Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14923D73408C96F2B5193D2C9D311B71BE3E1854CE67A864DF9DAC31E0AC5D88D86BF98 |
|
CONTENT
ssdeep
|
768:TIcqNhBnC7n1PdT2IKXC3iVpyyiO/zmNA65hRgu4sZnH7LMx3n39EH:TIcqNh5C7n1Ph2bSiV8O/zVcDxZnK3n+ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9414ebcac9fac896 |
|
VISUAL
aHash
|
fd0606060606fffb |
|
VISUAL
dHash
|
61ccccccecec1833 |
|
VISUAL
wHash
|
fd0606060606fffb |
|
VISUAL
colorHash
|
0e000000180 |
|
VISUAL
cropResistant
|
0001497161490152,96d6e8b284710f8e,c0183a0c2f333313,ccccccccccececec,fcfef9f3d3d59692 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 174 techniques to evade detection by security scanners and make reverse engineering more difficult.