Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13E13B8129304242A4D3313DCB9635B4E72AB625CDA27038167FF97683BCFD88A93759D |
|
CONTENT
ssdeep
|
768:gPLWLwLqKLvLjLpLuwLSLqcYQjVYekNtqVQXOkHbrhdXkXWeledR4kTqvdWiWHWR:2LWLwLFLvLjLpLzLSL2eHVQXOkHXSt0Y |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9fa01f6b84717b84 |
|
VISUAL
aHash
|
ffffffffbf000000 |
|
VISUAL
dHash
|
84715a9c4a4a4a72 |
|
VISUAL
wHash
|
fffffff708000000 |
|
VISUAL
colorHash
|
0e000038000 |
|
VISUAL
cropResistant
|
84715a9c4a4a4a72,a3b1998e86868688,c4c5c5c7c7839f9c,2802030100260606,959988a639696930,31b4a8b399d89a9a,35948c97e0c6c6de,43cce2445b5a5a7b |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)