Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T130D3F674E13851AF00D791E2E1705FD876E5E385D6820486E3FCD3AED6DADA1C80B26E |
|
CONTENT
ssdeep
|
1536:4/PBVQgoVoo3k/QngOBdS2uqNu32fdDEP2uqNu32fdDEP2uqNu32fdDECqxYXLoJ:gPT43y1cdEhLyGviIX |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a20dfedf3b8b2041 |
|
VISUAL
aHash
|
ff620000003fffc7 |
|
VISUAL
dHash
|
6fe6cfebe8e5080f |
|
VISUAL
wHash
|
ff730000003fffc7 |
|
VISUAL
colorHash
|
07202010000 |
|
VISUAL
cropResistant
|
6c6066e6cec6cbcb,e3e7e7edecf8e38b,e466000f000f0f0f,e6cec7cbe6e4ebe4,2000002101010101,23b3a1a515696346 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 51 techniques to evade detection by security scanners and make reverse engineering more difficult.