Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13F5250395138DB1F0093C6F4A7316BBA33C2D29EF60642519AFE876D9AE7C81DC5B085 |
|
CONTENT
ssdeep
|
96:T+u6tD930cHlfO7PRyhvwiSHShvwiS6fzUf4X/fo4YhvfNf2UYP+LR+faHhvENfC:AtD9l4ZyoHSo4VYcP+LR8aH5Cu/JsOb |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
aa55bc4ec35302fc |
|
VISUAL
aHash
|
c6922e6c3001c3c3 |
|
VISUAL
dHash
|
0c2654c8e9631b27 |
|
VISUAL
wHash
|
c6d22e6c7931c3c3 |
|
VISUAL
colorHash
|
30000c00000 |
|
VISUAL
cropResistant
|
3bb7aeddb264c890,a2a2a08e8f8c80a2,0c2654c8e9631b27 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)