Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CEF1620AE351761846071125BE72DBDEB31201E592098AFA6EB5C13EF1AC3F48537ADE |
|
CONTENT
ssdeep
|
192:hFadHcnp8JvfLsiGIyKocJTn+2u4tpuc5DDFkDaCjyA:hFO8mTsbvqJT+f47dk2CGA |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e5659e9a924c8b9a |
|
VISUAL
aHash
|
ffc3c3c3ffffffff |
|
VISUAL
dHash
|
169696961f17170f |
|
VISUAL
wHash
|
c3c3c3c3c3c3c3c3 |
|
VISUAL
colorHash
|
060000001c0 |
|
VISUAL
cropResistant
|
169696961f17170f,101aabeca2c94d4f,a4a553d3565a5330,00a0aad4d4008000 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 14 techniques to evade detection by security scanners and make reverse engineering more difficult.