Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T100C16A71A186BDB3015386E09737572BB6D0864ACE57061187F883EEBFDACA4EE1B150 |
|
CONTENT
ssdeep
|
48:pStC88DH3CXkDHRhDHWfsDHGXkDH3G2rZMDKmIBQZBQLBYHWcDID84TVHzh5gyDN:fSDuMmu4ZT4Hfe+vFTQWa |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e46431c6733974ce |
|
VISUAL
aHash
|
c3c3c3c3e3e3e7c3 |
|
VISUAL
dHash
|
9696969e0686969e |
|
VISUAL
wHash
|
c3c3c3c3c3c3c3c3 |
|
VISUAL
colorHash
|
07201010000 |
|
VISUAL
cropResistant
|
9696969e0686969e,a58d5be3d290a8a2,9a867169696912a4,cc3196c4aaac6143,39ce5f7ceff79ecb,969d56545098b49c,b4b39535b4b5b555,33728cce8eccceaa |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 27 techniques to evade detection by security scanners and make reverse engineering more difficult.