Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10F836732D393191390ABD1D4B172474933928789CB134BB577FD23BAF9CECB52622298 |
|
CONTENT
ssdeep
|
1536:QNDFJV0kee8XeSXehVPUgOq61ezdpgJMeUkeeIdqtSAQC0rSWSzsjM/59EfHI7bH:Z1oPUgOq6pu6iJYRk222I2222222OJdU |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b2cdc73930938ccd |
|
VISUAL
aHash
|
fff17f46c1c147c5 |
|
VISUAL
dHash
|
c0e7e48c8f8d8c8d |
|
VISUAL
wHash
|
fff17e4645404645 |
|
VISUAL
colorHash
|
02200038000 |
|
VISUAL
cropResistant
|
c0e7e48c8f8d8c8d,9192b2b0a9a0a2f2,01d924f035172b2b,d7693248cccc452c,676d4f7747597b23,9793d6c469239171,4743712d31302061 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)