Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E5F2737191416A3B4283A2C2A73527DBF7C5A28CDB734A0283F89359AFDFC46EC17519 |
|
CONTENT
ssdeep
|
768:CIQvQASSb1r/eeeneeeeXeeeyDoDUDoDDf93o:BQvQAS6r/eeeneeeweeeyDoDUDoDDf94 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e2debfa1ac257c00 |
|
VISUAL
aHash
|
fffde0f070400000 |
|
VISUAL
dHash
|
4cc988858383cf1f |
|
VISUAL
wHash
|
fffcf4f471602080 |
|
VISUAL
colorHash
|
0ee00008000 |
|
VISUAL
cropResistant
|
08004d4d10006969,cb4949d39586cc4d,1313131300000000,004020d0d0200000,c988c581878bcf1f |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 46 techniques to evade detection by security scanners and make reverse engineering more difficult.