Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T175A494B42304252D414783D4F3D5FB2D926ED794EB1B98AC727C52A257C7CC8EE27AA0 |
|
CONTENT
ssdeep
|
1536:H5KTMHyi9gigHZlEmU9qB93I1hWTLqGlJzlhMFRnT6XWOMP9St7TkMY9dy+Zx92Z:HF9STQ3j95NP1ZBU |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9cb767484343cc67 |
|
VISUAL
aHash
|
208f9f1f1f1a0000 |
|
VISUAL
dHash
|
ea14343834b2b208 |
|
VISUAL
wHash
|
62ff9f1f1f1f0000 |
|
VISUAL
colorHash
|
30007000001 |
|
VISUAL
cropResistant
|
ea14343834b2b208 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 38 techniques to evade detection by security scanners and make reverse engineering more difficult.