Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D33333319080743B02A3A2C59A75571BB3D3834ECF530B1967F8879D6FCBE44DD16A6A |
|
CONTENT
ssdeep
|
1536:U8nH4dJSSE3NUgYkRrOl766/hSSSSSQoMsYifPsWlB1j0eTW:H4Ntk6/eNN70kW |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8b49e51497777443 |
|
VISUAL
aHash
|
fff900000c0000ff |
|
VISUAL
dHash
|
23b3c379d9b1d149 |
|
VISUAL
wHash
|
fffd000c1d1900ff |
|
VISUAL
colorHash
|
06e00000000 |
|
VISUAL
cropResistant
|
0c023313232820b3,66495cb7b5b2b240,c901000100000000,004434e6c6c43442,f3c37159f9b1d159 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 10 techniques to evade detection by security scanners and make reverse engineering more difficult.