Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11F229512A244762C02D98168FA67D7EEB74042E4D2190FA5BF78817FF48C5E4CE3A6CD |
|
CONTENT
ssdeep
|
192:xCzUY1UsHCq6j1QWTAjWbF8bQ3XX/4Kq09msL81AzrVMiui9K:xqUYGGrg1VtEpkK |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b8383c38c7c7c3c3 |
|
VISUAL
aHash
|
c3c3c3ffdfdfffcf |
|
VISUAL
dHash
|
9e961e1e1e16161e |
|
VISUAL
wHash
|
c3c3c3c3c3c3c3c3 |
|
VISUAL
colorHash
|
070000005c0 |
|
VISUAL
cropResistant
|
9e961e1e1e16161e,7fded77efef5ffff |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 47 techniques to evade detection by security scanners and make reverse engineering more difficult.