Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1DC23BE2492504A2048D3A384FBF2A36F4235E755C9621CDEF7D483772B8ED9CE71297A |
|
CONTENT
ssdeep
|
384:kYr2/q+f+2GPxKh5nt/icAp5mDPbF1RA9GUR5ft:8/q+f+22Uhlt/ZWmPDR1aF |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
db816f20fe90ff00 |
|
VISUAL
aHash
|
407c7e3e3c243c9d |
|
VISUAL
dHash
|
82d9d0f0f4ccf871 |
|
VISUAL
wHash
|
407c1e3e3c3c3c9d |
|
VISUAL
colorHash
|
380000060c0 |
|
VISUAL
cropResistant
|
82d9d0f0f4ccf871 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 532 techniques to evade detection by security scanners and make reverse engineering more difficult.