Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B9836532D353190390BBC5D8F0724B4973518A89CB174B7967BD27BAF9CECB53622298 |
|
CONTENT
ssdeep
|
1536:CCUN/aGYweees0eekKPUgOq61eI9TQRAeKUee0BczysQC+UmVl7OZz7r07ZFcpHu:CpUPUgOq6uSmzlERk222I2222222Yrq9 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b4cde9b4ba13c0c5 |
|
VISUAL
aHash
|
e3c3f3c7c78746c7 |
|
VISUAL
dHash
|
2b23a2ad2cac8c2c |
|
VISUAL
wHash
|
c3c3f387c7860687 |
|
VISUAL
colorHash
|
06200038000 |
|
VISUAL
cropResistant
|
2b23a2ad2cac8c2c,9192a2b0a9a0a2b2,7931e471272b2b4a,d7693248cccc442c,1d3c585b5c5c7d1c,0d3c5c5b5e5c7d1c,9793d6c449638771 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 11 techniques to evade detection by security scanners and make reverse engineering more difficult.