Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19781D662C2515C47924BC3E5EE65F80952CA80B9D7460F46A3EC1B9C32FDDB1DCB62C6 |
|
CONTENT
ssdeep
|
48:ba1Mc+TNmTN7ALSLlY54yTJl+NaJ9Nz+LGuVB98wHxtQ6m189bqHJbusbM/2KmjG:Cu4le/mKzuP9Lmaq0sbM/2KIqn |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a3089d77891976d9 |
|
VISUAL
aHash
|
3f3f470767677f7f |
|
VISUAL
dHash
|
d8e3aececfcdc4c0 |
|
VISUAL
wHash
|
0f3f030323272f3f |
|
VISUAL
colorHash
|
07000000e00 |
|
VISUAL
cropResistant
|
d8e3aececfcdc4c0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.