Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19CF2B632A1046A3F01A7C3C9B761F32EA2E29289DB4A090593FD835D4FE7DD1ED27519 |
|
CONTENT
ssdeep
|
768:8Ly5NJlchn3RXDVHLVrYKZiEIIIIIIIIIwYP72IIMltSlRwIIVGJIbZP7sOy2+yv:Bwn3RzVHNiEIIIIIIIIIwYP72IIMlQRs |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c363f818bc6d86c5 |
|
VISUAL
aHash
|
000020000000ffff |
|
VISUAL
dHash
|
1449cbc3d0ece000 |
|
VISUAL
wHash
|
00e57100383cffff |
|
VISUAL
colorHash
|
31e00008000 |
|
VISUAL
cropResistant
|
e000a00458988000,d449cbc3d3d0cce0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.