Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E913A533E24658135177D6C8F271571E6281C78DCB130B6663E887AD6FCECB6BE52288 |
|
CONTENT
ssdeep
|
768:LKsW0Ee8nOddz/KZ9G9rgcJccQCOeeeAed3XZCK/9l2eTy+7Mdxuee9ewe0uzf94:3VC8uxeeeAeVXfX2eTlee9ewe0dY1+mo |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
96306d324e395b9b |
|
VISUAL
aHash
|
00240c3c3c2c3c20 |
|
VISUAL
dHash
|
8dadf9fd69496962 |
|
VISUAL
wHash
|
04043cffff2c3c38 |
|
VISUAL
colorHash
|
02000038000 |
|
VISUAL
cropResistant
|
adad99ed69696962,8686616d6d6d8d8e,693964f031272b2b,4a4b86a42c2d6d61,a42549c3d2929230,044b82a6a4252569,802549c3d2929230,004b82a624252569,a02549c3d2929230,4a4b86a624256d61,a42549c3d2929230,044b82a6a4252569,802549c3d2929230,044b4b86a6a4242d,8225254943d2d292 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)