Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T172134570404964BE0186E1C6DA24AF0A76EE81FDBF27271A11F89F7E3DE3D24CD69605 |
|
CONTENT
ssdeep
|
768:nMgIErKY1IIfPWhCFMNe8hlCIORzmvlfZ+StskonDXOXSTf1P4LABLd4xeT:n/1IIfPWheMNBhl5OJmvqS6RnDeXSTfb |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9c22e5589716d537 |
|
VISUAL
aHash
|
ff00003c000000ff |
|
VISUAL
dHash
|
6183cc6870b22006 |
|
VISUAL
wHash
|
ff007e3c1c1810ff |
|
VISUAL
colorHash
|
3a200c00040 |
|
VISUAL
cropResistant
|
8040286767284081,6bcbdbb5154b0f2c,2000000200229696,0022446869680200,a396cc6970b2b020 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 52 techniques to evade detection by security scanners and make reverse engineering more difficult.