Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10793BC31A23B1826911FB2E4A2A487192693CB8AC7438BF5627D52F67FCDC753D1318D |
|
CONTENT
ssdeep
|
1536:baBgCzR0gX4YrbaeMSqpbbqw+MFp/kex0en9MAVe+3zBkMHzSATMmYML7MFygnHH:baBgCzugAbvYU1ZHwo8nGKYDjhsrPWQ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d3cc339a9992cd31 |
|
VISUAL
aHash
|
3c20303c1c3c6c44 |
|
VISUAL
dHash
|
79c644f9e8e9c9d9 |
|
VISUAL
wHash
|
3e323c3e3c3e2c2c |
|
VISUAL
colorHash
|
02200038000 |
|
VISUAL
cropResistant
|
79c644f9e8e9c9d9,7828285a74683e3e,ceed490981917971,f4f4f4f0d0d0f0d8,d913cf6971dc9ece |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.