Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T140918770D118D9AA18938AE1EBB2A7E6268DDB58E987130612F9C3680FDFDD4CD75440 |
|
CONTENT
ssdeep
|
48:pV/s6e9YXb42lfGGo1TUsVovCIz//kVl/NKEVn9TO0TGlEg2+xXFj+FKT4b6fAa:pV/s1eb4yGLRVov3/mNLqEGFCFKT4Wr |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b818c5efc7923938 |
|
VISUAL
aHash
|
ff8f87878783cfff |
|
VISUAL
dHash
|
e13938383b3b3cc0 |
|
VISUAL
wHash
|
fd018787838386fe |
|
VISUAL
colorHash
|
06007200040 |
|
VISUAL
cropResistant
|
e13938383b3b3cc0,5d5d59b6a664a4a5,defeeeacf8f6b6b4 |
Victim enters credentials into 1 fake form. Form data is captured via JavaScript or backend submission and transmitted to attacker's server for account compromise.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)