Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18E8233709021E967406382D5F636475BF1D08209CB870E1663FC879EDFFAE64EC3AA85 |
|
CONTENT
ssdeep
|
192:8Hglrtqa6qaqpdGKoL831K3z6zVp1w3xyBtKK6d+iXP8lF2Kpb/0:8Hgh4aNaPK661K3zXxu7Ar/0a |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e041bf3bc441f479 |
|
VISUAL
aHash
|
4000607cc00000f7 |
|
VISUAL
dHash
|
a6538ca8a384d124 |
|
VISUAL
wHash
|
f2007efef84000ff |
|
VISUAL
colorHash
|
3020a400000 |
|
VISUAL
cropResistant
|
fce490b29ac6c940,c0d8cf8686365cbc,0000000000000000,8080808080808080,8080808080808080,0000000000000000,a6538ca8a384d124 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 1866 techniques to evade detection by security scanners and make reverse engineering more difficult.