Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D2C37711D4C03836105763F4F674AB5A62A2934DC70A0EC5BEF4D2BBDBE1DB1BDA6248 |
|
CONTENT
ssdeep
|
1536:fj1CblTKFdV006TL4tqXug8tuKbAFuebypuE2+J3Ooq3mjfnX2w:p7006TLwIug8tuCAFuuypuR+Jeoq2rXL |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
eded981a63a61c4c |
|
VISUAL
aHash
|
fffbf3e30000ffff |
|
VISUAL
dHash
|
33236646437820ba |
|
VISUAL
wHash
|
b9f3f2230000dfcf |
|
VISUAL
colorHash
|
060400001c0 |
|
VISUAL
cropResistant
|
23330662264e4783,cbc9d8ccc898cb33,40003830283a80aa,2262064e4f034279,7f6f2c2f24cc0573 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.