Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1DD93F770E42451FA00E312D1A5682FE9B3E1A384EBD30A59A3F8C3DE9BD6D44DD2715E |
|
CONTENT
ssdeep
|
1536:r/PBVQFoVoUJ6TVYQW1ro1InCZCAFfF0fceR0yVctf/VLtOb5o3yNTdtX:LPQrXCAFehPX |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8f46f139f238741c |
|
VISUAL
aHash
|
bd3f1f1f1f1f0fff |
|
VISUAL
dHash
|
49e8ecf1f176724c |
|
VISUAL
wHash
|
003f1f1d1f0f00ff |
|
VISUAL
colorHash
|
06c00008000 |
|
VISUAL
cropResistant
|
4de9e6f17176724c,0000083032300810,9b735b9d9ddf6e3b |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 26 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)