Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1DF5394B6C081E13759B2E6E17E21FB1DBA0141C6C98244D7D2E7DB6C3BC6D63AA5234C |
|
CONTENT
ssdeep
|
768:xSaw8nzVZhL37qVDhLn9Bwq5VMhLngswsxVnIdS3wdsdTVGIbSw5tV9IfPZybVBY:041cjeimRK8b+2nMv |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b030cfcf36367330 |
|
VISUAL
aHash
|
ffffc7c7c7ffffff |
|
VISUAL
dHash
|
30149d8d9f161e18 |
|
VISUAL
wHash
|
0f030303c0c0c0c4 |
|
VISUAL
colorHash
|
070000c0001 |
|
VISUAL
cropResistant
|
30149d8d9f161e18,167677cecbe6f3fd,c8c3c303870482c2 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 31 techniques to evade detection by security scanners and make reverse engineering more difficult.