Maldoc Templates - NONE, Dridex, TrickBot, BazaLoader, NanoCore, Loki, AsyncRAT, IcedID, SnakeKeylogger, njrat, SilentBuilder, Formbook, RemcosRAT, OskiStealer, Gozi, Quakbot
Total unique groups: 21
Total unique maldocs: 157
Total unique images: 38
Data from Malware Bazaar Abuse.ch https://mb-api.abuse.ch/downloads/.
Please note that image names are the MD5 hashes of the original document they were contained within.
Overall graph of images, 90% similarity
Total images: 5
Extracted OCR: Document, created, earlier, version, Microsoft, Office, Word, view, this, content, please, click, "Enable, Editing", from, yellow, then, Content", Protected, File, From, Ohiohealth, Hardin, Memorial, Hospital
Total images: 1
Extracted OCR: Microsoft, Office, Wizard, Transformation, Operation, complete, successfully, because, file, created, Android, device, view, edit, document, click, "Enable, Editing", then, Content"
Total images: 3
Extracted OCR: This, document, created, previous, version, Microsoft, Office, Word, view, edit, this, please, click, "Enable, editing", button, then, content"
Total images: 3
Extracted OCR: Security, Warning, Macros, have, been, disabled, Enable, Content
Total images: 2
Extracted OCR: Microsoft, Office, Excel, This, Spreadsheet, created, with, online, version, Click, "Enable, Content", review, this, spreadsheet
Total images: 1
Extracted OCR: Office
Total images: 3
Extracted OCR: None
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: view, invoice, details, please, click, "Enable, Content", Reynolds, Consumer, Products
Total images: 1
Extracted OCR: None
Total images: 6
Extracted OCR: PROTECTED, VIEW, carefulfiles, from, Intemet, contain, viruses, Unless, need, edit, it's, safer, stay, Protected, Vier
Total images: 1
Extracted OCR: DocuSige, THESE, STEPS, REQUIRED, FULLY, DECRYPT, DOCUMENT, ENCRYPTED, DOCUSIGN, Clickon", Enable, editing"to, unlock, editing, document, downloaded, from, internet, Click, "Enable, content", perform, Microsoft, Office, Decryption, Coreto, start, decryption, wMmcAfee, WOfFficé
Total images: 2
Extracted OCR: This, document, protected, Please, click“Enable, Content”, view, BUCK, click, “Enable
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: Document, created, earlier, version, Microsoft, Office, Word, BONN, cles), meal, "Enable, Content"
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: DocuSzge, THESE, STEPS, REQUIRED, FULLY, DECRYPT, DOCUMENT, ENCRYPTED, DOCUSIGN, Click, “Enable, editing", unlock, editing, document, downloaded, from, internet, content", perform, Microsoft, Office, Decryption, Core, start, decryption, Vicrosoft, wMmcaAfee, WOfficé
Total images: 1
Extracted OCR: THIS, DOCUMENT, PROTECTED, Open, document, online, available, prote, 4@umryatanicy, this, loaded, please, click, Enable, Editing, above, Once, have, enabled, Glithy-M@ifa, dairl(-neeijtent, yellow