Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D9C2D6B0D052B43356B392D966B69B6B73E1C689DBA3030043FD836D97DEC81FD1A50A |
|
CONTENT
ssdeep
|
768:oZ66dlpIxVz4ajOEFLS3Rb5pwspd5VDpNa5BSPnIBDrp1:oZnuxVz4ajOEFLS3B5pwspd5VDpNa5BD |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
dc837601fc23fc89 |
|
VISUAL
aHash
|
003c3c18181880c0 |
|
VISUAL
dHash
|
f0e8f0b0b2320020 |
|
VISUAL
wHash
|
7e7e7e7e3c1800c0 |
|
VISUAL
colorHash
|
38c00018000 |
|
VISUAL
cropResistant
|
c09713705dde86a0,f0e8f0b0b2320020 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 187 techniques to evade detection by security scanners and make reverse engineering more difficult.