Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B064FAF5539861ED9507CBD4EB329920734F74BFBB52C68446AC8BA4E6578B8DC0EC80 |
|
CONTENT
ssdeep
|
3072:yShUDMXXJ2MmrzWT+1GEg7xHd85nK2DZ5XiyFcG:P/J22+1GEg1c |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
99b560121b379737 |
|
VISUAL
aHash
|
00dbffff1c1c0000 |
|
VISUAL
dHash
|
94b24e7379f11533 |
|
VISUAL
wHash
|
00dbffff3d3c0010 |
|
VISUAL
colorHash
|
00000010006 |
|
VISUAL
cropResistant
|
6af8faa6ed69e464,9998a4aeab999a18,5555d15195381830,94b24e7379f11533 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 11236 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)