Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19783312373040E759B279FE8B4439B8042BEE328D553A06CD3ADD6768EE7C57A16C607 |
|
CONTENT
ssdeep
|
1536:2N9ZwKP/pE56sBIO1363hpEn1UpEn1m+6/Xd:2N9Zw9363v/N |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c3f16c3c9a92e1e1 |
|
VISUAL
aHash
|
58786e3e3c383878 |
|
VISUAL
dHash
|
90c0c4c8e8f0f0f0 |
|
VISUAL
wHash
|
7878767e3c381878 |
|
VISUAL
colorHash
|
38200000018 |
|
VISUAL
cropResistant
|
045212321a32d044,90c0c4c8e8f0f0f0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 189672 techniques to evade detection by security scanners and make reverse engineering more difficult.