Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F6A3FD23422D762B4437C3C1306A5B3BD1A69A8FFEE709405EDCC7F62AFAC91741A519 |
|
CONTENT
ssdeep
|
768:G5pWWptpR4nXF6YjOpSpFlTC6rrWXauOASJ1ruC8Dq5MnISBS:stpR4nXBKpSpFl26vKOpPru3qMISBS |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
93076d0313177f2d |
|
VISUAL
aHash
|
001f0f3e6f0f01c7 |
|
VISUAL
dHash
|
dcbf78dcdcd8b30f |
|
VISUAL
wHash
|
000f0f3f7f0f01e7 |
|
VISUAL
colorHash
|
00003400400 |
|
VISUAL
cropResistant
|
fdb75cdcdcb9f30f,dcbf3cdcdcdcbb77,8d951593a513c5c4,4e8f91c1a7a6ceca,68100c32320c11d4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 113 techniques to evade detection by security scanners and make reverse engineering more difficult.