Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B9E32C303359793E95A347D2E1AA332672BE831ED50F8C14B3A8D5AA13D9C496533FD8 |
|
CONTENT
ssdeep
|
3072:/W2SOKnWYcwqjgI7+MRH5uwqjgI7+MRH5sUEX8VMAIGvnAK1toF:uSMzNvnAK1toF |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c34bb87bba0ac3c2 |
|
VISUAL
aHash
|
ff002000000000ff |
|
VISUAL
dHash
|
0bc8c8ccc8c8a784 |
|
VISUAL
wHash
|
ff0078240060ffff |
|
VISUAL
colorHash
|
31406000000 |
|
VISUAL
cropResistant
|
000b4b4b4b2b0b14,adad80008000001a,31c8c8cce8c842a1 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 23 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)