Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1379351A44211557F1183C3A1A6B1EF5BF294E341DE539988F3E9C28A6FCFC51CEB2258 |
|
CONTENT
ssdeep
|
1536:2fTLDjLj7Z/fsYJ4QjKdnEUrRuyPK6whUhUhOQhrhIhLhov8pJWW8wC0IO+7xzyM:6Le9E+QmN4r0IO+7xzyBu |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c39b986b2f2c2ac3 |
|
VISUAL
aHash
|
007e7e202c007c7e |
|
VISUAL
dHash
|
5bd0d4d4c48bd4d4 |
|
VISUAL
wHash
|
017e7e3c3c403c7e |
|
VISUAL
colorHash
|
06209040200 |
|
VISUAL
cropResistant
|
e6d8f3eb820c2c6c,d4dc5e54fc5ed4dc,5bd0d4d4c48bd4d4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 38 techniques to evade detection by security scanners and make reverse engineering more difficult.