Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T114223133B500DD2A8D9B65CCF2C09688455ED345FB3148CA70A091BF7BC4DF069AA7AD |
|
CONTENT
ssdeep
|
192:NpcSoecAcPchvxrg0JZxFMcnthWeNWbnfMmUU8VCo6j/:pcAcPchvxr1gfMmUFCo6T |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b13131cecec66674 |
|
VISUAL
aHash
|
c3c3c3ffffffffff |
|
VISUAL
dHash
|
9696960c30000001 |
|
VISUAL
wHash
|
0000000000000101 |
|
VISUAL
colorHash
|
07000040007 |
|
VISUAL
cropResistant
|
9696960c30000001,6069167179711228 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 10 techniques to evade detection by security scanners and make reverse engineering more difficult.