Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15C939523A3112103D17798D4B2376B8A73528A2ADA034E7077F8677AE5CFCB67711399 |
|
CONTENT
ssdeep
|
1536:bTW9U86GrspUXeUNUsMFR8eSMOIkMUvfUCUMwUGFdfsSsMAtUIUksnVFK4NK1Uis:/8SdCSbLV5kGKk222I2222222p/yGFfQ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e936cd303399c3cc |
|
VISUAL
aHash
|
c381fbc3c3c1fbf9 |
|
VISUAL
dHash
|
0323239b8b8bb3ba |
|
VISUAL
wHash
|
8181f9c1c3c1dbf9 |
|
VISUAL
colorHash
|
07200038000 |
|
VISUAL
cropResistant
|
0323239b8b8bb3ba,13936bf3222c3624,4b437198d8d08c4d,3e92db4bd31a2b2b,676b392b2b3323dc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)