Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FB63B7B1E28976A78123E3C093163DB17795910AE3128B00D7F8DF5D6BD6C2CAC369B5 |
|
CONTENT
ssdeep
|
1536:044ynkRoxbW5O6cnplpKxLydMNF5qrSkSSSHS4yS4aHLnZeQ3R6cZu:JkRUy0pKxLydqF5qSLdu |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c96c333c659369c3 |
|
VISUAL
aHash
|
18183c3c38187e28 |
|
VISUAL
dHash
|
b270f0f0f0f0f8d0 |
|
VISUAL
wHash
|
5a383c7c3c187e3c |
|
VISUAL
colorHash
|
300012000c0 |
|
VISUAL
cropResistant
|
fcfca292d2e27cf8,b270f0f0f0f0f8d0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.