Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B864A8A35338547B1A178FC9D1503729F862FC0FCA4BF8A5A1AAC79013E7D929749273 |
|
CONTENT
ssdeep
|
6144:JCFwC/p3LMigZwnBcfI4gQrwJU1OZ3CkyT16BgbXnJx1106Hr6/eUCjdrEkdwqb/:mwCh3LMigZwnBcfI4gQrwJU1OZ3CkE1d |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
be1cc76346d42f41 |
|
VISUAL
aHash
|
ff0f00040083ffff |
|
VISUAL
dHash
|
78353e3c271f1863 |
|
VISUAL
wHash
|
ff0f00040083ffff |
|
VISUAL
colorHash
|
0b000038000 |
|
VISUAL
cropResistant
|
787070873132353e,0598d9b9e847a620,aaab3aaa71716171,671e914f4d116060,343e323c3c32431f |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 82 techniques to evade detection by security scanners and make reverse engineering more difficult.