Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T118D35421C6A40333D205078AE7EB7756679BC1C7CDA2B8F8A1708174DBB9D891C77DA2 |
|
CONTENT
ssdeep
|
3072:o3KJrjylK2E6IOZuagKI3ImJS20gIYLQICeIkPksuGIyIhuBnvRAZGy:yKNQ5IZf3N1AAy |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ed16b5924a934c67 |
|
VISUAL
aHash
|
fff1000000f1fbfb |
|
VISUAL
dHash
|
0b2262c3e5231293 |
|
VISUAL
wHash
|
fff0200000f1fbfb |
|
VISUAL
colorHash
|
06c08000000 |
|
VISUAL
cropResistant
|
2b6263c3e5231293,0020d0d0d0d02040,9696969311531b59,8202020606060606,ae8c44113b6a9a4c,4155496915954551,9f8d8d8c8f233265 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 18 techniques to evade detection by security scanners and make reverse engineering more difficult.