Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14A337590B1A3AD33411FD58AA02A631C53D2EB8DCFD23AF165FD4365C6E3CA47B92158 |
|
CONTENT
ssdeep
|
1536:mfh4FcLk93bcb+rOhQygOc5Dzxq8k+6/Xd:mfhXk93m+rOCy/cxy/N |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d36d92633c926d1c |
|
VISUAL
aHash
|
6060000000607e7e |
|
VISUAL
dHash
|
d0d0104000c9c9cc |
|
VISUAL
wHash
|
7c780000007fffff |
|
VISUAL
colorHash
|
38600018000 |
|
VISUAL
cropResistant
|
f0e8a48c0e0e3637,d0d0104000c9c9cc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 193216 techniques to evade detection by security scanners and make reverse engineering more difficult.