Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18524096C93175BE65EA9225CA1E1008D302ED8A99FF27363D8FF4937389E8D441F07A4 |
|
CONTENT
ssdeep
|
3072:avrMTW4MTczGwapwanYQc0820D0j/cs9WkK0ybI8Z19:avZbYQcRD04s9WL19 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
969669cde969a0e8 |
|
VISUAL
aHash
|
3c3c3c3c3c3c0000 |
|
VISUAL
dHash
|
686c6c7868686003 |
|
VISUAL
wHash
|
ff3e3e3e3e3c0000 |
|
VISUAL
colorHash
|
02e00000000 |
|
VISUAL
cropResistant
|
0000080c0c080000,4b4f4e3070e88055,686c687868686403,0000101010100000 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 168 techniques to evade detection by security scanners and make reverse engineering more difficult.