Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10BE113E0C015EC3B5763C5D5A7B56B1B76A5C349CF020E4453F893AB6BCACA0CE229D9 |
|
CONTENT
ssdeep
|
96:TkdY7QzH0XfeGdVvfSZtGPFdQ5XT5HFMuPqXcz/2YwVvfSZ8Q2R:QdY7QzH0X1dhotGKP3z+Tho8QM |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c7476d6d93931192 |
|
VISUAL
aHash
|
00003c3c3c00ffff |
|
VISUAL
dHash
|
6222696969164000 |
|
VISUAL
wHash
|
00427c7c3c00ffff |
|
VISUAL
colorHash
|
02007000000 |
|
VISUAL
cropResistant
|
6262696969964000,e8968e2a322aaad4,2aac8c0d88ac2724,d4ce6262a6622e96 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 55 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)