Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T147A22361710F7C2F0146D09AEE545F4ABAE982BEDB1B071143F8996E3BE2D51C93530C |
|
CONTENT
ssdeep
|
192:eaRC/MC/vC/+u48lPn7T8qNM76d6W5e0P2ye+mlFI5HfPTL8Kts5h:uLkR4898qNzfzmfIlPv8KtsX |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ca600275713f3eda |
|
VISUAL
aHash
|
40f8f8c0f8c13c1c |
|
VISUAL
dHash
|
91812113020769f1 |
|
VISUAL
wHash
|
40f8f9f8f8c13c1c |
|
VISUAL
colorHash
|
03c02000000 |
|
VISUAL
cropResistant
|
17c707e76717c717,79a080c080818383,221acaaabac6d696,5318e8ebcb0a3335,91812112020668f1 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 80 techniques to evade detection by security scanners and make reverse engineering more difficult.