Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T197E2E8749068293F92EF1ADEB5762B0D76D2C709DA0398449EFC869407EBC11F5832DE |
|
CONTENT
ssdeep
|
768:koDaeJEfiBriaMbiYMIiVMaVKcscaVKKGCg+A4lYiq1rey+yW:koBEfSONed/VMaUcscaUKf+4hy+b |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8393395b9f6d60c2 |
|
VISUAL
aHash
|
0f07673f3c000003 |
|
VISUAL
dHash
|
dbdfcde86961076f |
|
VISUAL
wHash
|
0f0f6f7f3f010107 |
|
VISUAL
colorHash
|
33c03000000 |
|
VISUAL
cropResistant
|
3f7f3bd91e46030b,c8212d8a67e3f8de,cc04a3c1e06561f9,e0e0c4e3c388ca88,bc7cee93d0b7321a,dbdfcde86961076f |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 220 techniques to evade detection by security scanners and make reverse engineering more difficult.