Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FB637532918698139197D2D8F1708B0E3381C785CB174B6563F967BFBECACB5AE1129C |
|
CONTENT
ssdeep
|
1536:FHyhbdjkrGBz91t1V+KLu131C16oul171l1h10LisBy3Z7hyeeeewyeqeMeeeeHk:oPV+KLUlI6ooZHD7h12xL0VT+g83EDI8 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
93cd363193c99669 |
|
VISUAL
aHash
|
3430787a40464646 |
|
VISUAL
dHash
|
6967e2d29a88988c |
|
VISUAL
wHash
|
f1717e7a42464e46 |
|
VISUAL
colorHash
|
02200038000 |
|
VISUAL
cropResistant
|
6967e2d29a88988c,cef4649866f83535,d9733369332f3726,2764e7f7e3ca6823,d7693248cccc442c,9597e328d0e0f090,9793d6c569a27171 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)