Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10281762191049D33C893D9E8FAE66B07B5C0C204C7835609E6F9F36D9FDBD45CEA06A6 |
|
CONTENT
ssdeep
|
48:bu6PpSgRwMN1+J2RGOTVNn0KpWK6YnNQOVBSo5MeYoRnND2e6kW98K48mECn8D:buskspOwVxx6mBS3eYl5Jo8D |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f3734c6c66585872 |
|
VISUAL
aHash
|
00ffefe7e7ffffff |
|
VISUAL
dHash
|
08080c0c4d000000 |
|
VISUAL
wHash
|
00e72727273f0f0f |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
0808080c4d000800,0000004040404040 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.