Maldoc Templates - NetWire, TrickBot, SilentBuilder, AgentTesla, AveMariaRAT, SnakeKeylogger, njrat, NONE, ZLoader, Dridex, Loki, Quakbot, RemcosRAT, FickerStealer
Total unique groups: 25
Total unique maldocs: 305
Total unique images: 101
Data from Malware Bazaar Abuse.ch https://mb-api.abuse.ch/downloads/.
Please note that image names are the MD5 hashes of the original document they were contained within.
Overall graph of images, 90% similarity
Total images: 14
Extracted OCR: None
Total images: 2
Extracted OCR: This, document, protected!, view, this, content, please, click, “Enable, Editing”, from, yellow, then, Content”
Total images: 27
Extracted OCR: None
Total images: 22
Extracted OCR: DocuSiger, open, document, follow, these, steps:, This, only, available, desktop, laptop, versions, Microsoft, Office, Word, Click, Enable, editing, button, from, yellow, above, Once, have, enabled, please, click, content
Total images: 6
Extracted OCR: elias, Microsoft, Office, 2019, DIESES, DOKUMENT, WURDE, EINER, FRUHERER, VERSION, MICROSOFT, OFFICE, WORD, ERSTELLT, IHRE, KOPIE, WIRD, AKTIVIERT, KLICKEN, HIER, DIESEN, INHALT, ANZUSEHEN, AKTIVIEREN, BEARBEITUNG
Total images: 1
Extracted OCR: open, follow, these, This, document, only, available, desktop, laptop, versions, Microsoft, Office, Word, Click, Enable, editing, button, from, yellow, above, Once, have, enabled, please, click, content
Total images: 2
Extracted OCR: Keita:, This, document, created, online, version, Microsoft, Office, Word, view, edit, this, please, click, «Enable, editing», yellow, after, content»
Total images: 1
Extracted OCR: Excel, Oops, something, went, wrong, This, document, protected, Open, Microsoft, Office, Previewing, online, documents, this, downloaded, from, your, email, please, click, Enable, Editing, yellow, above, Once, have, enabled, editing, Content
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: cifibanamexg, BancaNet, Empresarial, emanate, renee
Total images: 3
Extracted OCR: Excel, Oops, something, went, wrong, This, document, protected, Open, Microsoft, Office, Previewing, online, available, documents, this, downloaded, from, your, email, please, click, Enable, Editing, yellow, above, Once, have, enabled, editing, Content
Total images: 4
Extracted OCR: Microsoft®, Office, Oops, something, went, wrong, This, document, only, available, desktop, laptop, versions, Microsoft, Word, Click, Enable, editing, button, from, yellow, above, Once, have, enabled, please, click, content
Total images: 1
Extracted OCR: This, document, protected, Microsoft, Open, Office, Previewing, online, available, documents, this, downloaded, from, your, email, please, click, Enable, Editing, yellow, above, Once, have, enabled, editing, Content
Total images: 1
Extracted OCR: SECURITY, WARNING, Macros, have, been, disabled, Enable, Content, This, file, created, with, version, software, Please, above, view, this
Total images: 2
Extracted OCR: Microsoft’, Offices=, This, document, protected, Open, Microsoft, Office, Previewing, online, does, work, documents, downloaded, this, from, your, email, please, click, “Enable, Editing”, yellow, above, Once, have, enabled, editing, Content”
Total images: 2
Extracted OCR: Micresoft, Excel, Oops, something, went, wrong, This, document, protected, Open, Microsoft, Office, Previewing, online, available, documents, this, downloaded, from, your, email, please, click, Enable, Editing, yellow, above, Once, have, enabled, editing, Content
Total images: 2
Extracted OCR: GLOUHOOM)
Total images: 2
Extracted OCR: Document, created, earlier, version, Microsoft, Office, Excel, view, this, content, please, click, "Enable, Editing", form, yellow, then, Content"
Total images: 1
Extracted OCR: Goriintilemek, istediginiz, ddkiimant, seci
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: This, document, protected, (DHL, SECURITY), order, protect, information, from, unsecure, access, please, click, “Enable, Editing”, proceed, clicking, button, Content", [ENABLE, CONTENT], DELIVERY, INFORMATION, [Enable, Conte, Deter, Aasress, Content, ‘Scheduled, Devry, Dato, Dotver, Time, Coren, ‘YOUR, CONTACT, DETAILS, number, adstess, ‘Thankyou, using, Demand, Dstven, Express, Excoence, Simply, delved, NpH6ansuTenbHOe, 4HNCNO, 3HaKoB, -————, 100%
Total images: 1
Extracted OCR: None