Maldoc Templates - Gozi, BazarCall, SilentBuilder, Quakbot, Loki, CobaltStrike, SnakeKeylogger, TrickBot, AgentTesla, Dridex, NONE, Hancitor
Total unique groups: 21
Total unique maldocs: 354
Total unique images: 124
Data from Malware Bazaar Abuse.ch https://mb-api.abuse.ch/downloads/.
Please note that image names are the MD5 hashes of the original document they were contained within.
Overall graph of images, 90% similarity
Total images: 9
Extracted OCR: None
Total images: 8
Extracted OCR: DocuSiger, open, document, follow, these, steps:, This, only, available, desktop, laptop, versions, Microsoft, Office, Word, lick, Enable, editing, button, from, yellow, above, (Once, have, enabled, please, click, content, Click, Once
Total images: 5
Extracted OCR: follow, these, This, document, only, available, desktop, laptop, versions, Microsoft, Office, Word, Click, Enable, editing, button, from, yellow, above, Once, have, enabled, please, click, content, open
Total images: 2
Extracted OCR: Excel, Oops, something, went, wrong, This, document, protected, Open, Microsoft, Office, Previewing, online, available, documents, this, downloaded, from, your, email, please, click, Enable, Editing, yellow, above, Once, have, enabled, editing, Content
Total images: 36
Extracted OCR: Microsoft, Excel, Office, THIS, DOCUMENT, PROTECTED, Previewing, available, protected, Documents, have, press, “ENABLE, EDITING”, CONTENT”, buttons, preview, this, Document, HHiNitarersteris, seem, CMe), esas
Total images: 1
Extracted OCR: None
Total images: 33
Extracted OCR: Microsoft, Office, Home, Business, 2019, Ultimo, aggiornamento, file, Word, 2021, Importante:, causa, dell'ultimo, necessario, cliccare, volte, permettere, corretta, visualizzazione, visualizzare, correttamente, “Abilita, modifica", Contenuto”, ages
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: Destination, Regressions, InMeen, Total, Number, Exports, Exporters, Exporter, Uso), (20), 1767", 287", 301), 090), o6ors, 259", 708"r", 009), 243), 082), 082"**, 808", 221), 070), 188), assess, 1373", osat, 263), 566), 035), 2020", guia, 442), 340), 016), 902", 03a", (0587), 138), 438), 029), Click, "Enable, Content”, this, spreadsheet, display, correctly
Total images: 2
Extracted OCR: e514, Amencan, Rescue, Plan, form, Defow, accept, edera, This, document, protected, Click, "Enable, content", review, “Hed, dere, °*@Q~7", Federal, Content"
Total images: 11
Extracted OCR: DocuSzgn
Total images: 2
Extracted OCR: None
Total images: 2
Extracted OCR: None
Total images: 2
Extracted OCR: None
Total images: 1
Extracted OCR: DOCUMENT, File, Secured:, View, Complete
Total images: 2
Extracted OCR: Goriintilemek, istediginiz, ddkiimant, seci
Total images: 1
Extracted OCR: Security, Warning, Macros, have, been, disabled, Enable, Content
Total images: 1
Extracted OCR: Please, enable, macros, view, full, file, contents!, Security, Alert, Macro, trustworthy, source, should, leave, this, content, disabled, unless, ‘content, provides, ential, functionality, trust
Total images: 1
Extracted OCR: pall
Total images: 1
Extracted OCR: None
Total images: 2
Extracted OCR: This, document, protected, Click, "Enable, content", review