Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19463823373040F79DB17CF94B413AB5042BED328D652A06CD2AE9227CDE38A7967D646 |
|
CONTENT
ssdeep
|
768:Fzv3y2qiQRm2qiQRmJt8Dv6HbqFXNLS1kaNcFD+6/XIid:Fr3y2qiQRm2qiQR+Y41kgcx+6/Xd |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c3c734383999c766 |
|
VISUAL
aHash
|
007c7c7c00000020 |
|
VISUAL
dHash
|
f0e0e0f0e0c432c0 |
|
VISUAL
wHash
|
3c7c7c7c3c7c8070 |
|
VISUAL
colorHash
|
30000038000 |
|
VISUAL
cropResistant
|
6c6f7b6b2b7b3386,5535ad8c8cac3032,f0e0e0f0e0c432c0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 189676 techniques to evade detection by security scanners and make reverse engineering more difficult.