Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1DED329F3025822FE321293D0A629B719F792846DEF165BD0D6F9C18DB2C5D258EB3493 |
|
CONTENT
ssdeep
|
1536:7UhXcAq5IDNAq5j1MwpbAq5PhoBpToRAq5bHCXWP9LQAq5YiGAq5zZS2Aq5LOJ:KNt1MwEBNIHCGP9LJiNcOJ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9416b673fd131896 |
|
VISUAL
aHash
|
040000000000ffff |
|
VISUAL
dHash
|
dce4f4d2b2106832 |
|
VISUAL
wHash
|
ff001c1a1800ffff |
|
VISUAL
colorHash
|
3a080006000 |
|
VISUAL
cropResistant
|
0004d0d0d0dc0200,00932f33332fc02b,400ccccccc04428c,d4ecf4d2b23290c8 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.