Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16FA183326048685E5196C692A6F2FF26C3A9C150C6600D90D19D0FDF6EC5FA4E6F339E |
|
CONTENT
ssdeep
|
96:vnuj1SujyGw10aV2UtXXrU0dcIdXUtYwEuFAFNQL7:vny4yyGw10atyVFFEQL7 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cc33659333cc3399 |
|
VISUAL
aHash
|
001818181c3c3818 |
|
VISUAL
dHash
|
707070b07971b071 |
|
VISUAL
wHash
|
1c3cbc3c3c3c3c3c |
|
VISUAL
colorHash
|
30200030200 |
|
VISUAL
cropResistant
|
dfdec48c88089694,d2f6e7634d079bb9,4b7033d2f0cecee8,707070b07971b071 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)