Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C0D2C77160605A3B42EB82C9B7A27B2DB2E74249C7450864C6FD83F94FD7E08DE33695 |
|
CONTENT
ssdeep
|
768:Heee3KcvWVnb8UyBqraOowTu87sOy2+y9BH4crIe:43Kcv+btemTu87sOy2+UBH4crIe |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c343bd3ab038e5b2 |
|
VISUAL
aHash
|
002000000000ffff |
|
VISUAL
dHash
|
48c0c0c0c8e4d300 |
|
VISUAL
wHash
|
007860706c70ffff |
|
VISUAL
colorHash
|
31000c00000 |
|
VISUAL
cropResistant
|
028080004c888000,08e0c0c0c8c8e4d2 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 8 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)