Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E3D2B632A0205A3B42D782C9B6B17B2EA3E3428AD6451455D1FD83F94FD7E08ED33B95 |
|
CONTENT
ssdeep
|
768:/erl58pTzFgD8MGjDmn9ETbuq7sOy2+y9BH4crIe:I58pwp39auq7sOy2+UBH4crIe |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c34bb53ab238d48e |
|
VISUAL
aHash
|
000000000000ffff |
|
VISUAL
dHash
|
49c0c0c8c9d19300 |
|
VISUAL
wHash
|
00783070fc10ffff |
|
VISUAL
colorHash
|
31000c00000 |
|
VISUAL
cropResistant
|
028080004c888000,29c0e0c089c9d112 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.