53db696b5,4a4a92964a4ad5da,4a4ab4b6844ad5d3,4a4a94964a4ad5db,4a4ab2b44a4ad5d2,eccc96d4f0f0f0d8,6960e664e4654645,69606664e4654645,6960e664e4654645,69606664e4654645,6969e66564646546 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.