Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T108042DBC122419AE611BC7A5FA307195623F32FDFA978444A7BC0B606B97CC1F987D60 |
|
CONTENT
ssdeep
|
3072:/YJmLFQoswFynxAwrE5SBsp3nI8LZTmVP+d0CW0rSYhDf36O1APxciJjnQDRxX:/YJmLFQoswFynxAwrE5SBsp3nI8LZTmg |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9c1526fa994963e3 |
|
VISUAL
aHash
|
00000018ffffffff |
|
VISUAL
dHash
|
1cccd4b232746464 |
|
VISUAL
wHash
|
000000189fffffff |
|
VISUAL
colorHash
|
1e200038000 |
|
VISUAL
cropResistant
|
8c8e969aaa82aaaa,1cccd4b232746464 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 16 techniques to evade detection by security scanners and make reverse engineering more difficult.