Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E574C3F6173C53DC5887CBBEEF2AA595231FB0FD79A584D45A1E8BA851838D8E007E40 |
|
CONTENT
ssdeep
|
3072:7LL+2jCQnv8lRFLE9lHORlyEDbRhnhGZp4dNH+p6+tyv0Qyz01w:PUFaRqGyvB2 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9dcb002420bfdbf5 |
|
VISUAL
aHash
|
1838bd99c383c318 |
|
VISUAL
dHash
|
b63073330a2e1636 |
|
VISUAL
wHash
|
183cbd9dc3c3c31a |
|
VISUAL
colorHash
|
31c00400000 |
|
VISUAL
cropResistant
|
6878b070ecfcb9bc,b63073330a2e1636 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 1330 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)