Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T167E102E0C014EC3B5753C5E5A7B56B1B7295C349CF020E4853F853AB6BCACA0CE229A9 |
|
CONTENT
ssdeep
|
96:TkdhJ7QzH0XfeGnVA63ZtGrwF6OX+HFKuPaXez/JoYAVASZ8Q2R:QdhJ7QzH0X1nxptGrdN9ziRT8QM |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c7476d6d93931192 |
|
VISUAL
aHash
|
00003c3c3c00ffff |
|
VISUAL
dHash
|
6222696969164000 |
|
VISUAL
wHash
|
00427c7c3c00ffff |
|
VISUAL
colorHash
|
02007000000 |
|
VISUAL
cropResistant
|
6262696969964000,e8968e2a322aaad4,2aac8c0d88ac2724,d4ce6262a6622e96 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 63 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)