Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FD62B871765119BB719B49EEF6302FBAB2E9860ECE279D85F3FC8AC197C0C548E12510 |
|
CONTENT
ssdeep
|
384:YyStFD141sAaQ+0D6dawG4wOvoV7GiNqaOsk/i8ReC0uZSANcai1VvJ2MB0ZzztN:Yb141sAaQrOdawfwOvoV7GiNqaOH/i8f |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
fc07395a4b584d59 |
|
VISUAL
aHash
|
00d3f3ffffdfdfcb |
|
VISUAL
dHash
|
f037a6e6c0b43e2a |
|
VISUAL
wHash
|
000313fffcdec2c3 |
|
VISUAL
colorHash
|
06406008000 |
|
VISUAL
cropResistant
|
4000c06060600000,b7b6e6c0c0b43a2a,91b0b0f093655550 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 21 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)