Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T118B33AF6E798A970B11367D8F0A172926213113BEF05CAC4CA6C51B4F7C6C5E8E779A0 |
|
CONTENT
ssdeep
|
1536:6XdZdJZh5N0/3XdZdJZh5cSdB64ql3rwB2:6XdZdJZh5N0/3XdZdJZh5cSTqxA2 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cdec12123c7d5336 |
|
VISUAL
aHash
|
06fffbfbff000000 |
|
VISUAL
dHash
|
9cc6d63626d8c8c0 |
|
VISUAL
wHash
|
00fffffbff200000 |
|
VISUAL
colorHash
|
18007000000 |
|
VISUAL
cropResistant
|
0956c6d6e6d63629,040494d4d4240004,8f8686272773230d,c8d0d1d8c4c4c2d2 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 13 techniques to evade detection by security scanners and make reverse engineering more difficult.