Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T144931CB13245667F204383F1D718E62AA3C6D98DD7338D42E3E8832765CECE89D265A5 |
|
CONTENT
ssdeep
|
768:/QLWiZuqiSWRaWZeuJQOBNueWySiOVfxLWiZuqiSWRaWZeuJQOBNueWySiOVf/AT:w1HAa0Ige0T59UbKCOx9S06Ol |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bc3ee7c3b0189698 |
|
VISUAL
aHash
|
eb819f9fdfffffff |
|
VISUAL
dHash
|
4b2b3430b454300d |
|
VISUAL
wHash
|
00001e1e5e1effe7 |
|
VISUAL
colorHash
|
07180000200 |
|
VISUAL
cropResistant
|
4b2b3430b454300d,5a9989cbcd4d45e5 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 6 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)