Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14BB3B7714180293B55834380ABB0F75EE3928187DE370A4A5EE0DB4F9FEBF95CD521A9 |
|
CONTENT
ssdeep
|
3072:AFjZtOtOTnBpCTdd8Bg6Ys+TnBpb2d8BxGPJ1vL5r9Sm:AF8SPJ1T5rwm |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bf33c4c4494ac33e |
|
VISUAL
aHash
|
ff87818187ff9393 |
|
VISUAL
dHash
|
613f1d1b3f2b3327 |
|
VISUAL
wHash
|
ff87818181ff9191 |
|
VISUAL
colorHash
|
0f003000000 |
|
VISUAL
cropResistant
|
613f1d1b3f2b3327,0f5e9e9e9cbdbf3e,0f0f070f0f1f3e1e,7273432725270c8c,b6cdb8b5b4b4b4bd |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.