Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17973C7B1A568EA3F525382C9A3656F2A31D79249EFC6020193FD8BB44BFBCD1FC15460 |
|
CONTENT
ssdeep
|
1536:8Ki7ColkE1Al7PwrrXvylDFAdVfHSR9FjwKWejtQ4vukdB44QXLQPqG29Bo:8kE1AVFsq9FjwejtLGkdth |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
96916b67691e95c1 |
|
VISUAL
aHash
|
00003e3e7e261400 |
|
VISUAL
dHash
|
60ccfceccccc28f1 |
|
VISUAL
wHash
|
3c047e7e7e7e1c00 |
|
VISUAL
colorHash
|
39400030000 |
|
VISUAL
cropResistant
|
8888d85818181818,e6f0f0e0fcfefefe,e074711979260e01,0000000000000000,a5a5a5b5b2b5b490,6669695e6c6e6e6e,60ccfceccccc28f1 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 11 techniques to evade detection by security scanners and make reverse engineering more difficult.