Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16F7443674219692A4437C3D134699B7AD1A6DE9FFE930E004EDCCBF62AF9C60740B21D |
|
CONTENT
ssdeep
|
1536:zulN9Fc9DUgQmTa3MZo+Hd1+B0eIIOFgkCc9nd+Smfu4/ZT4oU5yG01G5I8SzGVR:QS5OQrjRfQz29Kna854Yni |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b09a39278e8c66cf |
|
VISUAL
aHash
|
ffe7ffdfc3c3c3c3 |
|
VISUAL
dHash
|
171e0e320e0e160e |
|
VISUAL
wHash
|
a1c3c7c3c3c3c3c3 |
|
VISUAL
colorHash
|
07007008000 |
|
VISUAL
cropResistant
|
171e0e320e0e160e,8280a2e2c2a280a2,a280a2c2c2a280a2,828082e2e2828082,82008272f2820082,0000104c4d4c3004,69e8b2e2a2b2b28e |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 31 techniques to evade detection by security scanners and make reverse engineering more difficult.