Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D523FA3118C42F2B47E392C9A311DA4BF3924184E27ADA97E1E7832B56C5E85DC3B75C |
|
CONTENT
ssdeep
|
768:ui7dmSHFuLMfpBWCOhIlo1eUSQxUceUpSHQiw8Eh9cZwKgXZWDmkyX0T0+eX5dD8:uipmSllfpB5OhF5bx0SSW8EhywvXZWy+ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
946bb494eab984f1 |
|
VISUAL
aHash
|
ff000000067e0e36 |
|
VISUAL
dHash
|
71f0c4f0ccccbcec |
|
VISUAL
wHash
|
ff180000767e7e76 |
|
VISUAL
colorHash
|
01000000030 |
|
VISUAL
cropResistant
|
0001416363890006,8494c0f4a00a1e88,a62466a424327236,83c1b878f8dc9f26,d2d9fcfaf8f8f8f8,31e0d4e8ccec9ce4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 174 techniques to evade detection by security scanners and make reverse engineering more difficult.