Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14EE21F31E195B93705F781C8E3705B1AB7C2428ACB634B06B3F9879F4BDBC56D82A506 |
|
CONTENT
ssdeep
|
768:lc2woId+FT6QAZZ3PT60HQZVU3QZFGPQZ48wQZ0NL/Nfcr/NXl7/NAdM/N2DHLl9:hwoIcF/KpPT60HQZVU3QZFGPQZ48wQZU |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
de16a86b99c86636 |
|
VISUAL
aHash
|
ffb400000000ffff |
|
VISUAL
dHash
|
33646c7050692930 |
|
VISUAL
wHash
|
ffbe00180000ffff |
|
VISUAL
colorHash
|
0be00000040 |
|
VISUAL
cropResistant
|
00222667c32b4b68,290030304a073791,0000000000000000,6c6c6c70514c4929 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 52 techniques to evade detection by security scanners and make reverse engineering more difficult.