Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1BD637332D257181390B7C1C8F1724B5A32918789C7134A75A7FD27BEBDCECF56A22298 |
|
CONTENT
ssdeep
|
1536:EECW5BXSlmPUgOq6JWP3ubQVmAfG5scox/59rYaprRcMe5KeMGBk0b9e8sD2WTRk:DXPUgOq6or59rYapVGhJeR5VTZk222Ix |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e8c6cd3293c3cdc4 |
|
VISUAL
aHash
|
e3c3fbefc381c1f9 |
|
VISUAL
dHash
|
2b27239b2b2b0bb3 |
|
VISUAL
wHash
|
c3c3b1cf8381c1f9 |
|
VISUAL
colorHash
|
06200038000 |
|
VISUAL
cropResistant
|
2b27239b2b2b0bb3,7458667815152933,d6693248cccc442c,2f2b3b2b2b3323cc,cc963e168303232b |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.