Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F763931152082F3EA11387E8EBE5B73861BFD399D32F491CA67D42B15786C88E9277C4 |
|
CONTENT
ssdeep
|
1536:aGpHJ+W4Lpyj9s76Lpyj9s7DrRBxywwh1OYcwjbjeK6ClSjVYq7:aGpHxdBdgbIjVYq7 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
936c6c696c916d95 |
|
VISUAL
aHash
|
000e0e2e2c0c0e0c |
|
VISUAL
dHash
|
f258d8c8d8d8d858 |
|
VISUAL
wHash
|
020e3e7e7e6e0e0e |
|
VISUAL
colorHash
|
38002200080 |
|
VISUAL
cropResistant
|
c0474d9983830007,0e0e1e9e9c9888f0,7ee288eae2843842,e0e9e9e4a48082f0,fffefffffffffffc,f258d8c8d8d8d858 |
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Malicious code is obfuscated using 214 techniques to evade detection by security scanners and make reverse engineering more difficult.