Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T188A30AB040441813D5039393A76077ABA2BFD1D9DEB3440859F4D2D6AFD6C8D7A3A2EB |
|
CONTENT
ssdeep
|
3072:S/npGFuE/DatjkT38I8yVQo9xZys1yxwCd74SHss+rddY:S/nwFuE/DatjkT38I8yVQo9xZys4h74o |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
939596666a5a6175 |
|
VISUAL
aHash
|
3fbf1f0d00000000 |
|
VISUAL
dHash
|
fc7efaf9d9dbb0e8 |
|
VISUAL
wHash
|
7fff7f1f0d200800 |
|
VISUAL
colorHash
|
33407000000 |
|
VISUAL
cropResistant
|
77f7dedafcfeeee2,fc7efaf9d9dbb0e8 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 130 techniques to evade detection by security scanners and make reverse engineering more difficult.