Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T192234B726332B87843DFA1DEF7382955A2D2999DF9C74690B1C99ACD13C3C802197BB4 |
|
CONTENT
ssdeep
|
768:az+EsZx8/G8dy14lDaw4M5B/wPM5BiwzqN2/y9dGDUDF1E56ITmH+LXPnTyPqDvQ:az+EsZ/8dy+lDaw4M5B/wPM5BiweN2/s |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9669e969b0963996 |
|
VISUAL
aHash
|
003c3c3c3c003c3c |
|
VISUAL
dHash
|
2be0e8e8e870e0e8 |
|
VISUAL
wHash
|
ff3c3c3c3c003c3c |
|
VISUAL
colorHash
|
030000001c0 |
|
VISUAL
cropResistant
|
000c083969696971,a6a24d6c604dcc51,a62582a4454da460,69e0e8e8e870e0e8 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 18 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)