Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A773D8316845AA3703A351C69D68FB5D73C6A389CF124F91B5F84639ABD3FB198030AD |
|
CONTENT
ssdeep
|
1536:JwfzbN2TDGCi2UyZLymXdA7zvjhao5FhwR8RZlXXGwnQkFODVeQ9AaVJIwYrr+u:JwfzbcFy+A7zvjhaWFhwR8RZlXWwnQbU |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c73838c76683c73c |
|
VISUAL
aHash
|
00003c3c343c3c00 |
|
VISUAL
dHash
|
4830684d4d496817 |
|
VISUAL
wHash
|
0088fefe7e7e3c00 |
|
VISUAL
colorHash
|
39200011001 |
|
VISUAL
cropResistant
|
4989939683828c98,5cd8c2e159593999,9cdad8d5495c5ccc,4830684d4d496817 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 507 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)