Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13513C0745094A97B82A3D3E557798F3BB2E58385CE83034A87F9838D0FEBC81CD56916 |
|
CONTENT
ssdeep
|
384:ENguqRABvBQL/BoRWPBPTLnTC9wJ9JBJzbJYJCVJ/+2bZM:2NqRAF6zxLTe6YqC |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8741deda1cedc143 |
|
VISUAL
aHash
|
ff00000000ffffff |
|
VISUAL
dHash
|
69dcced6dc6a2a2b |
|
VISUAL
wHash
|
ff00000000ffffff |
|
VISUAL
colorHash
|
330030000c0 |
|
VISUAL
cropResistant
|
002101696991014d,20032b2b2b2b2303,e0e0e8b2b2f0e0e0,cc98ccc6d6d4ddcc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 5 techniques to evade detection by security scanners and make reverse engineering more difficult.