Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T150C111B09712997B0637A0E0E462BF1E70D3921EDB970D1476E823163BCED93E8220DC |
|
CONTENT
ssdeep
|
96:cuErX90kWKzolSTSCSTH2fBSlSTSCSTIB5TYRkzQtL:cR6pU2/yfBSU2/3kq |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b43ca8f3898b3175 |
|
VISUAL
aHash
|
cf868616c6e6f77f |
|
VISUAL
dHash
|
9db42c2c0c8cccd0 |
|
VISUAL
wHash
|
cf068606c6c6667f |
|
VISUAL
colorHash
|
06201008240 |
|
VISUAL
cropResistant
|
9db42c2c0c8cccd0,29e1918969d9e135,8c0622321870e834,04b16b29924cd1d5,4ec6862eaeb6944e |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 72 techniques to evade detection by security scanners and make reverse engineering more difficult.