Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11051441100058E37848256E0F7D25B19B2E9C10ACA549F64B2F847AC5FDEF95BC3EDD5 |
|
CONTENT
ssdeep
|
48:TN4QcwEYwHwmwEdP8wEYwEcwEEwEmw1woCSejM0upl2aj/0cdPkPfX3YB5s5j:TEXejMRpN1d8Pf2qj |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a4c91cdc46c72db9 |
|
VISUAL
aHash
|
17070323c7030703 |
|
VISUAL
dHash
|
b696d6c7af96b636 |
|
VISUAL
wHash
|
170f2b67c7470707 |
|
VISUAL
colorHash
|
06007000080 |
|
VISUAL
cropResistant
|
8dd94c193b5ddcdd,e7d1f0b4b9f07a3a,98f4a406c2c6cec6,d88ca4e18bdd9fbc,0c13333234343466 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.