Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1BB91A43BE140222B7B274ADEF925176BA563D24ECA030E00B5BC91A81FF5C55C87A863 |
|
CONTENT
ssdeep
|
96:ToXnPSTNi7m+iKeDcW1nZ1M/eL/XzIsys9aR0/zIW:0XapituhnvqeL/Xssfi0EW |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bf39624338380f1f |
|
VISUAL
aHash
|
00ffbfdfbfbfff00 |
|
VISUAL
dHash
|
228028303060904d |
|
VISUAL
wHash
|
000f0f0f0f3fdb00 |
|
VISUAL
colorHash
|
070001c8000 |
|
VISUAL
cropResistant
|
802030307068904d,0000804343000000 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.