Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A0150AF013281E7A61C7C39DE7747CE766EAAE92DAC7544893AE0AE857C3CC8D9055C0 |
|
CONTENT
ssdeep
|
6144:1SAxECZytF2uoSbDbU9YMS7ePpfoLYh2qqXSOVmRDqYuh87bjXIsONoUcT5eu7e5:wAnAtOSb/UrtCzqqXSQaDqYvMQC5 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bc63929ec9cc3338 |
|
VISUAL
aHash
|
ffe3c3f3c3c393db |
|
VISUAL
dHash
|
290f0f42370f2333 |
|
VISUAL
wHash
|
8fe7c3c38183c3c3 |
|
VISUAL
colorHash
|
07403008000 |
|
VISUAL
cropResistant
|
290f0f42370f2333 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 7 techniques to evade detection by security scanners and make reverse engineering more difficult.