Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T199C29372A0503B3F1293C3C9B721BB5E93D39248DA59081653FC875E9BE7E50DE2351A |
|
CONTENT
ssdeep
|
768:r1S5y5NQ847V7raiwm9zu9AWdp7sOy2+y9BH4c1Ie:rB471du997sOy2+UBH4c1Ie |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c342fc3bb129cd86 |
|
VISUAL
aHash
|
000000000000ffff |
|
VISUAL
dHash
|
98c4e0c8ccc7d700 |
|
VISUAL
wHash
|
00fc70302423ffff |
|
VISUAL
colorHash
|
31000000c00 |
|
VISUAL
cropResistant
|
0480800458988000,98c8c4c0c8ccc7e7 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.