Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12BC29EA2CD8550D73219B2E095072E5C9D85DC3F52E24B4D52BFC3A9FBB28E2F51A318 |
|
CONTENT
ssdeep
|
384:AUCUvmA/ClHPypOtBKSe/kiqt6A34coaBdjtmhFk:uUvmA/+88B0/kiRJ04Fk |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f9b903374606de46 |
|
VISUAL
aHash
|
00cbdbdb81cb4100 |
|
VISUAL
dHash
|
9b9b33333b2b9ad5 |
|
VISUAL
wHash
|
00cbdbdbc9cbc318 |
|
VISUAL
colorHash
|
0ec08000000 |
|
VISUAL
cropResistant
|
2a2824b4444ca808,f0e0c4c3c3e64612,80c0c0c0c0e0e0e0,f8b0f8f8f8eafef1,e4e4f4f4ecacaccc,c0c2ccc8c8808488,642066ac88c8f6dc,b468e52b1996929c,9b9b33333b2b9ad5 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.