Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19423923108C46F2B51D343C4B3209A0BD7D69144EAB6C55AF1FEC39B5AC8E89C96EF58 |
|
CONTENT
ssdeep
|
768:K+MuBfzSBXmI7SAX2eKWFPL9eGQg/D9ro7mvCANabLVpZof0LoXQamhLSEJ8s:DR+B2IVaYD9fQg/Dho7mvCANGLVpZoMn |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
916aef90a7e89691 |
|
VISUAL
aHash
|
ff0000004e5e5e7e |
|
VISUAL
dHash
|
73f0c4f49c9c9ccc |
|
VISUAL
wHash
|
ff0000007e7e7e7e |
|
VISUAL
colorHash
|
03000000030 |
|
VISUAL
cropResistant
|
0001416363490002,5b8b8e0f8f864353,84c4d0b4881e1c8c,32d4c4dc9c9c9ccc,980c4c6c26263316 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 174 techniques to evade detection by security scanners and make reverse engineering more difficult.