Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E263B86011735AAB029383D1F6769F9DE0C08340D37B8B69B3FC866F6ECED449D95262 |
|
CONTENT
ssdeep
|
768:L34tQiEsgIsPcbc2WOh04L35COKhEY95HV6vybVRIIII7:87EsgIsPcbc2WOhLi9pV6KbVRIIII7 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bbd74d28119594d5 |
|
VISUAL
aHash
|
02a4fe4cc5818100 |
|
VISUAL
dHash
|
b64d4c9919252712 |
|
VISUAL
wHash
|
02f5fecfcdc78100 |
|
VISUAL
colorHash
|
300000084c0 |
|
VISUAL
cropResistant
|
b64d4c9919252712 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 114 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)