Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T174D1B6733304052F45D38394F592BA3AE2EF56E5F29B64B4B0BC8A9D06DADB0CD97160 |
|
CONTENT
ssdeep
|
96:icuoEGFlrW0N7TDynW/eS13STbC/EC1aECFCZej9SIgKizsjmRIgb:iA7rH7VSkEQaE3ZexSIJJsb |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cccc33339399cc66 |
|
VISUAL
aHash
|
0018181818000000 |
|
VISUAL
dHash
|
0810303210100000 |
|
VISUAL
wHash
|
3f3f3f3f1c1c0000 |
|
VISUAL
colorHash
|
38001000180 |
|
VISUAL
cropResistant
|
0810303210100000 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 49 techniques to evade detection by security scanners and make reverse engineering more difficult.