Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FC02789CE265D8235461C1E0E9696BEB31508E45D783271447FCC233FECA99EED123B8 |
|
CONTENT
ssdeep
|
192:lhxEmoQaVUPy56z8rnmiUJ3drotRkBWa1E:lhV7t656I43g |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cbdd3c33dc28d128 |
|
VISUAL
aHash
|
383c3c3c3c2c0101 |
|
VISUAL
dHash
|
f1f1e9e1c8c933db |
|
VISUAL
wHash
|
3c7c7c7c7c3d0103 |
|
VISUAL
colorHash
|
320000001c0 |
|
VISUAL
cropResistant
|
b4b98e848ee3939b,ba1b075b5b239dce,f1f1e9e1c8c933db,b3842423d41a1a12 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.