Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1EF234A726332B87843DBA1DEE7392A05B2D2999EB8C74594F1C55ACD23C3C902197BF4 |
|
CONTENT
ssdeep
|
768:aa+EsZx8/G87042DawWMJBSwnMJBsUcix+y9dQpUDF1E56ITmHDLBABW8KPqDvt6:aa+EsZ/87v2DawWMJBSwnMJBsUXx+y93 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ba2ecd3ac1e39285 |
|
VISUAL
aHash
|
818185858585ffff |
|
VISUAL
dHash
|
61296d4d4d4d2d02 |
|
VISUAL
wHash
|
818185858585ffff |
|
VISUAL
colorHash
|
06c08000000 |
|
VISUAL
cropResistant
|
61296d4d4d4d2d02,146a6a90e4789c2e,84b692808282f0ec,d8d27d5cb434989b,9193aca1a1231606,91a889b8b889a8f3,40606ccc8c8ccc6c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 18 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)