Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1653320B42145DBB741E7CAB1B2657B7BA2E4DB1CC563CA8FB2E843CA17C9C908E50354 |
|
CONTENT
ssdeep
|
768:HcBePZL8rFq8YuK3VgleJK/YIBGurw5/kab0flb96ClEImTFIoEHzYz+511yxuyO:GpYhg7WspvmTFIjYzMisF |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8accba77237522c5 |
|
VISUAL
aHash
|
013c181838042c0d |
|
VISUAL
dHash
|
0370b07060496869 |
|
VISUAL
wHash
|
993c3c983c3c3c3d |
|
VISUAL
colorHash
|
38000000180 |
|
VISUAL
cropResistant
|
0370b07060496869 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 51 techniques to evade detection by security scanners and make reverse engineering more difficult.