Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19E930E72627B1822514FB2D4A2B48B192683DB89C3434BF6627D52F67FCD8B67D1318C |
|
CONTENT
ssdeep
|
1536:R/LACLCHDUkQckPDl4KotDTiDLyDI7tRh6fDxDCeT6DDhD/h3CE/a1UcaRHSG7Mz:2Ql4KoJTMLcI5O1Kla1UcaRHSG7MVBs4 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
934d6e3330c3cdc6 |
|
VISUAL
aHash
|
78007a4e464e6e46 |
|
VISUAL
dHash
|
c0e6e2988898c888 |
|
VISUAL
wHash
|
78307a4e4e4e6e47 |
|
VISUAL
colorHash
|
03200030000 |
|
VISUAL
cropResistant
|
c0e6e2988898c888,099964f131262b2b,d6693248cccc442c,8796c469a271f1e1 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 16 techniques to evade detection by security scanners and make reverse engineering more difficult.