Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F133AFB15207151EEF63C6C6EA4E1E89A1C6E31AC3650C8EFBE64327DE4DD24BC2D518 |
|
CONTENT
ssdeep
|
768:yeDEctQin+mGX6a6Vk6h5yjSO/DGfLlBu4PQ0qRQvwOrJVAef6qldUnQpzheMo6H:95z5S8BkhD8H |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
92926d6d9692f22d |
|
VISUAL
aHash
|
06006e6e0e460000 |
|
VISUAL
dHash
|
bc7eccdcfccc9c38 |
|
VISUAL
wHash
|
0e0f7f7f1f6e0400 |
|
VISUAL
colorHash
|
300000001c0 |
|
VISUAL
cropResistant
|
a9a08091f252dada,f2e3e5e3e0dec79c,bc7eccdcfccc9c38 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 98 techniques to evade detection by security scanners and make reverse engineering more difficult.