Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10723D83218C46F2711D393C8A311DA5BE3D5854CE2BBC65AF5DAC72A1AC5D44CC3AB9C |
|
CONTENT
ssdeep
|
768:/QIESta8q37PxwptEBmlRG9LeclrtKG28Eh9fySwT/LBANn35y0+KY5te/gpT7je:/QI3I8q3GWBmlRALegrQ8EhsS6/LBANj |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
946bb186f9c486f1 |
|
VISUAL
aHash
|
ff00000004367e4e |
|
VISUAL
dHash
|
71f0ccd0ece4d49c |
|
VISUAL
wHash
|
ff180008167e7e7e |
|
VISUAL
colorHash
|
02000000030 |
|
VISUAL
cropResistant
|
0001416363490002,8494c0f4b0881e5a,f0f0ccd48a8e86a6,31e0c490ece4dc9c,4d4d0d57d6d747d3 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 174 techniques to evade detection by security scanners and make reverse engineering more difficult.