Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1BFD29330A090EE3784DB97E9F3B2572E22D7824AD943070607FD976C4BEBC41ED6A519 |
|
CONTENT
ssdeep
|
768:q1HxKmc+gVv0An+ipslA05t2ilMm+Ppi6F7sBLy2+y9l0K4/LIe:FXa5EF7sBLy2+UuK4/LIe |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9243b512cd29dced |
|
VISUAL
aHash
|
000000000004ffff |
|
VISUAL
dHash
|
ccccc0c0cccccd00 |
|
VISUAL
wHash
|
04fc6028041effff |
|
VISUAL
colorHash
|
39c00008000 |
|
VISUAL
cropResistant
|
c3c3cdcdcdc3c3c3,0c80d0025c888000,cc4cc0c0c0eccccc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.