Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1031375625859952B16268BD6F372FA8FF7418086C9D1444FE0EAE34C2BF2D72FA06315 |
|
CONTENT
ssdeep
|
768:haXDbsDLSgjL5xcr+8b5Xr3LLyKZdkLyeg0:oD46gXMrb7da9 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
fd5e9669e0617680 |
|
VISUAL
aHash
|
809c80c0e3e1ebff |
|
VISUAL
dHash
|
33342c0213131b2c |
|
VISUAL
wHash
|
809c80c0ebe1ebff |
|
VISUAL
colorHash
|
06e00000040 |
|
VISUAL
cropResistant
|
33342c0213131b2c,71a6ecd898f1e659 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 11 techniques to evade detection by security scanners and make reverse engineering more difficult.