Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C9633534A846FD3F61C78AD591726369A2A58740CB1387C5BAF093F95BCAC9CDB33109 |
|
CONTENT
ssdeep
|
768:S7sIx/jgAUkZpDIYjGFb98mGfxE7byddQ9RUrEUf7/A:S7sIxsAUQpEYjGFb98mGJEnyddQO7/A |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8365389c7cbc47c3 |
|
VISUAL
aHash
|
006060207c3c0f0d |
|
VISUAL
dHash
|
10c8c8e6c8d85919 |
|
VISUAL
wHash
|
1860647e7c7e1f0d |
|
VISUAL
colorHash
|
38203008000 |
|
VISUAL
cropResistant
|
10c8c8e6c8d85919 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 45 techniques to evade detection by security scanners and make reverse engineering more difficult.