Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16181762195009E33C893D5E8FAE66B07B5C0C204C7835609E6F5B36D9FDBD45CEA06A6 |
|
CONTENT
ssdeep
|
48:Gu6PpRjHgRwjN1+J2RGOTVNn0KpWK6YnNQOVBSo5MeYoRnND2e6kFW98K48mWFCA:GusPjHsYOwVxx6mBS3eYltxFo8D |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b44b4163433d4d77 |
|
VISUAL
aHash
|
00ffdf87a7838387 |
|
VISUAL
dHash
|
882c362e2e262626 |
|
VISUAL
wHash
|
00ff9f8b87838387 |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
882c362e2c262626,00004040404085ca |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 7 techniques to evade detection by security scanners and make reverse engineering more difficult.
| ID | Portuguese | English | Trigger |
|---|---|---|---|
Pages with identical visual appearance (based on perceptual hash)