Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T148E1B81181116127332386C9F6AB7B2E61C3910ED24A3524E6F913EDC7DEF61B476299 |
|
CONTENT
ssdeep
|
96:Qcop5TRK9eYJK/JFu4t9hLsURqDFbeKSS21omstNeP9STQnpTyjW9DTkaSTH:Qhfc9etui9hLsURMbe9S27sT0n5yS9er |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8d8537278d8d2727 |
|
VISUAL
aHash
|
6600181818000000 |
|
VISUAL
dHash
|
d60932b2320c1000 |
|
VISUAL
wHash
|
ef8f1b1b18000000 |
|
VISUAL
colorHash
|
380000001c0 |
|
VISUAL
cropResistant
|
000060aaae010000,d60932b2320c1000 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 5 techniques to evade detection by security scanners and make reverse engineering more difficult.