Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T167C1737291040D1E8110C390EEEAF78B4A57D865C7218EA9D5AC8BDA9AC8F74E27320D |
|
CONTENT
ssdeep
|
48:ZXL2zVuwSonL2zVuD/Wn2zVuw430eI0GiTC686Pc0c2TNPmwNDxmwNA0LLbvjEmx:545So4oWEQ30ibHvD60L4t1i6bUtNXW2 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cc4e3333646667cc |
|
VISUAL
aHash
|
0018181818181800 |
|
VISUAL
dHash
|
8532b2b2b2323230 |
|
VISUAL
wHash
|
001818181cdfffff |
|
VISUAL
colorHash
|
38400030000 |
|
VISUAL
cropResistant
|
8532b2b2b2323230 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.