Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1ECD2FB319145A97B12130CC0B8667BCE79E3838DDD5358006BFCC3AA7FCACD29E659A5 |
|
CONTENT
ssdeep
|
768:RQTgTpTXTaTJTqTNT4QTETFTQT5THTgTZTgQT2TpTnAePQMQnKg86VZFipIEPcMd:2M9jm1GhPAJ8FLs1PC9rHPQMQnKg86Vo |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b2106d9d13ebc53a |
|
VISUAL
aHash
|
0000242c0cffffe1 |
|
VISUAL
dHash
|
ba8dc9c818190b2b |
|
VISUAL
wHash
|
0004647c0cfffdf3 |
|
VISUAL
colorHash
|
03000000e00 |
|
VISUAL
cropResistant
|
61e09e9bb33a6ee6,c9c81cd8060b0b23,84c4846464840080,982d8dcdc9c85cd8,1787979793118198,123323083a7c3a56,a8b86227a2a6e3db |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 23 techniques to evade detection by security scanners and make reverse engineering more difficult.