Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13A9330303A076826606F51DF921B170DA1C1D7CAE2636AE4B3F4932DCFB5E50BFA6254 |
|
CONTENT
ssdeep
|
768:MiE4JhBqtO+3M/kNw44YLE9kWb4FaUjoMyJF:5E4JYO+le44YLE9kWbwoMyJF |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e161b42adece199c |
|
VISUAL
aHash
|
000000000000ffff |
|
VISUAL
dHash
|
b186d243bbdb4e20 |
|
VISUAL
wHash
|
d9000020c9ebffff |
|
VISUAL
colorHash
|
0fc00000000 |
|
VISUAL
cropResistant
|
0105253736620000,28a8000020023232,d09696d103bbdb4f |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 107 techniques to evade detection by security scanners and make reverse engineering more difficult.