Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T162F3B4A1B293923552CB85A1D2793F6BE2D8C940CB22C9F4D2F6C31D7BE9D128D5274C |
|
CONTENT
ssdeep
|
1536:mYPLXsuJIsHXOeF+n+ZR/RlUkvwzNLuGd9h45WiI+2Y:mYPLXseIsHXOm+n+ZR/R6kvwT9std |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9740bfc8bbc0fac0 |
|
VISUAL
aHash
|
ff000000ffffff9f |
|
VISUAL
dHash
|
dee4ec3a7a01817f |
|
VISUAL
wHash
|
ff0000000bffff8f |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
dee4ec3a7a01817f,5b3ae6e7b5b5253d,404c0dcd67666671,1c59511135396149 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.