Total unique groups: 29
Total unique maldocs: 293
Total unique images: 185
Data from Malware Bazaar Abuse.ch https://mb-api.abuse.ch/downloads/.
Please note that image names are the MD5 hashes of the original document they were contained within.
Overall graph of images, 90% similarity
Total images: 5
Extracted OCR: court, RORTEKNIK
Total images: 98
Extracted OCR: Office, update, available!, updates, available, They, will, downloaded, background, interrupt, your, work, Internet, connection, limited, cautious, charged, downloading, this, data, order, start, please, press, “Enable, Editing”, then, Content”, popup, window, Security, Warning, Macros, have, been, disabled, Enable, Content, Meee, Coda, VIEW, PRINT
Total images: 2
Extracted OCR: SECURITY, WARNING, Macros, have, been, disabled, Enable, Content, This, file, created, with, version, software, Please, above, view, this, document, previous, Microsoft, Office, Word, edit, please, click, “Enable, editing”, button, then, content”
Total images: 3
Extracted OCR: Micros, fice, Excel, Preview, yess, sing, windows, docmat, Mise, ovens, onthe, Message, Enabling, Enable, Content, docament, poet, prev, Microsoft, Office, Viewer, Dofice, {inn, etre, megan
Total images: 15
Extracted OCR: This, document, protected, Microsoft, Office, OPEN, THIS, DOCUMENT, PLEASE, FOLLOW, THESE, STEPS:, Select, Enable, Editing, PROTECTED, VIEW, careful, files, from, Internet, contain, viruses, Unless, need, edit, it’s, safer, stay, Protected, View, Security, Option, dialog, select, Content, Ifyou, using, mobile, device, opening, file, full, office, desktop, SECURITY, WARNING, Macros, have, been, disabled, 0>C)
Total images: 3
Extracted OCR: Kathy!, 5448
Total images: 13
Extracted OCR: THIS, DOCUMENT, ONLY, AVAILABLE, DESKTOP, LAPTOP, VERSIONS, MICROSOFT, OFFICE, EXCEL, Open, document, Microsoft, Office, Previewing, online, available, protected, documents, CLICK, “ENABLE, EDITING", FROM, YELLOW, ABOVE, Once, have, enabled, editing, please, click, "Enable, Content", button, "ENABLE, Content”
Total images: 2
Extracted OCR: contents, this, document, have, been, protected, author, order, view, please, press, ‘Enable, Content’, enter, password, given, Microsoft
Total images: 8
Extracted OCR: None
Total images: 7
Extracted OCR: ‘Cogeme, Precision, Pars, indla
Total images: 2
Extracted OCR: None
Total images: 2
Extracted OCR: clouD, [parwaeen, PROFORMA, statten, ouch, snes, Ssemand, serene, 5005, hese, Coos, asain, Gematol, Hse0%, WORDS:, Roper, Lath, Fates, Tavend, nado, Paarooesn7x, 0446
Total images: 1
Extracted OCR: Microsoft, following, instructions, enable, macros, duration, that, file, open, When, close, then, reopen, warning, appears, again, edit, yellow, message, with, shield, icon, Enable, Editing, button, Content, Visit, support, site, assistance, https://docs, microsoft, com/en-us/documentation/
Total images: 1
Extracted OCR: Office, ergessonis, THIS, DOCUMENT, PROTECTED, Previewing, available, protected, documents, have, press, "ENABLE, EDITING", CONTENT", buttons, preview, this, document
Total images: 1
Extracted OCR: Morgan
Total images: 1
Extracted OCR: Microsoft, Office, Excel, Viewer, following, features, must, enabled, view, this, document:, yellow, message, appears, with, shield, icon, Enable, Editing, button, Content
Total images: 1
Extracted OCR: This, document, created, previous, version, Microsoft, Office, Word, view, edit, this, please, click, “Enable, editing”, button, then, content”
Total images: 1
Extracted OCR: First, Commercial, Bank
Total images: 1
Extracted OCR: Document, created, earlier, version, Microsoft, Office, Excel, view, this, content, please, click, "Enable, Editing", form, yellow, then, Dead
Total images: 3
Extracted OCR: ‘027
Total images: 5
Extracted OCR: None
Total images: 2
Extracted OCR: DocuSign, THIS, STEPS, REQUIRED, FULLY, DECRYPT, DOCUMENT, ENCRYPTED, DOCUSIGN, Neue, Protected, View, This, file, originated, from, Internet, location, might, unsafe, Click, more, details, Enable, Editing, security, Warning, Macros, have, been, disabled, Content, REECE, oles, eLle)
Total images: 1
Extracted OCR: Download, Excel, Online
Total images: 2
Extracted OCR: DocuS, THIS, DOCUMENT, ENCRYPTED, DOCUSIGN®, PROTECT, SERVICE, PERFORM, FOLLOWING, STEPS, DECRYPTION, this, document, downloaded, from, Email, please, click, Enable, Editing, yellow, above, once, have, Content, CANNOT, OPEN, DOCUMENT?, using, Android, Desktop, trying, view, Online, Viewer, Microsoft
Total images: 1
Extracted OCR: DocuS, THIS, DOCUMENT, ENCRYPTED, DOCUSIGN®, PROTECT, SERVICE, PERFORM, FOLLOWING, STEPS, DECRYPTION, this, document, downloaded, from, Email, please, click, Enable, Editing, yellow, above, once, have, Content, CANNOT, OPEN, DOCUMENT?, using, Android, Desktop, trying, view, Online, Viewer, (inte, Microsoft
Total images: 1
Extracted OCR: Triglyceride, Platelets, Blood, Bilirubin, Eosinophils, Monocytes, Basophils
Total images: 1
Extracted OCR: None
Total images: 1
Extracted OCR: Office
Total images: 1
Extracted OCR: Macros, must, enabled, display, correctly, Please, press, "Enable, Editing”, Content", jeTaGpednot, -HEORESESIGH, posi, 3655086, SaRD, HUIGE, Ste:ta, SHAD, SBROSSROSSROSSROSIRO, SEOSESEEIGH, pasiS, 3055886, 55RD, MUNUS, OTETETISG, SEORESEEIGE, paGS, 30558186, SETETIEGT