Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11A2453607E036829309F07CF922B161D71D1DBC9E6536AD5A9F0E3289AF9C95FFE1240 |
|
CONTENT
ssdeep
|
1536:x3185sJr7qgU04wEOUDIUE+UfN/4LSZwgRcbJBo6IcQ74E2443LCyZibQsvBsJzb:xKY7TyUie6WfzBE2QGyAc9 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9407b1ba50cbc776 |
|
VISUAL
aHash
|
0000000000ffffff |
|
VISUAL
dHash
|
dcbec4e0202210be |
|
VISUAL
wHash
|
00023c1810ffffff |
|
VISUAL
colorHash
|
1e006000000 |
|
VISUAL
cropResistant
|
022ab400181c2eb2,dcfa9ec4e0f0a020 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 105 techniques to evade detection by security scanners and make reverse engineering more difficult.