Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T155F31135F180A4BBA18FC1E0A374677F265AC693CF530BA842E2E3741AD2DD2DC57265 |
|
CONTENT
ssdeep
|
1536:nyiVvu1Hbudl8HX+0303030303030Gd+vkNdFPQbSK:fGgtFK |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e4136c89e92cd3bc |
|
VISUAL
aHash
|
7e000000fffff3f3 |
|
VISUAL
dHash
|
84cc8c9d0a362727 |
|
VISUAL
wHash
|
74000000fffff3f3 |
|
VISUAL
colorHash
|
060000001c0 |
|
VISUAL
cropResistant
|
0080a08888948001,e4cb8a84b2b274f0,860e8e3b26272727,3dcccccccc8c8d6d,6626669c3858556c,2b2b21213733332f |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.