Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17C139333E24659130167D5C8F2715B5E6281C789CB130F6673EC97AD6ECECB6BE12288 |
|
CONTENT
ssdeep
|
768:D0dA0EUtn/05XsPCOG9VDq5DROeeeAedpXZTJdnd72eKy/YJWgGee9ewe3uUpnXm:EXFQeeeAerXv2eKAee9ewe3v1+mKQ2+q |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
96306d324e395b9b |
|
VISUAL
aHash
|
00241c0c3c2c3c20 |
|
VISUAL
dHash
|
adadf9fd6d496962 |
|
VISUAL
wHash
|
04243cffff2c3c28 |
|
VISUAL
colorHash
|
02000038000 |
|
VISUAL
cropResistant
|
adadb9fd69496962,8686616d6d6d8d8e,693964f031272b2b,4a4b86a42c2d6d61,a42549c3d2929230,044b82a6a4252569,802549c3d2929230,004b82a624252569,a02549c3d2929230,4a4b86a624256d61,a42549c3d2929230,044b82a6a4252569,802549c3d2929230,044b4b86a6a4242d,8225254943d2d292 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)