Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D1F142B092249D3B25E3C2D1E7A467BB31E1C207D747166447FE83A98BDDC99DC27089 |
|
CONTENT
ssdeep
|
96:Tn7nq9M53qM1Zotif6qIi8/8j8p3yiqEBBtXMKbLw1xwZqvZ4AxTW5NPF/:Hn+M53mRNrBBtcbxwMv7xK5H/ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
92976d6c923c6c3c |
|
VISUAL
aHash
|
067c340e2c300000 |
|
VISUAL
dHash
|
d4c9cc6d48626408 |
|
VISUAL
wHash
|
3e7c7c3e3e7c3000 |
|
VISUAL
colorHash
|
38e00000000 |
|
VISUAL
cropResistant
|
00040a4d4d1a0182,d4c9cc6d48626408 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 98 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)