Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12A32AFB421625DBB62C343F05A704BCFFACAA755CA57AE0593FD821A2BDBC41DD45220 |
|
CONTENT
ssdeep
|
192:fK7Xtp7er145DdbRw3fy92p6TDwAsEvQY:fKL/eR45DdafW2p6T/sEvn |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e598986d63c59267 |
|
VISUAL
aHash
|
8f87ffe3e1e3e3f3 |
|
VISUAL
dHash
|
3e3e4e4a4a4b424a |
|
VISUAL
wHash
|
8383c3e3e1e1e1e3 |
|
VISUAL
colorHash
|
07410000000 |
|
VISUAL
cropResistant
|
3e3e4e4a4a4b424a,4d6c294551514145,d9f1332ab22b3232,484e262f4e4f4f47 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 12 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)