Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T152D29631B100363B42C7D3C8B762A32EE2A3424AEA570916E5F983DD4BE7D54DE27617 |
|
CONTENT
ssdeep
|
768:RScy5NLP5D0P/OBrD/SdDj7sOy2+y9BH4cLIe:Mp0wSdX7sOy2+UBH4cLIe |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c766b43a9928d6c3 |
|
VISUAL
aHash
|
000020000000ffff |
|
VISUAL
dHash
|
1cccc6c2c8cdd300 |
|
VISUAL
wHash
|
00f7f2302004ffff |
|
VISUAL
colorHash
|
31000600030 |
|
VISUAL
cropResistant
|
008080024c888000,9c8ccec2c0c8cde1 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.