Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T191D2DA30A804EC3641CFA9D9A672466662F98346C6130688FAF5C3F95BEFD6CCB33514 |
|
CONTENT
ssdeep
|
384:1Hg/iUsJO5xVZjqTS/d1JwONA/bYd7I2XXc8TdMmqgroUa879ft:m5sIx/jqONA/w7IosmMmGUf79F |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c2c41ebc196dee16 |
|
VISUAL
aHash
|
3c3c74687eff0004 |
|
VISUAL
dHash
|
f4e0e0d8d850cc6d |
|
VISUAL
wHash
|
3e3c7c7c3cff0004 |
|
VISUAL
colorHash
|
193c0000000 |
|
VISUAL
cropResistant
|
7cdcdcac1c3e1e2e,1c9caaa2b3a28e8e,e3e27272666a2606,63514160f6f0e0f0,d8d8d8d8d8500000,f4f0e8e4e0d0d8d8,20c8d3ececec4d6d |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 75 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)