Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10883A82370D51036A1B7A1CCDA16BB1E62D783CADA478FC0B7FC1169DFC6DA0B922159 |
|
CONTENT
ssdeep
|
1536:Jgnpbo93tSSYyhrHWl7FOLfmPbzRCMFzSPwptQWm7kUGEWu9I6tZJ:Jgne93tSSYyhrHWl7FOLfmPbzRCMFziB |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ec4ee8933386ae86 |
|
VISUAL
aHash
|
581010006effffc3 |
|
VISUAL
dHash
|
b3b2262ecc169f9b |
|
VISUAL
wHash
|
f81010006effffc3 |
|
VISUAL
colorHash
|
06c00000000 |
|
VISUAL
cropResistant
|
b3b2262ecc169f9b,64b2a6a46dadaccc,cd8d9d9d0c7cf058,c38180627273d454,296daca89c9c5a7a |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 361 techniques to evade detection by security scanners and make reverse engineering more difficult.