Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F923B93038C42B1F599382C5B3559B1BF3998645B3B9CACEF5DA831A06C6D84CC7A76C |
|
CONTENT
ssdeep
|
768:C2MdOKrCpABoqu9uRnUE8Eh9fKewK4v10Yjq+S03Sl58+J45K5MrQFiLEJPq:CVOK2iBoqu9uRt8Ehbwjv10Oq+Sb38eq |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
946b9496e9b4a1f8 |
|
VISUAL
aHash
|
ff000000007e3e06 |
|
VISUAL
dHash
|
31e0c4d0d4ccecdc |
|
VISUAL
wHash
|
ff1c3008007e7e7e |
|
VISUAL
colorHash
|
01000000030 |
|
VISUAL
cropResistant
|
0001816373890006,8484c0c4b4a00e0e,a62466a624325236,71e8d4f0dcccecdc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 174 techniques to evade detection by security scanners and make reverse engineering more difficult.