Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1196221D1A0612B32033B90C2908BA72135E9F3A5D19B26C5CAFE07F91BFDD64752E45B |
|
CONTENT
ssdeep
|
384:MjLxZHYlo4IT9+tq+/lOv/kQ82CmNb4wXAJ9qz3Z3h/f3B+VmCLXXxAzB7L9Zab/:MqFL3 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b333999923278d27 |
|
VISUAL
aHash
|
ffe7e7e7e7ffffff |
|
VISUAL
dHash
|
d84d4d4d4d000800 |
|
VISUAL
wHash
|
4fc70707243c3c3c |
|
VISUAL
colorHash
|
070006000c0 |
|
VISUAL
cropResistant
|
d84d4d4d4d000800,f4e06972d8c4e071 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.