Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FC41F06062516D2DA5D184A7E3103E6687C0C5E583B919044A8B9F9FACC94F4EE233EE |
|
CONTENT
ssdeep
|
48:5hzThGxR9VPSe+Mw/n0VdGOpjJIVdr+VjXVsA8:/zTI36LM8YUEjJs9gjXS |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e699996633266699 |
|
VISUAL
aHash
|
ffffe7e7e7e7ffff |
|
VISUAL
dHash
|
0c004d4d4d4d000c |
|
VISUAL
wHash
|
0f0f070707073f3f |
|
VISUAL
colorHash
|
07000038000 |
|
VISUAL
cropResistant
|
0c004d4d4d4d000c,b08c8a8a929686aa,a8b2baa880b2a082,dce0696994b8f071 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)