Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A293A93293622403D0A795D5B1720B4B7322876ADA134B75A7F933BAFACECB13721355 |
|
CONTENT
ssdeep
|
1536:Q6Maw5AIaPu3+vcX9BPUgOq63yfRQkGAZX5YakTXQoe75p69fwNdZRV6HHgKM7N4:iNBPUgOq6WLOP9NDQxk222I2222222OV |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c1362c793398cf36 |
|
VISUAL
aHash
|
02027e6c6c787878 |
|
VISUAL
dHash
|
d4e4c4d8dad2d2d2 |
|
VISUAL
wHash
|
22227e6e68787c7a |
|
VISUAL
colorHash
|
0e400030000 |
|
VISUAL
cropResistant
|
d4e4c4d8dad2d2d2,d4d4d4d4d4d4d4d4,d4d4d4d4d4d4d4d4,d4d4d4d4d4d4d4d4,f1f1f1f1f1f1f1f5,099964f131272b2b,4b43719898d08c4d,672b392b2b3323dc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.