Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16BE29632924096274193F2D5F672E74BBB428386CE5306F1E2E49359DBCBDA9CF52348 |
|
CONTENT
ssdeep
|
768:f78VnV2J4Dc0AyOw6DGnjgQmRj0V/OBvYzFHez3E9XSld4j4R+y093laVaVfGSip:fOwWDc09Ow6DGnjgQmRj0V/OBvYzFHYN |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b36c6c61613393ce |
|
VISUAL
aHash
|
83c3ff6e7c6c4c4c |
|
VISUAL
dHash
|
8696595959599999 |
|
VISUAL
wHash
|
c3c3ff2c3c2c0c0c |
|
VISUAL
colorHash
|
06c00008000 |
|
VISUAL
cropResistant
|
8696595959599999 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 31 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)