Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17F33603A61066A7F519392C6B7702B6EF7C6D289C7534A6A63E8C31D03D7EC0CD31962 |
|
CONTENT
ssdeep
|
768:AKWmmgL+IVUmNDWTGUaR6jW3PJFEXNJu06YyqaIvpgi5wPq:MDgL+I2mZkWfgXNAvzti5wC |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f66cc93f9134c229 |
|
VISUAL
aHash
|
f0f0f0c6868686fc |
|
VISUAL
dHash
|
e427242c2c2c2cd0 |
|
VISUAL
wHash
|
f0f0f0e6868686fc |
|
VISUAL
colorHash
|
03000008030 |
|
VISUAL
cropResistant
|
71301333333333c8,54d0c6c474646458,e427242c2c2c2cd0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 14 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)