Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C4B3C8B1D6B01A25D653835983203B7940BBB1DC9F270514CA2C47E9BB99DADEC3B3D8 |
|
CONTENT
ssdeep
|
384:kJN83GygNkp/T1Q4TjUQyoXjruglZnJRjdcAkHnzbPb6afZQdDtDu7gGWVUjzgTz:ENbyEkzBggt+pgtD2gvhpCSsQkfnhofJ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ee6a95914e939166 |
|
VISUAL
aHash
|
ff91b0b0f0ffffbf |
|
VISUAL
dHash
|
4161656165006d6d |
|
VISUAL
wHash
|
bc000090f0ffe7bf |
|
VISUAL
colorHash
|
06201008040 |
|
VISUAL
cropResistant
|
4161656165006d6d,7251966465e9f0d2,d2c084ccc6c458f0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 75 techniques to evade detection by security scanners and make reverse engineering more difficult.