Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T182235B726332B8B883DB91EEF7382D46B2D5588DF8C74454B5C96A8D23C3C816197BB4 |
|
CONTENT
ssdeep
|
768:aV+EsZx8/G8CRF4YDatmM7B5tcM7BX7Ucix+y9dQpUDF1E56ITmHDLBABW8KPqDS:aV+EsZ/8EOYDatmM7B5tcM7BX7UXx+yB |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bf307034b6b4e04f |
|
VISUAL
aHash
|
8383bf8f9f879fbf |
|
VISUAL
dHash
|
2f736b7f63677563 |
|
VISUAL
wHash
|
819b898f8b8389bf |
|
VISUAL
colorHash
|
07000000000 |
|
VISUAL
cropResistant
|
2f736b7f63677563 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 17 techniques to evade detection by security scanners and make reverse engineering more difficult.