Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CC53E9E93894A456076290D3B0BF3A4AF739182F791C55A1B0B0CBE571B84F5506BF4F |
|
CONTENT
ssdeep
|
768:GyWuWuP/Wy/sH9X5DCKN/uZv11LlRjwqFo88n+LLqSz50U5uBz6jzSfxIUcoFFve:/TVQnyOloQzZs8oWQbp |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e466339b99cc889b |
|
VISUAL
aHash
|
c3c3c3d3c3cbcbc3 |
|
VISUAL
dHash
|
9686969696969696 |
|
VISUAL
wHash
|
c3c3c3d3c3c3c3c2 |
|
VISUAL
colorHash
|
0e000e00000 |
|
VISUAL
cropResistant
|
9686969696969696,36332321212121a1,7377751d18181898,7873597202050180,824060607a7a7860,c0c4c2e2f4d8d4d4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 472 techniques to evade detection by security scanners and make reverse engineering more difficult.