Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18B041AB29340E43A8253C3E4D3363B56B256619ECF4A8A99D3E8C79CCB82CC5DE77454 |
|
CONTENT
ssdeep
|
1536:8/mHQwpXS1ZVvDohoj7EJWwdOqV8AgU4DM0ykorJwlQjYTaoAsu5CUtu6tuaeSEP:8qNwnqaA0ykPaceTJAgATVZQc |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f88f5a8fc2896361 |
|
VISUAL
aHash
|
9983c3cfc3c3c3c0 |
|
VISUAL
dHash
|
3b370e160f0b3315 |
|
VISUAL
wHash
|
bb83c3c7c3c3c3c0 |
|
VISUAL
colorHash
|
07600030000 |
|
VISUAL
cropResistant
|
3b370e160f0b3315 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 178 techniques to evade detection by security scanners and make reverse engineering more difficult.