Total unique groups: 9
Total unique maldocs: 196
Total unique images: 35

Data from Malware Bazaar Abuse.ch https://mb-api.abuse.ch/downloads/.

Please note that image names are the MD5 hashes of the original document they were contained within.

Overall graph of images, 90% similarity

Total images: 23
Extracted OCR: GlobalSign, THIS, DOCUMENT, ENCRYPTED, PROTECTED, t¥GMO, FOLLOW, THESE, INSTRUCTIONS, DECRYPT, VIEW, using, Windows, higher, click, Enable, Editing, notification, yellow, Content, next, DecryptToole, from, https://shop, globalsign, com/en/document-signing, CANNOT, Update, software, Certification, Reinstall, ptTo, Authorities, ‘Authorities, WebTrust, Leary, Maiti’, code, Sing

Total images: 3
Extracted OCR: DocuWare, Open, document, Microsoft, Office, Previewing, online, available, protected, documents, Capterra, Customers, awarded, “Best, Ease, Use”, this, downloaded, from, your, email, please, click, Enable, Editing, yellow, above, G|crowp, Leader, Grid, Enterprise, Content, Management, Once, have, enabled, editing

Total images: 2
Extracted OCR: None

Total images: 1
Extracted OCR: edit, document, please, click, “Enable, Editing”, proceed, Content”, from, yellow, above

Total images: 1
Extracted OCR: None

Total images: 1
Extracted OCR: Belgeyi, gériintileyebilmen

Total images: 1
Extracted OCR: DocuSzge, THESE, STEPS, REQUIRED, FULLY, DECRYPT, DOCUMENT, ENCRYPTED, DOCUSIGN, Click, “Enable, editing", unlock, editing, document, downloaded, from, internet, content", perform, Microsoft, Office, Decryption, Core, start, decryption, Vicrosoft, wMmcaAfee, WOfficé

Total images: 2
Extracted OCR: THIS, DOCUMENT, MADE, WINDOWS, ALPHA, SAFELY, OPEN, PLEASE, PERFORM, FOLLOWING, STEPS, view, this, content, please, click, "Enable, editing’, yellow, then, content’, Introducing, Windows, brings, closer, what, love, Life’s, better, together, Microsoft, Teams, chat, call, make, plans, with, family, friends, 2021

Total images: 1
Extracted OCR: None