Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D9B2ADF1C2A2F9B7003380F6A99A0F6772F2878DC986060592FC53B947EDC65FD1A516 |
|
CONTENT
ssdeep
|
384:x2mXojN1gpJai9D37zhvEBUqkRiLi7Q4ZuudVboCCyhi4U8PGRsQjFS2IYByFFBn:47W9FJH |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8cdc25656198dee6 |
|
VISUAL
aHash
|
13023c3c3038093f |
|
VISUAL
dHash
|
321668716060d1c5 |
|
VISUAL
wHash
|
931a3c3c38183d7f |
|
VISUAL
colorHash
|
30001200600 |
|
VISUAL
cropResistant
|
2525cf1495e9ed69,321668716060d1c5 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 1 techniques to evade detection by security scanners and make reverse engineering more difficult.