Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17903B7326488663F45D38395B3604E9BF379834CC37A9AEDA4E9C3281B93C54CD769E4 |
|
CONTENT
ssdeep
|
768:7nJCQu83TxpheQa7zRNVkI4PIuZKRdzO7BUlbfPeQFXTsDxj7YNo/3tMFPVZ+Lkl:7nJCQucpheQa71NVkI4PIA2dzO7BUlbf |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9416ebeac8eac896 |
|
VISUAL
aHash
|
ff06060606fffffb |
|
VISUAL
dHash
|
71ecccecec7c3b13 |
|
VISUAL
wHash
|
fd060606060efff9 |
|
VISUAL
colorHash
|
0e000000180 |
|
VISUAL
cropResistant
|
0001856961c50162,a2e2e8e292690d8e,e0181f2c33131313,ececccccccececec,3ff4e06164672327 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 174 techniques to evade detection by security scanners and make reverse engineering more difficult.