Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F66429457611712A41EB21C6A43F060F7236EBA9A207850CF15AD6FC2E6CC8D92FFB75 |
|
CONTENT
ssdeep
|
6144:yhbCuUZreXIVple9u7Chn1S/Y7nHQJLs33oSNF92xoNq:2CuUZreXgplou7CXPnOLNSNFU |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
caa1957cd26cd8a3 |
|
VISUAL
aHash
|
fffff9003810003c |
|
VISUAL
dHash
|
83d8c341e1b3b2e8 |
|
VISUAL
wHash
|
fffffd003810103c |
|
VISUAL
colorHash
|
02000000043 |
|
VISUAL
cropResistant
|
0000808000808000,c0c0d4d0d0c4c0c1,565369755351a424,9595121a32324b49,4a6bf491c9d45159,8280825edec28080,6961696969d4c40e,000010cbeb814000,810361f1b1b281e8 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 43 techniques to evade detection by security scanners and make reverse engineering more difficult.