Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D0228232B488603B059397C5BF6AA79AA3F58141C3450B09A2F9839C9BD7D0BFC26855 |
|
CONTENT
ssdeep
|
192:jhVINhGj44t9JMCu2+GMWRjLtvDafKRKJe00wN:jnINhC44fHVRiuwN |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8903f61cc6e715f4 |
|
VISUAL
aHash
|
000000200000ffff |
|
VISUAL
dHash
|
c4dadac3f3f3920e |
|
VISUAL
wHash
|
02083b791818ffff |
|
VISUAL
colorHash
|
13201000180 |
|
VISUAL
cropResistant
|
a240b0d822a48450,326196966854ecac,c4dbcadac3f3f3f3 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 42 techniques to evade detection by security scanners and make reverse engineering more difficult.