Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B0E3665342146A2E4437C3C075759B77D2BAD98FFAA70A404FDCC7B62AEAC50B81B52C |
|
CONTENT
ssdeep
|
1536:2m4VUgQmTa3MZo+Hd1+E001jjC3leYc8raAFOwRaoLxRfXjhb:2m4VOQsX3jZGOaEX9b |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9852f9af6983833a |
|
VISUAL
aHash
|
fd1c1c3011ffdf9b |
|
VISUAL
dHash
|
29b4fcf1636e3b33 |
|
VISUAL
wHash
|
fd1c1c1011bf8f8b |
|
VISUAL
colorHash
|
07003000180 |
|
VISUAL
cropResistant
|
29b4fcf1636e3b33 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 31 techniques to evade detection by security scanners and make reverse engineering more difficult.