Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T191837532E3971903907BD1C9B1714B1923918B89C7134B7567BD27BAFACECF63612298 |
|
CONTENT
ssdeep
|
1536:JcGUAeHiZlF/nLMeeeedceraw5epevepeKepeze7H7ZeeoepeseJeheuxgNgcQQ0:2bJQ3Tl4UbgdAJUpJtJWJ+JzMsAmTn3R |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c12e693c3eb1cc96 |
|
VISUAL
aHash
|
68707e4e527a6868 |
|
VISUAL
dHash
|
8aa6e494a492dad2 |
|
VISUAL
wHash
|
60707e7e5a7a6868 |
|
VISUAL
colorHash
|
01000038000 |
|
VISUAL
cropResistant
|
524e64344434b4b6,230302616e561929,5a5ab2b45a5a959a,5a5ab4b6945a9596,5a5ab2b45a5a959a,5a5ab2b4525a9596,5a5ab0b4525a959a,8aa6e494a492dad2,ab6a656765658501,da8ac5c3c2c7060a,ce4b5878696b3121,6424215961a18158,d7693248cccc446c,86b0f4989bc68c43,5aca87c3c3c2c507 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)