Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15123D93118D4273F529383C99310AB5BF3998244A3BAC989F2EBC71F46C5D58D877A78 |
|
CONTENT
ssdeep
|
768:Kwc+9ig46cv2bQTF32Blt2LHO/+H/Fqxsv7TSlqGx++ORSQcJ3KEJiv:Kwc+9igov+QR3olkHO/+H4xs/v9rcJ34 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9414ebcacbbac896 |
|
VISUAL
aHash
|
fd0406060606fff9 |
|
VISUAL
dHash
|
61ccecccecec1b13 |
|
VISUAL
wHash
|
ff0606060606fff9 |
|
VISUAL
colorHash
|
13000000180 |
|
VISUAL
cropResistant
|
002149617149014a,96d6e8b284710f8e,e0181b2c3b131313,ccecacecccecccec,537332f3f373f6cf |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 174 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)