Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T197A3CC23411935274437C2C134AA5B3BE1A6D99FFAE70A404EECCBFA6BF9C90745B119 |
|
CONTENT
ssdeep
|
768:wuDMtpR4nXF6YjOpSpFlTC6rrsV5sfU8IEm:wuwtpR4nXBKpSpFl26vAOfU8IEm |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8339ecc6eb1c9163 |
|
VISUAL
aHash
|
ff000e0e7e7e00ff |
|
VISUAL
dHash
|
d9cfdce8ccec6c8b |
|
VISUAL
wHash
|
ef000e0c7e7e00ff |
|
VISUAL
colorHash
|
11006000040 |
|
VISUAL
cropResistant
|
b494e8cc829692f6,d500000000000000,d8cfdcf8ccccec67 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 113 techniques to evade detection by security scanners and make reverse engineering more difficult.