Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T117B4B661F2E25933205F92E2A46867081193FBAFCB411BC2A7F443B55BF5CB97C4B588 |
|
CONTENT
ssdeep
|
12288:D8bzMmd2xvdohfq6sS50vBPpXikJN0NJuHW99NoKIIT7E758cY:AfhfqpY |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
877078470f7c6f60 |
|
VISUAL
aHash
|
005fff3f3f7fffff |
|
VISUAL
dHash
|
00b8c050d0d0a0e0 |
|
VISUAL
wHash
|
00003f3f3f3f0f1e |
|
VISUAL
colorHash
|
07006040000 |
|
VISUAL
cropResistant
|
8000808282800080,98c050d0d068a0e0,4145808280c02120 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 191 techniques to evade detection by security scanners and make reverse engineering more difficult.