Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1DF91A9308118D9AB18938AF1E7F2A7A6268DDB94F987130612F9C3780BDFDD4CD75840 |
|
CONTENT
ssdeep
|
48:9s6e9YXb42lfGGo1TUsVovCIz//kVl/NKEVn9TO0TG8xISc2+xXFj+FKT4b6fAa:9s1eb4yGLRVov3/mNLjxI9FCFKT4Wr |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b818c5efc7923938 |
|
VISUAL
aHash
|
ff8f8f8f8783cfff |
|
VISUAL
dHash
|
e13938383b3b3cc0 |
|
VISUAL
wHash
|
fd018787838386fe |
|
VISUAL
colorHash
|
06007200040 |
|
VISUAL
cropResistant
|
e13938383b3b3cc0,5d5d59b6a664a4a5,defeeeacf8f6b6b4 |
Victim enters credit/debit card details including CVV and expiration. Card data is captured and can be used for fraudulent transactions or sold on dark web markets.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)