Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16ED263629455E63B1262C7D8F372F79AFB804186C9D6004FD2F9D35C6BE2D72EC0A216 |
|
CONTENT
ssdeep
|
384:KGOl9komvJXCT0h070XNS0GPq0U0a0sf0fe0j0E0lA0Y01l0cPdVd1VNS0FHzy0A:fomboIQYFz1L/l741feA+y |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d0c02f2f27d8d837 |
|
VISUAL
aHash
|
007cfc7c00000000 |
|
VISUAL
dHash
|
f2d1b9b146343c18 |
|
VISUAL
wHash
|
fffefffe00100000 |
|
VISUAL
colorHash
|
0e203008200 |
|
VISUAL
cropResistant
|
2c2e26333b39b03b,f2d1b9b146343c18 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 11 techniques to evade detection by security scanners and make reverse engineering more difficult.