Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17B332BE93C55B5121B7390D3A0AF395BB33E242F780C55A0B160DEA974F84A9507BF8E |
|
CONTENT
ssdeep
|
768:NyWu8n+WPy/u/sC11R5SM9XcNwGWirDLjwX8U89nu7hyDpSxHyOzxHRBaW/Sy3sj:VQoyOloQzZs8oWQbp |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8f50789eb58af09c |
|
VISUAL
aHash
|
1f1f1f3f3f3f3f03 |
|
VISUAL
dHash
|
71e9f9e766716166 |
|
VISUAL
wHash
|
0f051d3f1f073f03 |
|
VISUAL
colorHash
|
07000000000 |
|
VISUAL
cropResistant
|
71e9f9e766716166 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 478 techniques to evade detection by security scanners and make reverse engineering more difficult.