Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A2E2B771A1007B3B01A392C6F290AB5EA3E3874FD34A041653FD872D4BE7E50E92775A |
|
CONTENT
ssdeep
|
768:kQeNauJSEAbKz+0GYL2s77sOy2+y9BH4crIe:kPI1N3a7sOy2+UBH4crIe |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d342f93a9c6996c4 |
|
VISUAL
aHash
|
000020000400ffff |
|
VISUAL
dHash
|
98ccc4c8cc0cc300 |
|
VISUAL
wHash
|
006470303e0effff |
|
VISUAL
colorHash
|
31000038000 |
|
VISUAL
cropResistant
|
0080800058988000,9888c4c8c8cc3cc3 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.