Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1AF13B77104887B3B91A3C3C4A310AA5BD3978244F7A6C69AF1EDC35A57C5D4CCD2BB98 |
|
CONTENT
ssdeep
|
768:0itcEsVFjbPS830bv3k/BFmQRO/+WeZ4YSJhpLpQdhSGzYWqUs3EJVF:0itcEsVFfPXkL3bQRO/HxJhppkdWUs3Y |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9414ebcbc8ea98b6 |
|
VISUAL
aHash
|
fd0606060606ffff |
|
VISUAL
dHash
|
61cceccceccc183b |
|
VISUAL
wHash
|
ff0606060600ffff |
|
VISUAL
colorHash
|
0e0000001c0 |
|
VISUAL
cropResistant
|
0021096161890152,96d6e8b094710b8e,e0181a2c2d3f3c33,ccccacccccecccec |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 174 techniques to evade detection by security scanners and make reverse engineering more difficult.