Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12FD354716114F82AC0DB53CAB566720923A1F309C6C206D4BEB8CBD9DBCED19D963BD4 |
|
CONTENT
ssdeep
|
1536:dsIx35UOoQou0oiCFr2jDpGwK5YDVOYnLOmneJOTnArOHnh2OvnFf7up1uV68KSg:dVUYiCFr2jDgwK5IR7Ya2 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
fdea800597939a9c |
|
VISUAL
aHash
|
ffc1c08080000bff |
|
VISUAL
dHash
|
830b232a560aaa46 |
|
VISUAL
wHash
|
ffc1c1808a812bff |
|
VISUAL
colorHash
|
07209008001 |
|
VISUAL
cropResistant
|
830b232a560aaa46,929a9a3069d998b1,caad989696d8c84d,e9ce9adacecca8b1,d3d1c5a41a98c668,8901212d291b29a9,5e7e7fdff30f8130 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 74 techniques to evade detection by security scanners and make reverse engineering more difficult.