Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19F032538580F10AB1A23DCE1E121BF5F65A3EB3AC169C8A046ACD34C7FC7EF06659565 |
|
CONTENT
ssdeep
|
768:nfgwqZvzv4v5K/si/dF/ED/yv/PkvLkMmC:fg92 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e699cc66313366cc |
|
VISUAL
aHash
|
e3ffe7c7e7e3e7ff |
|
VISUAL
dHash
|
06085d4d4d0d4d1a |
|
VISUAL
wHash
|
c3c3e7e7c3c3c300 |
|
VISUAL
colorHash
|
07201030040 |
|
VISUAL
cropResistant
|
06085d4d4d0d4d1a,8fab9f970f2b290f,970e23370f355161,1b1b515590903136 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 78 techniques to evade detection by security scanners and make reverse engineering more difficult.