Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T182A210649A95A837096785D1A1F6AF0E33D7032EE7334F0142FE879E4FC5C81E866678 |
|
CONTENT
ssdeep
|
384:Z5yJC2EDipEk4VmEDiL9cQ1YysEYEDsJsEcEDsJsEkqfqxFfq2NdWp0WxrWGDiL:ZuwlRGJo/oU2qdWp0WRWke |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e3331c4ccccce363 |
|
VISUAL
aHash
|
0007e4fbfbffff00 |
|
VISUAL
dHash
|
743cc8c000888000 |
|
VISUAL
wHash
|
0007e0f8f8ffff00 |
|
VISUAL
colorHash
|
07000010003 |
|
VISUAL
cropResistant
|
f43cc8c002888000,3434b03474744448,6398889ac0ca7901 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)
Found 1 other scan for this domain