Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T154A39B33411935274437C6D130A55B3BE2A69E5FF9A70A010EECD7FA1BFACA0B45B11A |
|
CONTENT
ssdeep
|
768:/S9y5NMK0sIILz4NP3+mZY9svblTOCVrvMmBKsqyoamuRzgG3iQ1s4gdPtrBzZqL:ZLz4NP/y9svbliCdwt0NgdJ6 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
92e96d124d6d926d |
|
VISUAL
aHash
|
c0eff7212c0e003c |
|
VISUAL
dHash
|
0d094f43c9dc7070 |
|
VISUAL
wHash
|
c0efff333c0e003c |
|
VISUAL
colorHash
|
38600030000 |
|
VISUAL
cropResistant
|
fefeffdfcffffffe,0d094f43c9dc7070 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 54 techniques to evade detection by security scanners and make reverse engineering more difficult.