Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1EBB3A620A008A83F01EB46D8B575532E72F5834AC7638A49F6F6D3D89B8FD6DD52B704 |
|
CONTENT
ssdeep
|
1536:lYs2R/DAbsfQ4E3gxXXNzXxY+l7//HPArFYFP/VSXlPsAkw:q9LOy7/8 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
fc47f9b816a92609 |
|
VISUAL
aHash
|
f0f0700000c7ffc3 |
|
VISUAL
dHash
|
c0c0c082a62f1b27 |
|
VISUAL
wHash
|
f8f8f04000c7ffc3 |
|
VISUAL
colorHash
|
07000000180 |
|
VISUAL
cropResistant
|
802424763694c880,b200020202020002,6decbdadac1cecec,c0c0c082a62f1b27 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 57 techniques to evade detection by security scanners and make reverse engineering more difficult.