Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A5729472F264AF370267C7CA6BB5ABFA7286C514DA8A067187F8436C9CDBCD0DC16105 |
|
CONTENT
ssdeep
|
384:aDTIOMYjBCdiCTDDCvmG1keMIuJJawhfZH:apB+z3DkmG1ke1oJLhf5 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c71a25663c38c7c7 |
|
VISUAL
aHash
|
006c7c3c74707233 |
|
VISUAL
dHash
|
84c8c8d8ccc5c2c2 |
|
VISUAL
wHash
|
007c7c7c7c707273 |
|
VISUAL
colorHash
|
38038000000 |
|
VISUAL
cropResistant
|
84c8c8d8ccc5c2c2 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 24 techniques to evade detection by security scanners and make reverse engineering more difficult.