Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15A61AA7182A4AD7A07A7C2C06AB9A39F72D5CB4AEB43130947F8939C4FCEDD4DD15148 |
|
CONTENT
ssdeep
|
48:Tm9qmwdcXNjC8pqMT2NbktckJUuc+DhkrpU/qJxNRt09HMfWGwG1tuQ3:TmdKAjAMSKHUpm7/qJxzt090Wm1tuW |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d97c6670595c6670 |
|
VISUAL
aHash
|
00ffffffffffffff |
|
VISUAL
dHash
|
0000003232000000 |
|
VISUAL
wHash
|
000f0f1ff8f0f0f0 |
|
VISUAL
colorHash
|
07000e00000 |
|
VISUAL
cropResistant
|
0000003230000000,0000804040000000 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 493 techniques to evade detection by security scanners and make reverse engineering more difficult.