Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T164423F615054ED2B528392E877B67B2B3381C207CF53170643F8C75D6EE3DAADC2A564 |
|
CONTENT
ssdeep
|
192:Rns8ps8jjEHi44agkYND5uJ4RuHhGh6poO+Ssw1wne3XOQ4weYRq:Vs8ps8jUi44ag5uJ2uHh9+SseOkeYA |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8de9b292f20db2e8 |
|
VISUAL
aHash
|
bffb9bb9f93f1fe7 |
|
VISUAL
dHash
|
6b3232730376764c |
|
VISUAL
wHash
|
b18b81b1f93301e7 |
|
VISUAL
colorHash
|
07000030000 |
|
VISUAL
cropResistant
|
6b3232730376764c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.