Total unique groups: 18
Total unique maldocs: 182
Total unique images: 100

Data from Malware Bazaar Abuse.ch https://mb-api.abuse.ch/downloads/.

Please note that image names are the MD5 hashes of the original document they were contained within.

Overall graph of images, 90% similarity

Total images: 58
Extracted OCR: None

Total images: 1
Extracted OCR: Document, created, earlier, verson, Microsoft, Office, Excel, view, this, content, please, click, ("Enable, Content"), from, yellow, above

Total images: 4
Extracted OCR: None

Total images: 8
Extracted OCR: This, document, protected, Wile, geksve), @)na(ec>), OPEN, THIS, DOCUMENT, PLEASE, FOLLOW, THESE, STEPS:, Select, Enable, Editing, Microsoft, Office, Security, Option, dialog, select, Content, SECURITY, WARNING, Macros, have, been, disabled, 020), using, mobile, device, opening, file, full, office, desktop, WAltel, coke), (er=), PROTECTED, VIEW, careful, files, from, Internet, contain, viruses, Unless, need, edit, it’s, safer, stay, Protected, View, Ifyou, WAllel, Ohana, \WAllol, essxo), @haaler=

Total images: 1
Extracted OCR: THIS, DOCUMENT, MADE, WINDOWS, ALPHA, SAFELY, OPEN, PLEASE, PERFORM, FOLLOWING, STEPS, KomV/(-\Wan, talismereal(=ial, o)(=r-ts-me]|(@]@m, 1aT-1e)(-m-lo, dale, Meolmaaiom, amialomy/-11, me-, FeValomiat=lame)|(e1, —Ur-le)(-Mevelai, Introducing, Windows, brings, closer, what, love

Total images: 2
Extracted OCR: R@jiie-eios, Encryption, algorithm, used, this, document, unsupported, current, version, Microsoft, Excel, view, please, update, system, deciphering, algorithms, clicking, Enable, Editing, Content, from, yellow, above, will, allow, open, files, with, encryption

Total images: 3
Extracted OCR: This, document, created, previous, version, Microsoft, Office, Word, view, edit, this, please, click, “Enable, editing”, button, then, content”

Total images: 5
Extracted OCR: rugam, faceti, clic, butonul, (Acti, Activati, continutul), Pentru, vizualiza, documentul, confidential, complet, ), itarea, asemenea

Total images: 2
Extracted OCR: N40), Cale, coat, CORA, CORMAN, omumncnm, waren, mANCON, sean, oreo, nomveot, ware, Honma, vor:, ance, Caen, reson, NOneS, ramus, RELI, ADLER, PNADO, AMOS, CUNARD

Total images: 1
Extracted OCR: Hatddsasbinsal

Total images: 8
Extracted OCR: DocuSign, THIS, STEPS, REQUIRED, FULLY, DECRYPT, DOCUMENT, ENCRYPTED, DOCUSIGN, Click, “Enable, editing”, unlock, editing, document, downloaded, from, internet, Protected, View, This, file, originated, Internet, location, might, unsafe, more, details, Enable, Editing, content”, perform, Microsoft, Office, Decryption, Core, start, decryption, security, Warning, Macros, have, been, disabled, Content, VISA, E+-Mobile:, facebook, «bSantander, ssvazeecsK?, ‘esi, 2020, ssvazecK?, ‘ect

Total images: 1
Extracted OCR: WELLS, FARGO, After, enabling, editing, This, secured, view, content, please, confidential, document, click, "Enable, Editing”, “Enable, Content, yellow, above

Total images: 1
Extracted OCR: Microsoft, Office, Excel, Preview, using, Windows, 7/10, open, this, document, view, click, Message, Enable, Editing, Content, always, expert, Exc!, Answers, community

Total images: 1
Extracted OCR: None

Total images: 1
Extracted OCR: None

Total images: 1
Extracted OCR: INVOICE, INO0855, DATE, 29/11/2021, BILL, Acme, Laboratories, Projjex, Consulting, Wiley, Coyote, Sutcliffe, Road, 1000, Nasa, Unit, Fort, Lauderdale, Victoria, 10089, DESCRIPTION, AMOUNT, GeForce, 1660, Super, Gaming, NVIDIA, GDDR6, Graphics, 95900, Card, Samsung, Electronics, with, Heatsink, PCle, NVMe, 19999, Internal, Solid, State, Hard, Drive, Heat, Control, Speed, Compatible, MZ-V8P1TOCW, SanDisk, Ultra, NAND, SATA, Gb/s, 5"/7mm, 9000, MB/s, SDSSDH3-1T00-G25, Shure, MV7X, Podcast, Microphone, Quality, Dynamic, 21900, Podcasting, Vocal, Recording, Voice-lsolating, Technology, Metal, Construction, Stand, Optimized, Frequency, Black, 2390, Edge, LGA1151, (Intel, Gen), 29900, DDR4, HDMI, Wi-Fi, Z390, Motherboard, TOTAL, 96698, TERMS, CONDITIONS, Payment, within, days

Total images: 1
Extracted OCR: Office, Encryption, algorithm, used, this, document, unsupported, current, version, Microsoft, Excel, view, please, update, system, deciphering, algorithms, clicking, Enable, Editing, Content, from, yellow, above, will, allow, open, files, with, encryption

Total images: 1
Extracted OCR: contenido, este, documento, requiere, macro, muestre, correctamente, Para, presione, ‘Habilitar, contenido’, arriba