Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1BA12FAE7F31433754613166EAA0E65F68726406C8711187C247D826923D3A9CA2F7BEF |
|
CONTENT
ssdeep
|
192:HvtoTz9oQQlELJ3HWzKxPVc1XTQ7mGyrX7I9Svc:Pto3acJ3MocT1drX7I98c |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
94f629816d9963ba |
|
VISUAL
aHash
|
0be6e6fef6660800 |
|
VISUAL
dHash
|
f2acaca4cccc3253 |
|
VISUAL
wHash
|
0fc6e6fef6660c00 |
|
VISUAL
colorHash
|
000010001c0 |
|
VISUAL
cropResistant
|
5bd2b624ad99a996,cab2f0f470707031,52e3c3c24621928c,2d246e48993252ea,9494147d5252acad,e1a0684cdece6c39,f2acaca4cccc3253,e1830f962c5a3421,3173e3c7c68c1c38 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 615 techniques to evade detection by security scanners and make reverse engineering more difficult.