Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18A0221B025724E7B0797C2D1B7B46B3EB5C69250D653DA41A2FCC31A2FCEE90EC84664 |
|
CONTENT
ssdeep
|
96:n9bP6MBLDHRoXBP+ilVWjYE7kgMBlt1dsjlt1/mP6MBLDHRofKlt1dsjlt1y:9vfxopZ85kDB/10/1qfxofK/10/1y |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b939c6c62dc3c2d2 |
|
VISUAL
aHash
|
ff8f8f8b8bffffff |
|
VISUAL
dHash
|
ab3a381633881000 |
|
VISUAL
wHash
|
c183838381f3f3f3 |
|
VISUAL
colorHash
|
07002000180 |
|
VISUAL
cropResistant
|
ab3a381633881000,030e44a109aa610b,c69293139381353d,8e972323eb0b968e |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 179487 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)