Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T177A13472D164A927120386C4D575BB5DE2C3C78DDF03298AD2F1C3AA67DACA1CD261CE |
|
CONTENT
ssdeep
|
96:lEYjTMlEz3GwvrmANeSP8iAsdJfksnTf9s6ofisN3fv:lEYjTJrmC1BstX |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c9d63839d29598d5 |
|
VISUAL
aHash
|
d8e0fefef8090b00 |
|
VISUAL
dHash
|
b2c664c4c0d35aa3 |
|
VISUAL
wHash
|
d8e0fefefa090b00 |
|
VISUAL
colorHash
|
13401200000 |
|
VISUAL
cropResistant
|
062383c070b8ec36,69a9ab626466e2e3,3b393db49696d3d2,d88c8c988c8c8c88,acd48acad6aad2d2,dab2c4ccc4e4e66a,ba9e9cb0e1e2868a,b2c664c4c0d35aa3 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 13 techniques to evade detection by security scanners and make reverse engineering more difficult.