Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15FE29C205183DCBF1583AAD17634895BAD8AD350CA37AB1B03E5531D7FDBCA0CCA91B8 |
|
CONTENT
ssdeep
|
768:uoXhaYanaKatbKb/b5bwbSbobWbEbZbJbwbibMbVbXbQbgbDb1bLNajawafaWbT8:3obaR9+zpQGo6UJZQ2clrwgHFLEmji6I |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8ceb26aba82bae89 |
|
VISUAL
aHash
|
811818183c181806 |
|
VISUAL
dHash
|
67a032323232a18c |
|
VISUAL
wHash
|
f3383c3c3c38187e |
|
VISUAL
colorHash
|
30006000000 |
|
VISUAL
cropResistant
|
67a032323232a18c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 482 techniques to evade detection by security scanners and make reverse engineering more difficult.