Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15C73A732D2561403906BC5C9F1624B4A73918689C7134BB577FC27BAFECECB56B22398 |
|
CONTENT
ssdeep
|
1536:JA0SwJX++PUgOq6Vytf1+DWs5w7SJFoeyJxezqWSjUNHHzTMWOc5nPWeeuIIJFm+:LO+PUgOq6woCOzZbBhk222I2222222xh |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c1343c4db393cec6 |
|
VISUAL
aHash
|
80807e6e7e7a7e5a |
|
VISUAL
dHash
|
96a6d0d8daf2f2aa |
|
VISUAL
wHash
|
0000fe6e7a7a7e5a |
|
VISUAL
colorHash
|
02200030000 |
|
VISUAL
cropResistant
|
9387d0d8daf2f2aa,616161616569d529,6969696969696969,4941494d65634545,296956616169d529,696956616069d529,4b433198d8d08d4d,296de3616069d529,4f6b392b2b3323d8,296952616069d529,671692138362418e,b0b0b8b8bc7cecb7,296957e961616165 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.