Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FF73D932D2861503A05B85C8F1369B4D7362864DCB134FB976BE23B5EACECF56722358 |
|
CONTENT
ssdeep
|
1536:8ehOlUetKeYubifCyDzd/uRwcR4WIDly7JV5zVonnKnnnn6jeeeeeeeGUnnMpeeX:SJbipE1JLzooxk222I2222222RVYg76P |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
926dcd30b293ef88 |
|
VISUAL
aHash
|
42007e4646667e7e |
|
VISUAL
dHash
|
8aa6e4dc94ccdcdc |
|
VISUAL
wHash
|
42427e4646667e7e |
|
VISUAL
colorHash
|
06c00018000 |
|
VISUAL
cropResistant
|
8aa6e4dc94ccdcdc,8692939325651f23,8692939325651f23,4148b4f415152b2b,8692939325651f23,8692939325651f23,4b4b3198d8d08c4d,3e925b4bd31a2b2b,8692939325651f23,8692939325651f23 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.