Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FB838822D3931903907BD1D9B0724B4973528789CB174FB967FD23BAF9CECB52622198 |
|
CONTENT
ssdeep
|
1536:KvtnioBee4XeSXecVPUgOq61eLFngxLeIkeekdy1CYQC0DubbY5zM8hzM8FI4Lc/:v1VPUgOq6f5q4U8qk222I22222229Ocf |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f4cd8729389392cb |
|
VISUAL
aHash
|
fff6fec6c3c6c7c6 |
|
VISUAL
dHash
|
c6a4cc8cae8c8cac |
|
VISUAL
wHash
|
ff62ff44c340c446 |
|
VISUAL
colorHash
|
03200038000 |
|
VISUAL
cropResistant
|
c6a4cc8cae8c8cac,9192a2b0a9a0a2b2,099964f031272b2b,95e3b6366c489698,95e3b6366c489698,d7693248cccc442c,2565477747496921,94e3b2366c489698,94e7b23626688d16,9793d6456b827171,0f43312c30202025 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.