Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1EFA3953253C1FA3F24F7D1DB5731AB1BE6986006DD474AC05BFD832D9AC9C50A8A6788 |
|
CONTENT
ssdeep
|
768:xwxXeqI23HocKX3P5tu2WvI0RLdo9gl3JWjJMDQyjm:Uem3HI4LBl3JBjm |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9649399669b2b669 |
|
VISUAL
aHash
|
0018006c767e0e00 |
|
VISUAL
dHash
|
32b20c8dc4cc2c92 |
|
VISUAL
wHash
|
0018f4f4fefecf00 |
|
VISUAL
colorHash
|
38000038001 |
|
VISUAL
cropResistant
|
bc5ab7a0b630b471,32b20c8dc4cc2c92 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 9 techniques to evade detection by security scanners and make reverse engineering more difficult.