Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T144A383919098257F11DB035A6E70D754E3E28083A9482A094FFAD78B8EFFD42DF0566F |
|
CONTENT
ssdeep
|
768:3o6UcNTun5U/mJLSNR/H4mJr6E/bPfAof+o4SGTyGGGGGGGGGGGGGGGGGGGGGGv:3dUeTy5XSNNHj |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e7ab14d508d60de3 |
|
VISUAL
aHash
|
ffe7e3e3e2e2e600 |
|
VISUAL
dHash
|
cc4f4b4b0a4e4c8c |
|
VISUAL
wHash
|
ffe3e1e1e0a2e600 |
|
VISUAL
colorHash
|
07640008000 |
|
VISUAL
cropResistant
|
4c4d4b4b0b4a4e0c,92b09087b38ec461,4f4b4b0b4a4ccc8c,8751444121179b33 |
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.