Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10943FAB28442557B46A3F1D0B3361B6A73DAD289CA93474693F8C31D8FDBE21EC23611 |
|
CONTENT
ssdeep
|
1536:veeefeee6eee1eee7eeefeee8eee1eee6KRSp+:2KRSp+ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f00fb64528d08f6f |
|
VISUAL
aHash
|
00001858407ee6e7 |
|
VISUAL
dHash
|
949473929296949c |
|
VISUAL
wHash
|
0000385a5bfef7e7 |
|
VISUAL
colorHash
|
30401008400 |
|
VISUAL
cropResistant
|
f8fcfcfdcdcefcf8,f276707262acf8f8,9cdcbcd69c3cebc3,949473929296949c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 13 techniques to evade detection by security scanners and make reverse engineering more difficult.