Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CAE32421D6A41733D20A07CAD3EB365622AAC2C7CD5278E8F170827597BEC8C5D77DA1 |
|
CONTENT
ssdeep
|
3072:n8KZrjylK2E6IOZuagKI3ImJS20gIYLQICeIkPksuGIyIhuBnvLqnh7x:8KdQ5IZf3NvqnL |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ed169d926a934a35 |
|
VISUAL
aHash
|
fff1000000f1fbfb |
|
VISUAL
dHash
|
0e22424347e31213 |
|
VISUAL
wHash
|
fff0002000f1fbfb |
|
VISUAL
colorHash
|
06e00008000 |
|
VISUAL
cropResistant
|
22224343c7e31213,000205d4d4d40304,9696969313531959,8202020602020606,1f0d0d0c0f232264 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 32 techniques to evade detection by security scanners and make reverse engineering more difficult.