Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B9621262108AC8737222D1CADAB27B7DB441925FC781489563F8079EE3CBDF1ED02368 |
|
CONTENT
ssdeep
|
96:XQtip9x7vCdrGFUB0Gng3T79N0FNQZlZ5CLvVakNijUuhWtPmdM+N0FNQZlZp0Bx:XDb0PSP0MZlZQDEQ0d0MZlZSx |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e9a182924fcf1bcc |
|
VISUAL
aHash
|
ffefc38381c1e100 |
|
VISUAL
dHash
|
9b9b162633999ba1 |
|
VISUAL
wHash
|
ffefc38381c9e100 |
|
VISUAL
colorHash
|
020000001c0 |
|
VISUAL
cropResistant
|
9b9b160637399ba1,11d4545cc452d456,4871614971707869,88c9606969b8e069,44c8d948c4f06849,ddf169c9e1617135,0640608080323231,8c92d27272f0e869,09d5e9d9d9e96169,8d49716979f1e169,880c33b2daf4e869,a3b3a3858d896969 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 69 techniques to evade detection by security scanners and make reverse engineering more difficult.