Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D2C2A771A100663F419BC3C9B771F72EE2D3D249DB4A181652FD835E8BE3E50CA2352A |
|
CONTENT
ssdeep
|
768:jSCy5NaigkKlKorLoIBjYCbRWdXtK7sOy2+y9BH4crIe:IgkYrLWRddK7sOy2+UBH4crIe |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
936bb532cd2894cd |
|
VISUAL
aHash
|
000000000000ffff |
|
VISUAL
dHash
|
1e49c0d0c1e99900 |
|
VISUAL
wHash
|
80ff3030200cffff |
|
VISUAL
colorHash
|
39038000400 |
|
VISUAL
cropResistant
|
0080802058d08000,1e4948e0c0c9e90d |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.