Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1BE020EB019328E7B0797D2D57AB4AB3F72C6D290D1679941A1FCC31A2FC9F94EC90960 |
|
CONTENT
ssdeep
|
96:n9bP6MCLAHRoXBP+XlVWjYE7kgMBltYdsjltY/mP6MCLAHRofKltYdsjltYy:9M8xopO85kDB/Y0/YH8xofK/Y0/Yy |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b939c6c62dc3c2d2 |
|
VISUAL
aHash
|
ff8f8f8b8bffffff |
|
VISUAL
dHash
|
ab3a381633881000 |
|
VISUAL
wHash
|
c183838381f3f3f3 |
|
VISUAL
colorHash
|
07002000180 |
|
VISUAL
cropResistant
|
ab3a381633881000,030e44a109aa610b,c69293139381353d,8e972323eb0b968e |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 162696 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)