Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E7747372E792B427217B80D4E671DF1B63441286C7A28BD5FBF408E7E6CDCA4A42705B |
|
CONTENT
ssdeep
|
3072:Mur6/HQZn+3QZ8nPQZ48wQZ+FL/Nfrr/Nid7/NRUM/Nu74dazmEdau/kda4TrdaD:M7iiWW |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8505fada1393bb1a |
|
VISUAL
aHash
|
000000263cffffff |
|
VISUAL
dHash
|
f0c6ced4d42b60e0 |
|
VISUAL
wHash
|
0000002e3cffffff |
|
VISUAL
colorHash
|
070010080c0 |
|
VISUAL
cropResistant
|
2969292969292929,0cc06018c4fcee73,b2f263a9da4b7ad0,a240566e645848a2,a2c05b6a6a4cc8a2,80c0806460e023d0,78c6c6ecced4d4d4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 10 techniques to evade detection by security scanners and make reverse engineering more difficult.