Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18762B81FE3892128056B03DEBD2A61EDB72A448CA13B17832D7DD60D75920D46F3B69B |
|
CONTENT
ssdeep
|
384:7BrKzwTfVtb3prLOlfYQ8F3oS+YujvcyCxnqzr:7hKzwTfLb30JYQwpLOr |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b166ce1b91a564ea |
|
VISUAL
aHash
|
000000020a00ffff |
|
VISUAL
dHash
|
e8888a9a9a8a56b0 |
|
VISUAL
wHash
|
000062ceea4affff |
|
VISUAL
colorHash
|
3ae00008000 |
|
VISUAL
cropResistant
|
ec8e99adb0b13133,9c78e1c3c6c4c3f0,642686f038c5d0c8,e810888a9a9a9ada |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.