Maldoc Templates - Dridex, NONE, Adwind, RemcosRAT, TrickBot, AgentTesla, FickerStealer, IcedID, Loki, BazaLoader, SilentBuilder, Hancitor, Quakbot
Total unique groups: 17
Total unique maldocs: 6497
Total unique images: 145
Data from Malware Bazaar Abuse.ch https://mb-api.abuse.ch/downloads/.
Please note that image names are the MD5 hashes of the original document they were contained within.
Overall graph of images, 90% similarity
Total images: 24
Extracted OCR: None
Total images: 11
Extracted OCR: This, spreadsheet, downloaded, with, OneDrive, Click, "Enable, Content", review, document, created, previous, version, Microsoft, Office, Word, view, edit, this, please, click, editing", button, then, content"
Total images: 81
Extracted OCR: <Lee, Document, created, using, application, related, Microsoft, Office, viewing/editing, perform, following, steps:, Click, Enable, editing, button, from, yellow, above, Once, have, enabled, please, click, Content
Total images: 11
Extracted OCR: follow, these, This, document, only, available, desktop, laptop, versions, Microsoft, Office, Word, Click, Enable, editing, button, from, yellow, above, Once, have, enabled, please, click, content
Total images: 3
Extracted OCR: (aceyteyii, Excel, Kejiie-eio, THIS, DOCUMENT, PROTECTED, Previewing, available, protected, Documents, have, press, “ENABLE, EDITING”, CONTENT”, buttons, preview, this, Document, etree, Revireckios, terete
Total images: 1
Extracted OCR: IMIOR, PHARMALIVT™C, OUDULTEMS, (IMETED
Total images: 1
Extracted OCR: Mayware-, ROTEGER
Total images: 1
Extracted OCR: None
Total images: 2
Extracted OCR: pall
Total images: 1
Extracted OCR: DocuSzgn
Total images: 2
Extracted OCR: This, document, protected!, view, this, content, please, click, “Enable, Editing”, from, yellow, then, Content”
Total images: 2
Extracted OCR: Goriintilemek, istediginiz, ddkiimant, seci
Total images: 1
Extracted OCR: Excel, Oops, something, went, wrong, This, document, protected, Open, Microsoft, Office, Previewing, online, available, documents, this, downloaded, from, your, email, please, click, Enable, Editing, yellow, above, Once, have, enabled, editing, Content
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: R-0086
Total images: 1
Extracted OCR: DocuSzige
Total images: 1
Extracted OCR: None