Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T133A3D832D2461503A15B94C8F1268B4D73528789CB138FB476FD17A9FACECF52B62398 |
|
CONTENT
ssdeep
|
3072:AABq9lJSSxk222I2222222MfLvQ2D7Xf1Q3c6vxk222I2222222DJsJ6jeJrJ6JO:UXSSxk222I2222222Mf82D7Xf1Q3c6v0 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e926cd3293c3c6cc |
|
VISUAL
aHash
|
c381f3efc1c1f9f9 |
|
VISUAL
dHash
|
2323239b9b8b93b3 |
|
VISUAL
wHash
|
c181d3cbc1c1f9d9 |
|
VISUAL
colorHash
|
03e00010000 |
|
VISUAL
cropResistant
|
2323239b9b8b93b3,04c836f815152d29,6b6b3198d8d08c4d,252577276d692329,36925b4bd31a2b2b |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.