Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18DE31AB5321411857103C3E4F211BB68D2DBB39BDB26C5D8E2EA9760FFD5C3A951BA80 |
|
CONTENT
ssdeep
|
1536:ZvT4s6w6gU1nd7FrD35XAgGbMuk/kqj5j0B/4pqpqsq7LnaiL0N:xT56+uuk/kqj5j0B/4pqpqsq73AN |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
92166d49bb6d1e92 |
|
VISUAL
aHash
|
00040e0c6c346203 |
|
VISUAL
dHash
|
d0ccecdcc8cdd6cb |
|
VISUAL
wHash
|
4c060e0e7e7c7e03 |
|
VISUAL
colorHash
|
1e601000040 |
|
VISUAL
cropResistant
|
f4e9da78e1e933cf,a8e454ccdcf0b0d0,d0ccecdcc8cdd6cb |
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Malicious code is obfuscated using 131092 techniques to evade detection by security scanners and make reverse engineering more difficult.