Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12F732122781E056FB147D3C5A2F4FAA7DD51CD0ADE300E40EAA59FCECA91F12B675218 |
|
CONTENT
ssdeep
|
768:YhTT8b+4VgLZprDdB7N719YY48qMKAC+JSqwv0EUqWQj7:yTh4Vjj7 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
86973f6968622d95 |
|
VISUAL
aHash
|
00be7e7479180000 |
|
VISUAL
dHash
|
d568ec85b3f35c13 |
|
VISUAL
wHash
|
00be7f777f183c00 |
|
VISUAL
colorHash
|
30000038000 |
|
VISUAL
cropResistant
|
20889898b2b5e5c5,db7aa52723a5ed2b,cf3a7b69b2b0430e,dc989892b2b8b2a6,165757529231484b,3d71c9b8dae6ef7a,d568ec85b3f35c13 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)