Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T159B38936A31047399A094BCCCBE1A919283F11DF67147798B62601B2FA2DCED5CBB1DD |
|
CONTENT
ssdeep
|
1536:uUGkxaRMOxvDLnqU/g1Sw1wyIXDOGNwKrS6KfJUlBY0Rf:uUULnqU/g1Sw1wzDOGN3rqUlBPRf |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ab53b469c3e103ec |
|
VISUAL
aHash
|
688404292103c387 |
|
VISUAL
dHash
|
d92c59db6bd72f2e |
|
VISUAL
wHash
|
ecdc0d693303c787 |
|
VISUAL
colorHash
|
30000e00000 |
|
VISUAL
cropResistant
|
0204081122448810,3b77eeddba74c890,a2a2a08e8f8c80a2,d92c59db6bd72f2e |
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Malicious code is obfuscated using 5 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)