Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19693F8A074C95A3A5A93B3A06730FAC0B76AF355C35BCB0D93F4824B76DAD81C90D674 |
|
CONTENT
ssdeep
|
1536:absRHoG0rLqPNB3aWxKAg0MfVYu0uKWKY7g97pclw0dt2qnG:cuBqyHMA/nY7y7p+3e |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
aa5af4f5110c1ed6 |
|
VISUAL
aHash
|
00800001fffffbff |
|
VISUAL
dHash
|
9c4d696b9937271c |
|
VISUAL
wHash
|
00800101ffdff3ff |
|
VISUAL
colorHash
|
06002600008 |
|
VISUAL
cropResistant
|
9c4d696b9937271c,0174784804183911,8181619191410181,0001010101010100,8382212143439286,5c26e627474d1387 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 31 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)