Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15872CC31A091983B09B7D4E2E1B5232F71F2CA88ED530656E3FD436C2BD9F91ED92914 |
|
CONTENT
ssdeep
|
384:vVHpMDycdCsUTZ0L0N2kSPOaBQGb+Pw5CPd/9RagS8QsGmQs4+TUF7F/9:vppMDLdCsUTZ0L0N2kSPOaBQGb+Pw5Ci |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c2ae3d3b86e0a91e |
|
VISUAL
aHash
|
8100707474686000 |
|
VISUAL
dHash
|
2118c6c4c993c030 |
|
VISUAL
wHash
|
cbc0f27f7d696010 |
|
VISUAL
colorHash
|
380000001c0 |
|
VISUAL
cropResistant
|
2118c6c4c993c030 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 7 techniques to evade detection by security scanners and make reverse engineering more difficult.