Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1ABF2A631A100693B11A7C2C9B363B72EB2A3824ADB47051583FD83AD0BE7D95DF77619 |
|
CONTENT
ssdeep
|
768:noy5NTtuGSfY2NSfHroZcEE77sOy2+y9BH4crIe:juFYMSfLoS7sOy2+UBH4crIe |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c267b8389d21c7cd |
|
VISUAL
aHash
|
000020000000ffff |
|
VISUAL
dHash
|
9c0cc5c0c0ddcd00 |
|
VISUAL
wHash
|
c0e6f0303004ffff |
|
VISUAL
colorHash
|
39001000180 |
|
VISUAL
cropResistant
|
c880800458988000,940ccdc5c1c4cdcd |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.