Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19EC30AF19208B47D260317DCB262B69DA0DF725FCF310D84B2BCA176A381DED6476989 |
|
CONTENT
ssdeep
|
768:uEdBt+GGsTqO7kYX+YXkYXoYXzYXGYX7YXrYX1YXOYXgYX9YXjYXUYXlYXOYXPYg:uuBkqqqGCV9mVieTfKzAyt6 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ed934d2992cf3823 |
|
VISUAL
aHash
|
ffffe7ffc3c3b312 |
|
VISUAL
dHash
|
230e0e4d96963676 |
|
VISUAL
wHash
|
ffffc3e7c3810000 |
|
VISUAL
colorHash
|
07006600000 |
|
VISUAL
cropResistant
|
230e0e4d96963676,1f66510163467c7c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 39 techniques to evade detection by security scanners and make reverse engineering more difficult.