2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-12-14 14:30:15 +00:00
|
|
|
"Event": {
|
|
|
|
|
"analysis": "2",
|
|
|
|
|
"date": "2019-02-20",
|
|
|
|
|
"extends_uuid": "",
|
|
|
|
|
"info": "IoT malware - Gafgyt.Gen28 (active) - 20190220 - 20190222",
|
2024-04-05 12:15:17 +00:00
|
|
|
"publish_timestamp": "1708958105",
|
2023-12-14 14:30:15 +00:00
|
|
|
"published": true,
|
|
|
|
|
"threat_level_id": "3",
|
2024-04-05 12:15:17 +00:00
|
|
|
"timestamp": "1708956185",
|
2023-12-14 14:30:15 +00:00
|
|
|
"uuid": "5c6d21e5-bb60-47b7-b892-42e6950d2111",
|
|
|
|
|
"Orgc": {
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
|
|
|
},
|
|
|
|
|
"Tag": [
|
|
|
|
|
{
|
|
|
|
|
"colour": "#ffffff",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "tlp:white",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#005b9d",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "osint:source-type=\"automatic-collection\"",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#3a7300",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "circl:incident-classification=\"malware\"",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0088cc",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "misp-galaxy:botnet=\"Gafgyt\"",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0088cc",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "misp-galaxy:malpedia=\"Bashlite\"",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#0da800",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "misp-galaxy:tool=\"Gafgyt\"",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"colour": "#410069",
|
2024-04-05 12:15:17 +00:00
|
|
|
"local": false,
|
2023-12-14 14:30:15 +00:00
|
|
|
"name": "adversary:infrastructure-action=\"take-down\"",
|
|
|
|
|
"relationship_type": ""
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Delivery point for the malware",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656701",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d24bd-d094-4dd6-a1b6-4fa3950d2111",
|
|
|
|
|
"value": "ftp://185.135.80.163/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "Delivery point for the malware",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656725",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5c6d24d5-3f18-438d-b77f-40fb950d2111",
|
|
|
|
|
"value": "185.135.80.163"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656946",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b2-491c-4c4b-9ed2-45260add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.mips"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656946",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b2-b900-4180-80a5-44e40add7fba",
|
|
|
|
|
"value": "DEMON.mips"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656946",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b2-aefc-470d-8c36-477d0add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.mipsel"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656946",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b2-9da0-4f41-ae71-4bc10add7fba",
|
|
|
|
|
"value": "DEMON.mipsel"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656946",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b2-8418-4512-ac0e-429a0add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.sh4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656946",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b2-3214-45fa-9073-41200add7fba",
|
|
|
|
|
"value": "DEMON.sh4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656946",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b2-6ed4-44b1-b235-49a90add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.x86"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656946",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b2-6040-426b-8539-4a520add7fba",
|
|
|
|
|
"value": "DEMON.x86"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b3-c9c4-493e-b0ef-4a910add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.arm6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b3-fc3c-4326-a26d-411b0add7fba",
|
|
|
|
|
"value": "DEMON.arm6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b3-f31c-4575-a603-43d50add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.i686"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b3-f5ec-45b6-9664-43aa0add7fba",
|
|
|
|
|
"value": "DEMON.i686"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b3-56f8-4ba5-896d-4d4d0add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.ppc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b3-858c-4985-bcf5-45e60add7fba",
|
|
|
|
|
"value": "DEMON.ppc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b3-e6f8-404b-b245-488f0add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.i586"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b3-a0fc-47eb-bb93-44ec0add7fba",
|
|
|
|
|
"value": "DEMON.i586"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656947",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b3-8090-4aef-832a-45840add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/DEMON.m68k"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656948",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6d25b4-118c-40a8-95d7-407c0add7fba",
|
|
|
|
|
"value": "DEMON.m68k"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656948",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b4-b64c-4df7-9a9b-491f0add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656948",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b4-9a00-4467-b95e-4ef80add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/nut"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656948",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b4-a64c-4623-bf7e-41bb0add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/apache2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550656948",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6d25b4-381c-4a93-84cd-47410add7fba",
|
|
|
|
|
"value": "http://185.135.80.163/telnetd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550827118",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "url",
|
|
|
|
|
"uuid": "5c6fbe6e-eba0-4dd5-8e04-4881950d210f",
|
|
|
|
|
"value": "ftp://185.135.82.116/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Network activity",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"timestamp": "1550827144",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ip-dst",
|
|
|
|
|
"uuid": "5c6fbe88-6100-4d4a-9efd-42de950d210f",
|
|
|
|
|
"value": "185.135.82.116"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Object": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655984",
|
|
|
|
|
"uuid": "ab5f0c85-5623-424c-bc03-d79841700d74",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655984",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "be442f65-789e-44f5-ae00-336eb6c32d78",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655984",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d297f64b-74df-4f93-a9eb-bb8780fbdadd",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655984",
|
|
|
|
|
"uuid": "4f5d6000-e3f0-4282-944c-8ab3f686c973",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7f3bc4cc-4323-48d3-9190-bc02c31ae268",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "29cd4320-fa69-44bf-a770-7cdd4a6e31bd",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "af3172dc-e50f-4e00-9e8e-6e7483a84183",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7b964085-e632-4767-b1b8-35dffb9aa068",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "61d181d5-65e2-49f0-af81-e02f8fd427b0",
|
|
|
|
|
"value": "24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b786eb3b-8b39-429a-908e-f7687050ad47",
|
|
|
|
|
"value": "4.136842188131"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "50022e4f-414d-4fb1-9f35-d680c8381622",
|
|
|
|
|
"value": "7fcf78111133a7c68de5cd192adb4131"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "d9e97ba6-1f67-417d-8d5e-5d0ba7c6cfe2",
|
|
|
|
|
"value": "7d047261e5ef5b461ceaa73a9e18e4d0f33ceb7e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "06036345-be1b-41cf-a67d-187bd097b66b",
|
|
|
|
|
"value": "b0fd3b5c5e3ff1b290e3056639ea0bcf9ab17ab0f7c8449ffe1027866bf03ca4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "51e732a1-0132-4211-bf24-307ba3d61077",
|
|
|
|
|
"value": "9460a4051ef0944b0e343ae72251661aa9f29b4cf2f7dea5cae5d2358060f0b208ce42c851cc0aae33a993068039236153f61a3e6ab8e7c62a5d02de596eadf9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ad909b66-fcd1-4220-b2a4-893f853f227b",
|
|
|
|
|
"value": "3:4FcMhZUfRn:4+gqfR"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"uuid": "dc897614-58b7-418c-a6d6-fee0515c8e7a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "076d86db-6e17-4698-97b4-6b742eb0a1e2",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "273dbb6a-0d0f-4e0f-be2b-50ce6e4c9778",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f9b360ce-aa6c-4c8e-9422-f09ac948c01e",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7b33caa6-c8db-4f7d-bb8b-136de53d7074",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "2373eac4-47fd-4037-afa9-b937516ec1aa",
|
|
|
|
|
"value": "54128"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "933e9131-3ac5-4ae8-aa6b-af39649d53db",
|
|
|
|
|
"value": "5.8219803146545"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "ca78217a-4850-4948-bfe9-86044531f004",
|
|
|
|
|
"value": "b2727915ee1b50786e800df94a3a32c6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "765a64ef-5562-463b-a9fa-29e4190f3c07",
|
|
|
|
|
"value": "be8dffaaed1566eb68539de3a3404a6107c359ee"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "04ae3427-7379-4434-a59a-865bb713fd39",
|
|
|
|
|
"value": "2a7b18183df9d53ef109e28c3e0904b656829a920203676ba6a8926b476b35ac"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655985",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "8c278b0b-5405-427e-aad1-903a0c926232",
|
|
|
|
|
"value": "dac4da211e3ddba824ac8bae6ce99b1ce5023c27911a8e6964107954b14aaca7ce906440600df013d5a3ebea907b17145fe8c73647fe78f342557eb667ac618e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "333c9b01-5e98-4db3-9031-4e5e91346733",
|
|
|
|
|
"value": "768:pqKdk8huF9bB2POJ+/aOBZn39uM+bRwLMZSNEySU1c2yk1mpSUu+OfVOrb6u9:LVkFZ+ywx5+b+yaaU1cBkSSUAfVOrd"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"uuid": "7f64ad39-cff6-472b-a6e1-7bf50d613d3c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "868e2c5b-4ab6-4bb8-a414-d65d09918e00",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "35ba2611-29f6-4299-9eb7-dc64095a832d",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c3a2d40b-d645-41fe-ad65-76d40d94f036",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "237ceec5-fe13-43c9-99ab-90265ae7f678",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "25e170e6-1278-4ea0-8cff-e9bf5193932f",
|
|
|
|
|
"value": "20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "bed2e4b4-dce9-475f-a6ef-f50ff616b3fb",
|
|
|
|
|
"value": "4.1219280948874"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4871badd-904c-470e-bdf7-3b4ea45f4cd2",
|
|
|
|
|
"value": "114aae478b5d88a5f0770c5e5d62bb70"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "471701d4-761e-494e-b763-bb74b8b19a9b",
|
|
|
|
|
"value": "e9ed5e3da1b579e48267b372158bbe3585d04852"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d8f312d0-78dd-4b8a-ba64-e71da7e8d639",
|
|
|
|
|
"value": "b3fb85776b5cf20e2cf31dd564dccf3f6fb705b2285ed93dcf2de6df48cd866d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "7e92d079-4b58-4534-9a5c-eb63f58f4970",
|
|
|
|
|
"value": "0885c81c2bb8cd14fcad351bfb622dd64f9dd49ae94b5d7195fcb8a9b8d71422a4b1cecc572c5285a172e20d6ac77917288674d89e8be1110cd2808a935891d6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "9898b158-35e8-475f-8e0a-0484236bed73",
|
|
|
|
|
"value": "3:4FcMhxvWn:4+gQn"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"uuid": "5d3c8572-b1e9-4af6-9067-34d2c9359651",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9b36a0dc-8602-453a-97ae-889753cf0983",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "10f5b5fa-f716-4753-9b61-2bee2d855954",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "38ab7636-c318-4588-9ec6-f01f57e2cd22",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f1ec4a52-a1b9-4b91-88c0-ee874c450a0a",
|
|
|
|
|
"value": "7784"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "c4d35346-5421-4090-a771-48d30a2990d8",
|
|
|
|
|
"value": "5.267949278575"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d34eb0fa-8647-4fdf-bbf9-d39dd7fbfc11",
|
|
|
|
|
"value": "4fc2d310ce12b14b23e1b1e40e70f0b5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "44785872-30c0-4495-bf6d-9e448f97d939",
|
|
|
|
|
"value": "3cdcaac9626c6b2c6d9ee17e3b4f0c0c1ba31fc2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "433b15eb-608b-4bfd-8070-7673f0ff9db2",
|
|
|
|
|
"value": "68cf7f0e95df07d75930ec6b9b7ee20abafb3836c381fe666ca50d80d7220916"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "fd0fc14b-dce5-4448-8b8e-275abf2ed661",
|
|
|
|
|
"value": "d23a80f6cc7c5f5154b13edd48f59ff061927d336c3b767d1e27038910485e20b98e9472bed70c741458df36845e38ffb210b36e6a7b354870a7deedaabc5824"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655986",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "10a976ec-a368-4b77-87de-50477c5f7a04",
|
|
|
|
|
"value": "96:r+DaaXGxBMHHVR8aQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpuEx7yWMl:q7HH8aEnlRum67bqlOVyQSWB3tuf"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637931",
|
|
|
|
|
"uuid": "1c18e4e0-8fb3-4d11-ba91-63c60ca95981",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e4b67033-b026-4033-af4a-4897f88ae306",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7a1f66b7-9a3f-4f14-ba9e-d7d3c32e3cd3",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f0a1f498-787d-44f3-b762-913cef517d9d",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "faea281d-3e32-4335-b6f2-e75f7a44a6f6",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "1eef1b9a-39fc-4ad1-9c65-af572f30ee30",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637921",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "400b974e-2548-472a-bac4-757e00396b45",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637924",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "b0d3cee7-200f-48e0-8462-fecc603ee81d",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637926",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "1570ba1c-3d40-41d4-9e33-da1645bd6ed5",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637928",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "8a4a133f-0b33-4c8c-9354-e7b7089f9e4b",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637931",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "1e804e0b-4ff3-42d5-bb5a-90f2a3f9395c",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"uuid": "2198b5e0-4891-493a-8a0c-19452f7d5702",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "403687f2-8185-4788-bc13-ea405acaefff",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6bbcf346-564d-497c-8de7-9eb6112f3b9c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "175f3cc5-910f-4bd9-9d2e-9637b421172d",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8ed746de-bb18-4d67-aae2-b9591147cd2e",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c3bb24bd-3cab-42df-bda3-2445e0e63b94",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "a56a3b2b-fe33-455f-9896-926bd8ef5dd5",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0a3cba51-3712-4fb1-8169-ed346b588241",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3741d0ac-8710-49b7-8706-c1608d86a62a",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "b66ec7e4-047e-48e2-82c7-fc0ec73bfdc7",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "e8012a24-f895-4eb7-84e5-dbcde423b9ca",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "93038606-5ff3-4b72-a1e3-c6b6544a79b5",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"uuid": "4f3aeec4-3cbb-42ff-8caf-9b50e6e172b0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f7720289-bba3-4bd7-ae1d-d96eee7402d5",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9300fa55-eba6-41ef-9489-32eb17f64093",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "48906445-ad4c-408b-af4e-81072e0ff680",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "50f5566b-c68b-44db-8aa3-84c51593e582",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "9361142f-41d0-4616-b129-ff242ec42009",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655987",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "5accaf0b-84e1-4a7e-9220-d19c926066e3",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "52a8356b-54f6-4365-8550-a29cf737bdcb",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "bcc13eec-3fa4-4734-8d87-07fe18de1f3f",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8005d037-3283-424a-8d74-b172cbe553e4",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "3bb73d16-906a-479d-837c-69856fb4f752",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e6d1f38a-5b43-4d26-940f-ca59711e4b56",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637947",
|
|
|
|
|
"uuid": "9d4b06b3-e506-4b63-991f-fdde148494b0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7d69ca98-4516-4498-b2ee-14f85692b22e",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "518447e6-066a-4238-90c4-7a33a031311b",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7747b0d9-5ec6-43b1-91c1-8b6dbdd03a46",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "eb148f1b-f0fa-44c3-a4fc-79b6582d7952",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "76766e20-ce7d-4d04-9197-865150107910",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "55b55b06-d4b9-4a90-b753-879d4c21f1be",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637937",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "99ce2343-dc04-449c-bb70-871102eb1b70",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637939",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "e647b17d-6524-4a22-8164-369d72ea0799",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637942",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d3138419-ecc1-42cd-9a2c-c268b0a77c6a",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637944",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "e9bd3fc6-d9b3-4586-88f9-c1de3daef483",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637947",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "4d7fbe4a-b596-4f59-8a47-50c36c13f808",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"uuid": "1d9b9f2f-295e-42bd-9793-e553832e940c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "960675c0-e95c-4b53-a3fc-fe5b14aa3975",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c24bb547-37d2-4a88-bed6-6d2731786ee8",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "607e0155-46b2-4856-b411-e2f976ef9cb5",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1d0e60b6-5649-4a9c-abeb-6ebf21cb0725",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4fa61095-b0a2-46c1-8dd4-3453fa0aff96",
|
|
|
|
|
"value": "900"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b2bdd1bd-f42b-4593-be33-eb6dd7c1e32e",
|
|
|
|
|
"value": "2.6059574728556"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "31c63aa2-2a28-4424-bf4e-18d205247ffe",
|
|
|
|
|
"value": "7c58a62bda0bd293d1a3e52a77139412"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "eb958850-68db-4f0b-8c8e-efe45cdfc1e6",
|
|
|
|
|
"value": "2d0cba7fa9b84b39c82ebcf240d21e5707727df2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "33cc0bde-c851-456b-b0e0-a6573b055a80",
|
|
|
|
|
"value": "14400e4bc661442afd3d6ed5b165869f5ed9bfcc82a3808c1986846a4a72f656"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "ab8da0ac-ea91-4975-aefa-7b0f1f8c134d",
|
|
|
|
|
"value": "74d09d6fb8051a9db1b4a42d80f7a2b681a1e3d52ca13f0543a6526a72b1d9e573a5a70434f4eee2ab41aedaf3c0c32a7f5976f142f2cd5fef4194b9e93d75c6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655988",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "fa61204a-8eaa-4003-9d94-05a8a17bdd05",
|
|
|
|
|
"value": "12:6lXklhp3DjqEURysyw6E9RQlybSvOH/YJck/:6lXklr3DqRQlLn"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"uuid": "7a8106f1-71ea-4f5c-8835-74ebe31688fd",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "08501e81-bcdb-4930-a644-3fe4def300ef",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f4d225ab-6d7b-4f41-a182-55bcdc9d2d69",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c9308835-501b-4d4e-a384-eb1b50fc57b6",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5504521d-df08-4ccf-b942-d4ab7ffc19a8",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "02f81347-adc8-4686-b20b-ff34a9066c4f",
|
|
|
|
|
"value": "25428"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "c9ffa735-8c35-48ae-8f40-6e68de82e7f6",
|
|
|
|
|
"value": "4.4616320662107"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0b989dc6-0160-4ba6-9dc6-f215a99e1dfc",
|
|
|
|
|
"value": "049c57bed1d4b94d2f1da034784efdca"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "0ab56cc9-1fa4-491e-9371-37729b3db109",
|
|
|
|
|
"value": "cd25d95009ea7ffc3f58289c63e1fca83677cb43"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "15ff56e5-bfcb-45d6-aeb1-37a5345e51fb",
|
|
|
|
|
"value": "2ade8278d6c7ed7aa6c57d2f4584ac1f5fa08bfbb8368af3fb388c2bb2ee379f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a1c859fa-b11f-4508-bae6-328f7ebd9296",
|
|
|
|
|
"value": "935e0b93fccf755e8e1a5d49e4f2190b34e5f9a249e0896605251b651b1d894c07b478b28bdb3fdf149defa9ab816990fc48a251ed98074bef96229c599a3bba"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "f1a6ce1a-d8ef-4d41-afc5-44b5b0026025",
|
|
|
|
|
"value": "384:Z3L+2hJCe4/X5MY8ERd6NIypVwOd8fHwEPoorJG5hqdc7IyeMiDIQ:Z37DAv5BRd6NJgQEPz05bM"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"uuid": "1f6dfa85-e357-46fc-aab5-c7f886092666",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "353c479b-5310-4452-b9ac-831f9aa4ab46",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fba0aaa6-3d54-4e7e-b105-46a84b1e4839",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "77a5bbec-f9c6-4241-9ae8-54cf8ee0caa4",
|
|
|
|
|
"value": "2920"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "df63c7ec-044a-4867-8118-683d67c49f12",
|
|
|
|
|
"value": "3.7316466793579"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "07517f90-586f-4a0b-b2f3-a571abc051c8",
|
|
|
|
|
"value": "02eaba63128184570a4bdfcd8c29d929"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "47baeb77-8088-4ed1-9e86-29d5d3b146bb",
|
|
|
|
|
"value": "9f8b551a43fcd110a2e5eeaf4c613ccb928351b8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8664ebe6-525d-49f8-8c31-9d998bc7468f",
|
|
|
|
|
"value": "cb592889f9a91adb49129a3bbcb3492c6e81b51da830e5da936e0e00998b47e7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "954f3451-a1d6-4e97-adf8-36e0819e7e5e",
|
|
|
|
|
"value": "98dff98a2e5e0c016ac00b0d0054d555ae5801b995bbbaa0f22ebb5fa7d6b9577ace852ef7b9b1097a411000d2dd272a233d517c6822167745fb091befc4d40c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "9c5598f8-9945-44f2-b066-11baabc774ca",
|
|
|
|
|
"value": "48:BVCEoUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU7:fRNRw"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"uuid": "9bd89f5b-da48-4fbf-bcf6-722baca2ea3d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9c080fcf-a5bb-48fa-9121-0fe7fb0d40e1",
|
|
|
|
|
"value": ".debug_aranges"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8d4d4f2f-b0cd-45f6-8540-a1a5bcf17e1a",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "61b2c35b-4393-41de-a0b3-a407e21115c0",
|
|
|
|
|
"value": "160"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "17def925-5774-4a55-870c-9ac5faf4e2f3",
|
|
|
|
|
"value": "1.7902674546964"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655989",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "66f289a5-57e6-43c4-bf3c-39bdde10ac3d",
|
|
|
|
|
"value": "f015e144f701d50ce89068e7fa331a1b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "27a517fd-f719-4fa5-ad97-227a0965b801",
|
|
|
|
|
"value": "56e2148c28a2a39d0232d86fdbecae0c07bb0b25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e4f8b399-3001-4bc7-bf9c-af6cc9d1d580",
|
|
|
|
|
"value": "baa355978109a6025bdda65b4a0322dbbc4f624537f8a3b37453f3b72de2616c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "19381cc5-1cd5-4fb1-939b-b06d566c4916",
|
|
|
|
|
"value": "0ab7249c0b3931a73e32c2dd76731b902a116000f3f5cef0886b4960dcafa4527bfaa976a8e46ed46d3cd96081c8a647183790a0015572a6c22cadb249d43341"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "33d77d2d-1e29-4166-b41b-03d829bbc553",
|
|
|
|
|
"value": "3:Ll/5lNlxl7Ltld1ltzlmpXlhw/ptzlipltlNJ7tlllhlNlrlBUM:Wpkx2pCM"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"uuid": "1bf32510-81a1-4ade-bccc-d0044cb5267f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c3c60f59-d3cc-477d-bfb4-02161fa3d9df",
|
|
|
|
|
"value": ".debug_info"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "72b49d6d-9582-4685-a393-048c9402f03c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "46fcaa48-3ce3-4caa-87f4-12fd63cc7270",
|
|
|
|
|
"value": "780"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "8ed4706a-1ff5-4e85-9c0b-271b172e2d79",
|
|
|
|
|
"value": "4.9243659663662"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "35df83ce-4451-4ef4-a21e-ea70e529f014",
|
|
|
|
|
"value": "b431c9505e908a3f10bac83965ea12e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "ae71dc04-513b-4c11-8c7f-72d23f9fedf9",
|
|
|
|
|
"value": "75d4fd8544a7b3d6b840829cdc369dce0564ab8b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "08c4762a-813d-4e1b-bddb-2dc54aa65456",
|
|
|
|
|
"value": "01d09e51d9cc706500d935b16365cb1e37566b870ebae68389d3278d5877f9e2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d97e45bb-bd55-4c52-9577-fa6b955d3677",
|
|
|
|
|
"value": "c0c0d044bbcf1cf580c9dc3c5a6c698512a1cd318d17f3b82c012dea2ac8d08c4ccbd6b24e7b444d065f5e7c25771f597b4772e4eae0d1f266565e469c076407"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ad031654-3a95-4a7d-96a6-46c7d9a50759",
|
|
|
|
|
"value": "24:9B6QIBS/MxsB6QIBS/4B6QIBS/lB6QIBS/IB6QIBS/a:9e0/MGe0/4e0/le0/Ie0/a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"uuid": "c873cad9-ab04-4a26-a0ee-fba9a8a4b27c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4b53735a-36ef-477b-b53b-fdfd2d8ae0af",
|
|
|
|
|
"value": ".debug_abbrev"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e6b92e93-4acc-48ad-ae50-631999147abe",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d9093bf7-5654-49c6-8ff8-69f213e7d154",
|
|
|
|
|
"value": "100"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "8fd29c68-cfaf-43f6-80bc-a74e11d428cf",
|
|
|
|
|
"value": "3.346439344671"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "3d096422-0c24-4911-b4d0-4bf12030a213",
|
|
|
|
|
"value": "33b343ca5f1b99b9b71bb47f32af43c7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "d150aa40-b97f-4c04-b2a1-9fa862827568",
|
|
|
|
|
"value": "c42a7af88fa0ec92c922e5de03e04ceaaf720c33"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e974587b-5e0a-432e-952d-a53cff185523",
|
|
|
|
|
"value": "2ae6cf8a42f2768724e77dbeb2915eb89199d3239de2817fa014df1d15008e67"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "4fcf0bbf-323d-4e4e-8d9a-b2119bd5859f",
|
|
|
|
|
"value": "3d1c652cce7e8cc98a52f8d6f3281195382dd7a604424b92f20351f8b3812797d8b62d24957f5105ea667fe57037298d7ac12f30853ab7aab77448890e3927ae"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7d01c06b-86fa-4ba9-8d49-2214d28aef83",
|
|
|
|
|
"value": "3:PU1utPU1utPU1utPU1utPU1utn:Pk6Pk6Pk6Pk6Pk6n"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"uuid": "0070abd5-c842-4a8e-8b48-54138e4136b1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f58a80e5-569f-4173-9d3d-4187cba350c7",
|
|
|
|
|
"value": ".debug_line"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2a32a5e6-20f7-46db-8302-a8c1d16bcf33",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "9dba2566-9035-445c-9388-3e2040f437cf",
|
|
|
|
|
"value": "743"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "dedb6c31-7a4d-4094-8128-d9fb35a92ef5",
|
|
|
|
|
"value": "4.887536564754"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c4a1b12-6768-4197-ab91-21e14c1a1dc9",
|
|
|
|
|
"value": "69d9284ed6901a87af0051300d956cdf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "97a2b176-4839-48bc-a94a-f0aeecb9ceaf",
|
|
|
|
|
"value": "222a15246c0f13f04c794c69f2e68627ce66add1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8909a202-db74-49af-9a73-32a685de9687",
|
|
|
|
|
"value": "71df03c5f8358902d27d73bd2e88df56039f3669c706580f9b97a19ecc9a12e5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655990",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "4065048e-678a-4e0a-8d5e-f0e21a494244",
|
|
|
|
|
"value": "1f79681f1db74074fbc734c2461f90bd0a315075878a5ae08e8aef890b2bbb424128e9106fca2670ed2138edac101478842295f14c34e27d9da95974a36e144b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "efd9099a-09bd-4ba4-a3ea-1c27dff43ebf",
|
|
|
|
|
"value": "12:I4OBc9XA0HuDh+v3Bc9XA0MMRcGy1Bc9XA0esTRBc9XA0v6YOBc9XA0gAZ:FOB6QZ9+v3B6QJMRzyB6QDQRB6QXYOBA"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"uuid": "321a716e-311b-4023-a02a-1980cc3b3d02",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ae692cad-c4fb-4baa-a786-d01959164d25",
|
|
|
|
|
"value": ".debug_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e6d99329-46f1-4a62-9631-e3abbe5ae647",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "10db8ec0-3224-4ab8-83ac-2afe729fcd8c",
|
|
|
|
|
"value": "160"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "1d83e041-f49d-48bd-86f7-87807586b476",
|
|
|
|
|
"value": "3.3172090733526"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "bff40f0f-68ae-447a-a6fd-1531b928cf9a",
|
|
|
|
|
"value": "4dd554071ee04e7381ad5c2e8a285101"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "7f128699-8bf9-4881-8d19-f56f781a245b",
|
|
|
|
|
"value": "93448591e1ce61e79b6f65fcb202a7f4fd27373b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "259ed473-5b1f-4343-b95e-4d81c433c388",
|
|
|
|
|
"value": "be90f778602df804336cedc5e9177f6378aa9a1b7063392d0b451d470ca90cce"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "6c165f79-061f-4546-9e17-adbaaa538545",
|
|
|
|
|
"value": "ce60eb027a2266369124353dbd34ccd776eb4a96999b42c07c8dbce9266f8b1da82d9c26bde5306a263161b17f8df6cf2a0c8ab415a820000baee325175f1023"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7653b0f0-e290-452e-977c-77c548086143",
|
|
|
|
|
"value": "3:NRCxajlpRCxXHxzlthlpRCxNSlp1hlpRCxIUP7:nJCFT9pUz"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"uuid": "de794f38-760a-4c03-8514-98ddceeeddc5",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d78ae6bd-c7da-4e47-8db2-af30015e15d8",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "02104cb4-9750-4e12-8509-bf104ca7edff",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5cf54643-ad52-4754-9f0f-b26641885a1e",
|
|
|
|
|
"value": "168"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "068f4d80-6863-465b-935d-4814c73b3a9f",
|
|
|
|
|
"value": "4.1672851010934"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "64505efc-7853-4443-951d-4f65fae7abc5",
|
|
|
|
|
"value": "3c77484bd9a7a5025d604b50bcf6d0e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "ede72363-2172-4e9c-a51f-21745dbe332b",
|
|
|
|
|
"value": "219c22469be20c3183270f148c6866c569955439"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "cdb9ace9-f633-4bfb-bfe5-924f1975bee1",
|
|
|
|
|
"value": "07254bdbc45884f0dec220bd72d26adbf2ee1e7ce515b19ecea11e14505ef01c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "dcd23140-f31a-45dc-8196-2be3357c274a",
|
|
|
|
|
"value": "71117837c8e3be5e401448ea31a16c289428e920d9dee5cae7e1ddb0ed32790e6581c8a02aee7292b014ab327c95f5c6f5a95c62213104956e4d246553d1757e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d1ba82af-4955-4394-ae9a-e4a5dd78fbed",
|
|
|
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+K2iLTpeWnz/mI9l1AHQVhA:EXwWEgMF84MFTnfniLTpttHKwVhA"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655991",
|
|
|
|
|
"uuid": "320625e6-bc23-4868-967f-ac3a684997fc",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a37568bf-a873-45bd-a791-fb9287499109",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fb0c81bb-2eb2-4543-aef9-77e982d539ce",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "842fbc0b-bdc2-4548-883b-d517dd908de3",
|
|
|
|
|
"value": "17168"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "93d5e253-7e7c-4071-be0d-b959c96d2c30",
|
|
|
|
|
"value": "3.4057620227265"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d08a47de-5de2-4b0d-bbb7-3f623d27703c",
|
|
|
|
|
"value": "b9245a14a250598ab3d36c79221cc5b0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f46b012f-ddb5-47cf-9311-85661e064975",
|
|
|
|
|
"value": "5082108e4a56f55e9357270c6d17f4989a2186fb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d22ff689-f1c9-4a29-bdb2-ac609fc30213",
|
|
|
|
|
"value": "685253e1a019dc51d575e6a7c752752cac9ad2ca46c3e9295e84c31f13de81d8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "8d206ac4-cdb3-418b-aa40-49bcb4f0bb5f",
|
|
|
|
|
"value": "5b26e6c3f23ef486bb0e9e90032fec1af849dcc15926766c43b920a3204ef5974a201086831456deacc3ae5bc4309f5f20b983f842280c33688b5964bbd4e6c1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "96430308-973d-4130-8920-1ac7ea9e633e",
|
|
|
|
|
"value": "384:b2hJCe4/X5MY8ERd6NIypVwOd8fHwEPoorJG5v:aDAv5BRd6NJgQEPz05v"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"uuid": "504ec11b-59f4-488c-bd75-ca4d85c57f37",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e9416d1f-8447-4207-80a7-4ea34e85efa9",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "dd8dfadb-1c65-4f97-bd20-80147f08d742",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "863e7c60-acd1-4a6a-bfc0-6088aa87dea0",
|
|
|
|
|
"value": "9072"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "10c64b33-d82a-411a-8fd7-15e406ecf793",
|
|
|
|
|
"value": "4.614460837061"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "cc9a6f63-25ae-4abb-a107-f34eb2bca7ca",
|
|
|
|
|
"value": "eb8ef1a8c28ffb7ff2aa237fb5270b14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "45cb5587-cf58-4ef2-b1b2-b022ecd98a31",
|
|
|
|
|
"value": "cd7c15cecfecef1dfffcae3cf61445d9e8490930"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ffc96348-a140-4506-8c5d-c8abfcd3d662",
|
|
|
|
|
"value": "2a1addbb03f2742a2d3d4b8b6c0e7680615f51bfc99308c0753cd82745926d81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "43cbcfae-50ff-42b9-8bd1-5b7a43308bb6",
|
|
|
|
|
"value": "c1a5acb8300cf752617f8eea7e11eb63b7c16a77227f3bae5c2128ca1f7afba4779acaebee8a78676248ca28f6da28ecbdd8cbcc5d310be433a73797c8950a76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "9eccea07-8587-4057-825e-f34873f2dc16",
|
|
|
|
|
"value": "192:pqdc7IyvCfXMtivDIQXZxwmX8px5s4v/MqQFAENCyx9XtYglf4QPVhDrqIUOwuIh:pqdc7IyeMiDIQpmmX8px5HvEqQuEUy7g"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550655995",
|
|
|
|
|
"uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "ab5f0c85-5623-424c-bc03-d79841700d74",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037658",
|
|
|
|
|
"uuid": "5c6d21f9-0384-4bd2-b256-40de950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "4f5d6000-e3f0-4282-944c-8ab3f686c973",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037658",
|
|
|
|
|
"uuid": "5c6d21f9-cc88-466d-bfa8-4e98950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "dc897614-58b7-418c-a6d6-fee0515c8e7a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037658",
|
|
|
|
|
"uuid": "5c6d21f9-3cd8-4566-93cb-4a69950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "7f64ad39-cff6-472b-a6e1-7bf50d613d3c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037658",
|
|
|
|
|
"uuid": "5c6d21f9-fc18-4ba9-a2a7-47ce950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "5d3c8572-b1e9-4af6-9067-34d2c9359651",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037658",
|
|
|
|
|
"uuid": "5c6d21f9-3c34-423c-b3e3-4568950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "1c18e4e0-8fb3-4d11-ba91-63c60ca95981",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037658",
|
|
|
|
|
"uuid": "5c6d21f9-d5d0-4c55-9974-48cc950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "2198b5e0-4891-493a-8a0c-19452f7d5702",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037658",
|
|
|
|
|
"uuid": "5c6d21fa-4288-4ce5-bcb0-426e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "4f3aeec4-3cbb-42ff-8caf-9b50e6e172b0",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037658",
|
|
|
|
|
"uuid": "5c6d21fa-f084-446b-bab8-4e6a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "9d4b06b3-e506-4b63-991f-fdde148494b0",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fa-6d04-459d-97dd-4f4b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "1d9b9f2f-295e-42bd-9793-e553832e940c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fa-e50c-4ae0-b6ea-4b9a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "7a8106f1-71ea-4f5c-8835-74ebe31688fd",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fa-4de0-4dd8-91d6-4867950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "1f6dfa85-e357-46fc-aab5-c7f886092666",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fa-0fbc-428e-9704-4846950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "9bd89f5b-da48-4fbf-bcf6-722baca2ea3d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fa-fdc0-4f6b-8640-4228950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "1bf32510-81a1-4ade-bccc-d0044cb5267f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fa-45a8-4757-8682-43e2950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "c873cad9-ab04-4a26-a0ee-fba9a8a4b27c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fa-42f0-4fd1-b32a-4ac2950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "0070abd5-c842-4a8e-8b48-54138e4136b1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fa-91e8-437f-81fd-4326950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 16 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "321a716e-311b-4023-a02a-1980cc3b3d02",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fb-5940-4614-9df9-41a0950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 17 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "de794f38-760a-4c03-8514-98ddceeeddc5",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fb-8c04-4eb2-8a1b-40db950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 18 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "320625e6-bc23-4868-967f-ac3a684997fc",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fb-e49c-4043-8925-4fc0950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 19 of ELF",
|
|
|
|
|
"object_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
|
|
|
|
"referenced_uuid": "504ec11b-59f4-488c-bd75-ca4d85c57f37",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fb-0a44-48c1-acda-4f24950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0b355673-5932-4867-97c6-aa6b4980b623",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "dff88bfa-a42b-4bdc-9234-139fd94dcd24",
|
|
|
|
|
"value": "33168"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5d1ead93-0876-4f67-88da-027d6307a631",
|
|
|
|
|
"value": "ARM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "78f98e18-6afb-466c-ae0e-cfe75f4dad8e",
|
|
|
|
|
"value": "ARM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "ceacb2aa-25dd-4a54-98db-29e04fc812d5",
|
|
|
|
|
"value": "20"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550655995",
|
|
|
|
|
"uuid": "3f183dde-981b-468a-b9ed-5c4c3e16b42a",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "3f183dde-981b-468a-b9ed-5c4c3e16b42a",
|
|
|
|
|
"referenced_uuid": "23275e05-c202-460e-aadf-819c417fb326",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d21fb-9820-4249-b8b3-4199950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "db583518-e7bc-4ac7-84d8-c715fa6062aa",
|
|
|
|
|
"value": "apache2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550655992",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "0fe6120e-969d-4233-8eb5-6032dbb30f08",
|
|
|
|
|
"value": "95104"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550655993",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4fae4697-4196-4aa0-880c-c634e2a6601d",
|
|
|
|
|
"value": "5.8718833659276"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550655993",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "399fb3e1-79e5-4bda-b54e-90e3721b6389",
|
|
|
|
|
"value": "00208302a81fe252b3713555967846bb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550655993",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "b9509058-d15b-401c-b01a-d73aa4e61845",
|
|
|
|
|
"value": "f4232c9d445f0ccbb6eb3a443818d5a643c89124"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550655993",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "20e04fa5-5201-4f2f-aa27-21c28d230eda",
|
|
|
|
|
"value": "97f9347d6721155d72f6c592e662c905bb462c96aad23a9c5be3b5c95088150a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550655993",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d42cbe7e-2579-4175-8eed-6ad4d1db6cbe",
|
|
|
|
|
"value": "ac2e3ea46cf06abc8f4f921cc987a929074158cc48b95d7a0741e021d2a21027afb94b58f4f748a69e77796eb388fde2d1d6d13f02f3e35b7e531275fa363a43"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550655993",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "913d3541-33bf-473d-b7b1-497977fcadae",
|
|
|
|
|
"value": "ELF 32-bit LSB executable, ARM, version 1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550655993",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "1fa8fab3-4115-4c2c-8256-93c9ab94618e",
|
|
|
|
|
"value": "1536:AVkFZ+ywx5+b+yaaU1cBkSSUAfVOrdu+37DqBRdYgQErSmE3cqQuELrDPO0S:h+55+qcBzAGu+37DqBRd9N2mocqQuEno"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656039",
|
|
|
|
|
"uuid": "0efddb66-b6bf-4244-8fee-2cba6be0f5a1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7761fd48-bcee-43d7-807c-8957337bd931",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "eb44c112-d8c5-4a73-9d08-b253da8ed0ba",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"uuid": "ae12d82c-b919-4527-b625-8c178fd4f30a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a532b626-3c30-4240-b10f-d53cea33e799",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4752a659-c627-4180-a83c-28edc54d231e",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cd42b57c-b971-4a69-b4de-4d40e706f605",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a7ce93bf-199b-408a-b991-d7df385b9555",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "2243b998-47fb-440b-8ec8-7d900250b396",
|
|
|
|
|
"value": "16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "9a8d65ee-7ba9-4261-8119-390e8b5a47da",
|
|
|
|
|
"value": "3.75"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "58008e9b-01bd-4f4c-b5e6-37565e351bf7",
|
|
|
|
|
"value": "a940b2bb9e2ac31591e26da5bd8f1005"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "c90b8de4-8e30-41eb-a527-90912e7c7e11",
|
|
|
|
|
"value": "de753d372fb57887d310174fe8302ba87e08f8a2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9d6c9bf0-b191-4ee2-b227-9d9ea600b2b6",
|
|
|
|
|
"value": "f56cbc1b12ec231a28dcc9d8d2cf67ab88aed9094da3914850694c8c0877fc28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "7fbab0e3-f0d4-4b65-baee-746efd0b2b9f",
|
|
|
|
|
"value": "a3cfbe57a58527aa2e7fb5e925c8613f1985d8262c8941382006b8aaadb26d243ee257e3d5e7b5140f99bb8088564a193e35b32ada93c07c61c1a9c1c2dbcdb6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "a3522a4c-9f99-4247-aabe-afdaf87f586d",
|
|
|
|
|
"value": "3:4FcMhE:4+gE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"uuid": "91933b10-68ce-4a57-aed6-5f379af1b5e4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "290034ec-7aa4-4dea-b442-2de201471e20",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "27c8c4e6-487a-4bb7-bb49-1a158510294c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ab1202db-3a73-4054-b323-765948fe133a",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "45c53067-5e9e-4f3b-ad5e-8ae5455491da",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "09573d15-71fa-4781-bb23-642e82df9295",
|
|
|
|
|
"value": "68740"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "02ac4070-e6e5-4b5c-bff8-e5b335dfbb74",
|
|
|
|
|
"value": "5.9302386292455"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4b8a7fef-0312-4806-bd03-48ce6b152b05",
|
|
|
|
|
"value": "13f884082313f796f2361d7665914c3c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9904b1ef-8f49-4898-9c37-b7d267e8a9b8",
|
|
|
|
|
"value": "217480d8d7d11f2166f848c9bfeed65819f45329"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "7094555b-003f-4413-aa35-4632e43e23be",
|
|
|
|
|
"value": "3ba287203cef5b2d64d2c10c57f82410c2fcc6ccd48879e77e96cf7a7cf5e6a8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656040",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c48cc2c4-b29b-4b6d-81aa-abe71d3309f5",
|
|
|
|
|
"value": "18712cd005b99ac82eb16b6c9c7833f2c699525b9f39c07fb8c924b9ddd125ac0ff405039ac9f6dfd9d543d5f0d003d3ccda661dd80cdd8681425788a73fbfe5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "21240662-db56-41a4-8c8c-38ccf1be1e3a",
|
|
|
|
|
"value": "1536:jonKqgqzIXijf9ai1zhJipNi3EDBIFm5Z/nBY0:9ijf9ai+DBGm/B1"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"uuid": "b4c0cfbc-93ed-4be0-b4fe-b644085f4463",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8db56d45-e146-4524-a441-7a0f2324e48e",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e0ef919b-7717-49ac-9b07-8513ee41e91d",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b34afaa3-6715-4d15-b30a-a5aa4ff71cc6",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "24661e10-cb8e-4c7f-a33f-96a416c8be68",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "0ce42d8d-ad37-43f8-b600-96a122e0dc58",
|
|
|
|
|
"value": "16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "009399fd-0d67-45b4-bffe-c9bbeee37933",
|
|
|
|
|
"value": "3.75"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f02e0b00-c62c-4c2a-9de5-1836f261f421",
|
|
|
|
|
"value": "a940b2bb9e2ac31591e26da5bd8f1005"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "2cf45ad8-527d-450b-898b-8263fbf6fe12",
|
|
|
|
|
"value": "de753d372fb57887d310174fe8302ba87e08f8a2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c3033c50-4f3f-424a-b48d-e44db6d7118d",
|
|
|
|
|
"value": "f56cbc1b12ec231a28dcc9d8d2cf67ab88aed9094da3914850694c8c0877fc28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "4f1a6104-1e5b-4b6e-9f5b-1da3b31ce646",
|
|
|
|
|
"value": "a3cfbe57a58527aa2e7fb5e925c8613f1985d8262c8941382006b8aaadb26d243ee257e3d5e7b5140f99bb8088564a193e35b32ada93c07c61c1a9c1c2dbcdb6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "1973b277-d44d-45fb-a857-827cbd0a5f98",
|
|
|
|
|
"value": "3:4FcMhE:4+gE"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"uuid": "38ec7e98-19ab-4d57-bb9f-7986d2c6a038",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "44e72cb3-5d21-4120-a1c7-11393158db33",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d81fdbc5-0962-4bd1-af3a-de0c5f6e6a2c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5dc6eeba-cc41-4708-9538-3ad55db13b80",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ee56a26c-c575-4462-ac22-e6a39e019c2d",
|
|
|
|
|
"value": "7860"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "dbc4cc5f-992d-42c4-92d8-7a5d218a071d",
|
|
|
|
|
"value": "5.2582401007226"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "364b30e9-77a8-4402-8c65-8f0dad031f0c",
|
|
|
|
|
"value": "3e8a73f5351f424263e40209a5a8f3c4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "b755a674-a309-42d4-9b10-b2fe3269cf84",
|
|
|
|
|
"value": "e1af90ae1ad15f1d04ed1a83fba861132ed4f2b4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "4b475072-d06b-4034-96c3-c413279544e4",
|
|
|
|
|
"value": "b15c4b646fab5c9c8b63676c8c6c73cf1eecf414db478bf3cf8cfe9e31071bf8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a95c6c75-62dc-49a4-b0b1-ec489d681154",
|
|
|
|
|
"value": "7793deb784b15a0b2cb463fdd79674e2b306ddca0c4f964e811df827c59d880a1e8e94f8998f64357d6b70ecbdf690a4817a990368aa9bb8cb47b8bd884fe0c0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "1d0e0a27-4466-400c-a4d8-bc0581f5915c",
|
|
|
|
|
"value": "96:r+KDtxBMHHVTqaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpuBmSMl:DWHxqaEnlRum67bqlOVyQSWB33"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"uuid": "a4a5a544-d184-49c3-9682-0b8c96d98c69",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8451644b-5f48-4c86-a163-b23b6e675384",
|
|
|
|
|
"value": ".ARM.extab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e82a7840-6700-4ee3-843c-1676d19fc382",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f4449d10-f27e-452d-80c3-78b5d0fceece",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "2dce9705-b1a3-4137-a3e6-f259cae47a9a",
|
|
|
|
|
"value": "24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656041",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "f0a35645-2936-4094-bd87-707c6266cf94",
|
|
|
|
|
"value": "3.0016291673878"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "a3b2ba0f-fae3-4352-8300-074f665b6adb",
|
|
|
|
|
"value": "eab9a803b5d9ef7708222fb7122be618"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3f313bfc-5d64-4bfd-b66f-de2f531ec790",
|
|
|
|
|
"value": "50024cc82cc38cf63fbaa00c5af5a2fb6e9b52d2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "213937b4-3041-4db3-97ef-82250faf8d47",
|
|
|
|
|
"value": "fc82f14c90d817b5b41a16b677858f26c2a57052eaf2d445516c21bb82974ece"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f06725b3-74c3-4004-bd4e-228334ab0323",
|
|
|
|
|
"value": "9c35a0a10512e8a9a3e77fe293360f477e6101e0b1cc5ca561e688a5de4466696a2393095489201580051c27e61afde2de29de65aacc6041152bfc73c2f73e41"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "c4174b38-255e-408a-9a23-bfc4a4294140",
|
|
|
|
|
"value": "3:9q/ztS/:I/ZS/"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"uuid": "632a229e-d0b5-4524-a97d-8816e5792f43",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c496609f-236f-4f0a-8b9e-21c6d836f27d",
|
|
|
|
|
"value": ".ARM.exidx"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c3c286a2-b62f-4336-a23d-73e7707f4880",
|
|
|
|
|
"value": "ARM_EXIDX"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9b0fcf17-b9f9-4f2a-afd1-922dfbd8b53f",
|
|
|
|
|
"value": "LINK_ORDER"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "57a51764-e305-432c-9eed-1a2120e8f2c8",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "25ee44a6-4951-4536-9fc4-c5bdd8f3c99f",
|
|
|
|
|
"value": "16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4f248957-ee58-4b23-9d53-351a0b0e40a3",
|
|
|
|
|
"value": "2.4056390622296"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5ea3e9dc-8435-4651-8cbc-e5cd8c45ddbd",
|
|
|
|
|
"value": "d5d9bc8a082a4dd89fd04187630a5e49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "aefa2581-e2b8-482c-b945-0d397c4df6f3",
|
|
|
|
|
"value": "04a48afb83c2935c3dfd31751c7ec4f18c750aa5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "7ab497d9-6e54-4de1-a457-612625de178b",
|
|
|
|
|
"value": "82b34e5092acd07bd2dc178828a7cc1d8c44de3781be17f6be15fb64e1dbde97"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "32b94631-4217-41e7-8579-b374a1b8ce83",
|
|
|
|
|
"value": "8508b306540998c3e922c524ae5c733427f3a090af21b87730fbc73170a6b2e2c82d84578a8c59c6c2b5599cb85ccbc6a267d6edbcd19bb3ca84e8bbd27e24c7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "0b4006e1-c25f-4b7a-b4a8-261174a37ff2",
|
|
|
|
|
"value": "3:KntaG8:Kt8"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637961",
|
|
|
|
|
"uuid": "e90c448e-ba4c-40cf-8546-cee2c43613c8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "027da1bd-4bfa-4a0a-88c4-c0ac7e499608",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "abf31f36-f39f-46b0-a2de-56cb681a61d5",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "026abcdd-08eb-461c-9e4a-7e3f449fdf6a",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "506d35ad-7739-424b-8e4e-3c2c6aece48e",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e13c43a3-c96c-4281-8c8b-244ef2ebd7c5",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656042",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "954e0904-60bf-458a-b736-0693de6afe87",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637950",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "cf0d7bcd-ba1e-4621-9dbf-a07944b2cb8a",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637952",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5486f06d-04d8-4644-8edf-7147380f84fd",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637955",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d70f95fd-a7f8-4d18-b074-3e856b15b9ea",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637958",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "eab3866a-f9e3-43d9-a2f1-42686be263f4",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637961",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ffbd7781-6ac9-4db6-9279-bf7606e519a1",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"uuid": "c8acbc26-1989-4f19-abde-85f8ca74b0fb",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8de8f04a-1d76-43dd-8571-8af5e1064e0d",
|
|
|
|
|
"value": ".init_array"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "281cbe7a-8f21-4f28-8958-4c5d5a6925f4",
|
|
|
|
|
"value": "INIT_ARRAY"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "72141cab-74ee-464c-85f9-1a7a507ca8a9",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d857ab1e-2c3a-48ae-bd91-42cf2f443593",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a3f5e1fc-2b47-40e2-bfbf-44be61ea49b3",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4d0ab4ee-e631-44f2-b6d6-f976d48ee2f8",
|
|
|
|
|
"value": "1.5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "7af0e744-e213-4572-bd4c-ac03208859bc",
|
|
|
|
|
"value": "625d2455e43ebd504cceb3a15c339683"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "03863982-7da7-4827-9dba-d1782519625f",
|
|
|
|
|
"value": "889ac316c6762b553b47fb03f3f7b9916696f475"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "dace9297-b65c-46d4-915a-ff10b2f752ed",
|
|
|
|
|
"value": "edbcd43def2634634faeb8967bb01da7f6057a5d0c0f940308c38bd2ea01f0ee"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "aa0b782d-ab48-45e6-b985-33cd1f840286",
|
|
|
|
|
"value": "1a7dd6b98913e1296528a78dd336ab36af7d96f7ffab6250963c39613f9b23b5ca0729c29886420cd38dc0bad63675cb96bed488dec45057ebe81df4c02f0fbf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "9dcf8287-2913-4828-bcaf-45e9b2fc59fd",
|
|
|
|
|
"value": "3:qln:ql"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"uuid": "cb41f2a5-6432-4a61-a25a-b54abef32bc8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "555d64a4-039f-467f-91ef-bbfc2d953d20",
|
|
|
|
|
"value": ".fini_array"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1eab528a-280a-4a96-86f3-0d61d6c5c6f3",
|
|
|
|
|
"value": "FINI_ARRAY"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bdd0bc40-acb4-45b9-bf1b-a165acb3385f",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5f458834-fb5b-49b9-b73e-099da76b23c3",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4cc6b4ab-0c50-40c8-a0c7-f8f0b6ce50eb",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d8700d4a-ebb3-4899-b812-f86fc76354d0",
|
|
|
|
|
"value": "1.5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "728ff8db-e2f6-45fe-b284-f30fa617906f",
|
|
|
|
|
"value": "7113160d313627fd88f1b76409f34123"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "df62af7c-c403-4e74-82b5-054aae9cc9b1",
|
|
|
|
|
"value": "a8bd109d4bbe3ad31627bfc58cc4a0d2acdf09e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "80f8ac30-381a-46a9-a7cf-ddfd1611ea90",
|
|
|
|
|
"value": "081b855a147a9920e8e304342baec9417cfe47a15e019b468ae04c42fdbe19fa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656043",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "918a1c11-8fe2-4251-a773-654c58e71778",
|
|
|
|
|
"value": "15874f1e8c17c8e35a19707a3daa49920a8f0e8d3ebe568dda7b8162795fcd121a32519eaafe4f1a7596614285093ba78d6840f97d6cf1f2c3d2b908d464138b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "21afa090-59e0-4d58-bc05-5b5cb9b938c8",
|
|
|
|
|
"value": "3:K/n:K/"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637977",
|
|
|
|
|
"uuid": "51c1d7f7-0362-43a7-8a81-cf5d558e36e3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ef79f5fb-250e-4e16-9754-61097e5f7e90",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c6c7818c-dc73-4b64-95c2-22f60199118c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a0abf342-8c88-44ee-a2a6-ad1f9c7b61ef",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d23ef51c-ab61-47ed-9994-eaf431d4d069",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c96c253f-1fbe-486d-bd99-399df62d2bbe",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "f5c3dcaa-3f90-4c14-87e0-5e6b7233e507",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637966",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "ec22d8e9-5348-4ceb-be30-d35587ad7076",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637969",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1d9a2f0a-c36c-425b-b78e-d2cca3377e78",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637971",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "76233ffe-c887-4b8b-8bdf-dfa958a3c3e0",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637974",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f5e0d080-9bcf-48b3-8df8-308752bceb0f",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637977",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "859bd537-89e3-4159-8d4e-b87579972471",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"uuid": "39c43ea1-e61e-411a-b531-553326d63b56",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "81e5c01a-4cbb-4fbf-9e1e-eebcf5fadb1a",
|
|
|
|
|
"value": ".got"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f7aa8fae-d77b-482f-8ea8-927c30644de8",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "40d8957d-ccd2-4ce0-a33d-bd2658bd64ea",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3796d342-79e4-4451-94c7-47892e76fef2",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "fe9edad7-574f-4919-97fb-bb213155befd",
|
|
|
|
|
"value": "124"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "5ae68205-244d-4531-b8d4-ace55e6bcaf3",
|
|
|
|
|
"value": "3.677846635341"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d7bc8e39-ee27-4555-a116-d8621601950f",
|
|
|
|
|
"value": "c8c3b8f50e0cc61ab53e674aff414d04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "adb5cd7e-f34d-4544-9f7a-434751ef6c57",
|
|
|
|
|
"value": "80e07d1922ec6a8cb1127511a8d68b5064da6f43"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "1b9005f9-e7d2-4ce5-8c0d-2b89a3af54a2",
|
|
|
|
|
"value": "bb14a8a707ef3ab9665c4bc3911793da7ee31db7b403ce91964e145de2413870"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "1a0b27a8-97bd-438c-9023-b60a76a103cc",
|
|
|
|
|
"value": "6ed7f106d9dfb1892621c0f71152efb50786d1c40b9e670dffccdee3474e7a522d4a5ab52e30222c95828a542e9826d41667c9c3b15f7323885a050ae8540a48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656044",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7d47574a-7d53-448a-b7d9-8b8beba43a41",
|
|
|
|
|
"value": "3:CJ3csIK6sjJlhgXVtSUTCAZrWkl1ZvXEOmVPV:KMsIcJlBUTCAZrjvZvX9mv"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"uuid": "1fb60859-3d2f-488b-a56f-1cb8ea504f54",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "abed9ee1-b0ac-46fa-bc9f-5cbe394d0d1a",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "62fde3e4-8de8-4a48-819d-242f2b12e59e",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1a012851-8dda-471f-bd54-4f0b4aeacb0c",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4a1b067c-490f-4ce8-8809-e00644177f8e",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "279f2ee1-9095-4b7a-a3f5-d57243c23083",
|
|
|
|
|
"value": "628"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "636ebef8-e98a-4f4d-90ad-00c09fb87c87",
|
|
|
|
|
"value": "3.4752016560863"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0797af29-2d72-4a07-b0ac-ab98d1788a8d",
|
|
|
|
|
"value": "ab6367a5dd576384d8bcf54886755409"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "8e7c5ef0-3fc3-4b62-a5f9-3ab5d97b8dd5",
|
|
|
|
|
"value": "b47c304a3318e1cc6b110e3fa9293b1d3537745c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8444b634-7874-47a6-ace7-3d17ee4ef017",
|
|
|
|
|
"value": "b71cbed031ada5d98ec338558778a8903a3fb605057389588ac5305ff58b92c2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "dae08d18-9bad-41ae-8d44-c915f672914f",
|
|
|
|
|
"value": "2d3f35fa9cf1c12da3a3dcf899a6c92e303e008ad31f8395a506b9f1c28b2947ed6905b2eab3fc5fb74878e3d7e0df32d4903a665b98edbf52fc850c103e6a6c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "76e5bfaf-43f2-4f14-871a-45072cc192ac",
|
|
|
|
|
"value": "6:98czuEY/UTEjrjmF/kymiEEE9cydxrgdlXHoUOHdFuszJobuhwSS5Ps:9uEYcTmXOkymiEE1ybSvOH/YeeU"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"uuid": "9dbf82e2-a659-4f65-a1cb-1a4c1917a005",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a08b469d-3de1-43cd-8d4a-0925dee71260",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "481ba880-e415-43e3-b0cc-9034a28df405",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "25546aed-a579-4ded-bc06-00321e719cbc",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a055e5e6-68ed-418c-9478-ca3fd29c6e87",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "3b6d0254-7883-4836-b1cb-544c61b17c66",
|
|
|
|
|
"value": "26212"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "02749158-3aea-4736-9f4d-8f3f155890e9",
|
|
|
|
|
"value": "4.2629806400624"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "12f15cee-0462-41c5-b3a0-c9c9c46e43b6",
|
|
|
|
|
"value": "b86cf82cd3399e85992bd1740cf10705"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "30da2d40-d1d2-496e-b8d2-ec5e30a3c850",
|
|
|
|
|
"value": "9cf2ca983a99d95717f0b1049c53504c9f1d0da5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "07816138-b823-42ed-983e-3600622725d5",
|
|
|
|
|
"value": "b0efbc744e461365758fef001836639e47d6162f88b9573de88f923dab5504cd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656045",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "27f9cb06-60cb-4cc8-8f15-cc12b4389cd1",
|
|
|
|
|
"value": "9f136cdf5e1ddaacbc8eef70d0d2de639287554ddbd7784f26d1f0f4390f6cfa7b5f166d621b010e38fb5e8f782ec126430321b85575d37e9840751088e2a308"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6f6d1281-0881-4bf5-9c30-62451c0fc733",
|
|
|
|
|
"value": "384:Z3OEdMEnE6WFcWF5WFzpWFZV1N/+j/+y/+3/+66NWYRmTgBIhiLF8UQN3plPvy3B:Z35KbG/NdS0A++j3nPqpiy6yoi9K2z"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"uuid": "4dbada84-b2ff-42b0-9263-5f43ec5ce1a9",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2553c0e9-00e7-45f8-87a6-50c5360cdc4e",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "75844e38-7801-43cc-aad7-72a6ac1dbe66",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c79668f-eb72-4051-8ff5-8936af2b7c5f",
|
|
|
|
|
"value": "3244"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "308c0eac-5fc7-4492-a820-efbdf32cfa9c",
|
|
|
|
|
"value": "3.722201329874"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "680a7a34-9a98-4127-99aa-b2802c833513",
|
|
|
|
|
"value": "f71fed316ef3ad116b3e0486fc92501e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "964ef34a-94b0-4598-b606-28ac4f502d48",
|
|
|
|
|
"value": "d2602117e3c660c6728d70a3509436689d70f424"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "41ee7da2-6cd5-47ba-9230-78e464b393fd",
|
|
|
|
|
"value": "b3bb89777224fe5101e8364b78c0844fbe9a2f1446084260b0daf25f66bfda34"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "18f6f1ec-6729-401c-a27c-9806d8b0941e",
|
|
|
|
|
"value": "bb69cf16a1493453af8aa190db42a4c8875c780b7e3a9a813797a465fe5169217353fdce593a03399e1d9f282023d0a97a4a8cb0b0b4b113bbcc215d97b0de69"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "8d582be3-d6d8-445f-bb9b-23252430b00f",
|
|
|
|
|
"value": "48:BVCEoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD:fRNRw"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"uuid": "1608b5e5-da24-49e8-b0c4-8609562bce1e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "89168e56-f90c-4c92-aa56-75436923d015",
|
|
|
|
|
"value": ".debug_aranges"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "dec276ea-ee50-4971-ac93-9ba0a0042afa",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "1379cb68-1d79-426e-80f4-ae1ce4c16286",
|
|
|
|
|
"value": "224"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "cdff1b30-03a8-4426-84ee-919d5161cc04",
|
|
|
|
|
"value": "1.9583901975117"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "c24704a1-ce51-4059-9a76-3519870cda45",
|
|
|
|
|
"value": "85361ae5f37db466ee977e3bfcfac56d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1adaaac6-3b1b-4106-830b-29514426d297",
|
|
|
|
|
"value": "8ae12ea6d066057fcef75e14707d66a9208e35f9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ccb8e916-51d4-4348-b888-456527474d93",
|
|
|
|
|
"value": "0c293038d1f5b926fcfea4077d9d9c8d24ac4a947dd292f8947c983e40059d33"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "0adaa9a4-899d-472a-91ec-ae913669686b",
|
|
|
|
|
"value": "753466e30c9c93910f9f3030d82388a113d1d2cc0c0bb22a92a3260ea98223a96d218b4d0d4e325cc01dceed91e637e6159db8658094d7d221b28a4fb5ed82ff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "61d27af2-c9c3-4db9-a081-ca28ca210d0c",
|
|
|
|
|
"value": "3:Ll/5lpx+JlrllhXlFEZlGlz/lhkkg/JlxlrltTlX7l8lhtlBis5jl7lu5lljkjlI:QWalzoLlmLEs52Rh"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"uuid": "67da960b-1262-4850-8386-de665b4e1399",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "01c08101-3e49-48b7-912d-d10bf24ab7cb",
|
|
|
|
|
"value": ".debug_info"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0e934129-ab17-4012-89bf-70418dabdb57",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e738727d-46e3-457d-adfb-50e5e70f120c",
|
|
|
|
|
"value": "1200"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656046",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ecfb4a6d-e1d9-4a6c-9558-c3f8a3a0cd93",
|
|
|
|
|
"value": "5.0580539204891"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "c41645d4-7d44-492c-b66c-82f22daea306",
|
|
|
|
|
"value": "eefadc760ed5801e70798b70a761d84c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "cc179ddd-f4a7-4496-9c3a-07ff12e6678e",
|
|
|
|
|
"value": "7055303db7995800ff3c754816ddae8f9e3810df"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "91ed3ae9-d4b5-42a6-8091-cb41b409d2a0",
|
|
|
|
|
"value": "c51146fcdb185d5b5c4977d97b28475ca6f45046d51a23e72d8beb02aaf4fd2a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d16e54e0-8c6e-4f6a-8ccd-baba01bf290a",
|
|
|
|
|
"value": "ad2fda5cff9437a4e49d2c358887e777a4d1938759794364b4919aebe52c6ef157472189831eed04894517bda174477cc6b0e43215b14887f4c70944140a64b9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "feeda8ab-b075-45ad-bec4-9bdc5b9ae53d",
|
|
|
|
|
"value": "24:XFQQuWviMQQuWvTuQQuWv00QQH1CFWvFFBQQH1CFWvoQQH1CFWvirFQQH1CFWva:1EWviMEWvyEWvrhAFWv1hAFWvohAFWvR"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"uuid": "af6f3841-8a1d-4348-8e26-9b0f175c048b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bb6d7760-090e-4756-824b-16342be2aa74",
|
|
|
|
|
"value": ".debug_abbrev"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d8922f05-9b5b-46a3-bdd6-23ac2eb34386",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "50ec776a-63a8-49e6-8c48-051b94db9766",
|
|
|
|
|
"value": "140"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "6a592726-6c88-4256-8701-dd6e1f838c30",
|
|
|
|
|
"value": "3.346439344671"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f54a3b42-6adc-4739-b2eb-8f31174b372b",
|
|
|
|
|
"value": "5aaac7866cfdcaa91634e0de61a4985b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "98d6b61b-777e-48a9-b9e4-784768c948ab",
|
|
|
|
|
"value": "0d24a41bae150ce46eb53ee00fc41961f825226f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f5f0b3d4-9b7e-4db9-b2b4-b346916d80d5",
|
|
|
|
|
"value": "d0a0a7a43ecdd135f1c78d9aeca5f6feddd7d462a00266ab2a6c693673f93e22"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "80933b87-27f9-4065-8012-c2996b726e83",
|
|
|
|
|
"value": "dbe3cdf3d4a623903bd870704e0a4790164210eaa18aad3f34d595a97c1e3d90b6d748a00ec32a61ea6999a178eacf23fe3b460c337afbcee291c8f28dfe3d6c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6a1e121d-2506-4a97-a360-ddff5e87e590",
|
|
|
|
|
"value": "3:PU1utPU1utPU1utPU1utPU1utPU1utPU1utn:Pk6Pk6Pk6Pk6Pk6Pk6Pk6n"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"uuid": "ce498a1e-28d1-499e-afdf-799d6da13d3d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0a35c291-ac4f-4775-9c17-ffb814cd66f3",
|
|
|
|
|
"value": ".debug_line"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "903250cd-f645-4ded-961a-86a0e19ced24",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "41a8a5d7-0794-4b5e-a4d4-44bbd474302a",
|
|
|
|
|
"value": "1621"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "159b6824-8916-459c-95b3-674083ebff8b",
|
|
|
|
|
"value": "4.205743427437"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4857fc9b-c9ee-4c13-8918-8a5b7cd39409",
|
|
|
|
|
"value": "a42a12d7c3f887ba30d32f1d9b0946ea"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "576611a2-233c-4372-a74b-8ec932b4de17",
|
|
|
|
|
"value": "3eddc0d5233b8e278be59112341f8d54ceb0626e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "fa204c1a-1f5c-4b31-a1a8-e51c921f657a",
|
|
|
|
|
"value": "6ad0187f76061f48ba30bbc57c02bb00d9b71504cc850bb4170c1af225f04d5e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "2447cc11-f159-45df-a039-9645d97cd4ce",
|
|
|
|
|
"value": "c9483e844d9254d004b29ffc850f822dd74025624fb1b9a320f592c1de1bdfb841eba20cd569b466bd59bfb5cd5ffc3565250f1a39c6c4dda4ede6823d3cd328"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ca6e086e-bd8e-4997-924b-e9a12edbac77",
|
|
|
|
|
"value": "24:/QQ4gQQTzQQrQQy1C+ZEYmghksR/QQy1C+Cr6nuQQy1C+HXQQy1C+C:/qg1N0A+Zrh0A+Cr6u0A+30A+C"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"uuid": "4d9a9254-0873-49bd-9cfb-62a1f0848a58",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "93a385ba-65c5-48ac-8a58-bdf18d5854d0",
|
|
|
|
|
"value": ".debug_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656047",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4176b82f-44d2-4eaa-80e1-3ac2e8c49389",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "8c8c2797-8c76-4dbb-a33d-4631dbf79af6",
|
|
|
|
|
"value": "88"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "e726ae83-a2e7-4f69-ba79-d93cd13c680c",
|
|
|
|
|
"value": "3.3454151753098"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "223dbf44-cb05-4000-b2c7-d82012400d01",
|
|
|
|
|
"value": "779b09db89100ae14e02cfcc4837d92f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "361073d3-1770-43ec-b9d6-cd1cda75bc4c",
|
|
|
|
|
"value": "4b8984d1fb7c69115f9f919fc88023abd01c8e54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e52d17f2-fcfa-4bb2-bc9b-1f47d612dde3",
|
|
|
|
|
"value": "d9ac041de17d5be8cce6d6218ba9b7254576ed6f3e97e2e1d7c7bb8985db65dd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "0d4534ad-a3ef-4039-b02f-beb9ef91aa31",
|
|
|
|
|
"value": "04f71132255c4554813513c719c85d2cc6e3a466199ee4f9e6a4af9a127c35d48068c88709862c7a926d5597377a542d5468b91797a431669de7f3f85f6ee128"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "241cbbc1-c766-4e16-b0d0-9ba326a497fa",
|
|
|
|
|
"value": "3:NRC9/lvtLlNRC9/lxlI8Cbjn:nqDqo"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"uuid": "2cee848c-2326-4854-9d96-93a7fa2cf988",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "710541f7-a179-4485-8bcd-ccd8d416691d",
|
|
|
|
|
"value": ".ARM.attributes"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "af809bd4-0b8e-47b0-9304-94e6fd365983",
|
|
|
|
|
"value": "ARM_ATTRIBUTES"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a8bb4cf7-f48c-464c-8c6a-68782f0a658c",
|
|
|
|
|
"value": "16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "db277fb7-547a-49ba-9e2d-ea05b0f00e29",
|
|
|
|
|
"value": "2.6467822215998"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b2b0677a-8fa5-41b0-b5e6-05cb293f4f71",
|
|
|
|
|
"value": "37005ccd253a7a5b850ecc3bde4005a4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "fd9a590f-7875-4701-b604-1cdbbd4cfd82",
|
|
|
|
|
"value": "15745e02a709144996f57ce897cde63620a498f8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "511e0233-349d-4523-b520-d3f581a6be6d",
|
|
|
|
|
"value": "e379f18122d9b562947e07b84e12e6999a0e0650abf259033b61a22ba02cc26a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "75997c4c-be64-40a4-a8ed-8ce6be8b939f",
|
|
|
|
|
"value": "c0f96443ee0bc3e45180942ce87420f33cf794558c75bc0892ab6a6eee01dbc6d40faf836a588fc980714d95c47b967e14a2b98c71f3f3f975f6948b544b998e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "39e93057-60c7-4dba-a9f2-40c943948e0a",
|
|
|
|
|
"value": "3:Zlmiln:Zlxn"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"uuid": "d8d201a0-3149-42b2-9513-34b447c1c13f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "519dd448-7e83-435a-9210-ce168b9808be",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5e44f1da-55c2-4a84-b30c-20ec86d721e4",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "53d665ce-3256-41e3-b759-efc0854a4c2d",
|
|
|
|
|
"value": "221"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "8e3700b4-8cc5-4f51-b295-127d91405b95",
|
|
|
|
|
"value": "4.2882323145373"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f7a4ac8c-17c8-4422-88fa-842d8f40fead",
|
|
|
|
|
"value": "e8ba6938803aa080ca9909ae33c56ac2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "616b1f56-485f-49ba-9698-d80b17dcc904",
|
|
|
|
|
"value": "f6aa549f26a05df9ff80db7fff11297412e88330"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f050ac40-afe1-4f36-810b-276c9fa78994",
|
|
|
|
|
"value": "8143605c420ec27d09c8b42bc386368fdd56c35bf33b8fb59c150705869a7696"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5c76f254-9ef3-46ff-9a6a-365f0a8a5cd7",
|
|
|
|
|
"value": "661405d6b27ff98ffaef04c470c027944029620649bfce996f11abffb6f7580f0c242acbdc47f968de761d7efddeb450a1082b168cad3af02b8a53cbe0fd23f1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "68c60fbb-93f5-4d3b-827d-7514d3576dc1",
|
|
|
|
|
"value": "6:EXwWEgMF84MFgiuqL+j2cKJAiLTpttHKwVhr9KI:IE/HllqieJAivptxhL9KI"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656048",
|
|
|
|
|
"uuid": "1926ac04-ef31-4e89-911a-345958a68ede",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "932a420a-d7ee-47d8-92c2-a8a9985f2e61",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5074c667-12b9-4092-a828-0e0da8d23e68",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "2f9bb81f-5eb4-4fa7-ae94-cb02a0485d28",
|
|
|
|
|
"value": "19888"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "810ff960-734a-45a5-b4dc-814ae2102ae9",
|
|
|
|
|
"value": "3.4615886959378"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "628542bf-f651-46f8-a1db-b4608c2b9e50",
|
|
|
|
|
"value": "1020b195070f7e479b3d80ce29213e4e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "fb678a2d-7fb2-4212-96d3-25062def9d9b",
|
|
|
|
|
"value": "b86496d09cab9e9386b279771c10d297e06d26b6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8cfb28bc-b669-4d61-afb4-56bd32abcb4d",
|
|
|
|
|
"value": "01290465491452b65bc2d116279fe4a62e99c09b21e608f49ea0838b7a8a3a5f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "019874c9-f602-4535-b9df-6769462bf314",
|
|
|
|
|
"value": "9142145801d893be87dbce6400cb1ce94cba0ca08d3d3f6ab1d3e6870a8e517cd23f559ad9b9b0f134dc5fad2a08501eaff2500fc8026212d0c998adefa27938"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "bbb28afc-bc76-4afc-9cb8-530d6765385c",
|
|
|
|
|
"value": "384:ZNWYRmTgBIhiLF8UQN3plPvy35NUXy6yoi9K26QeI:ZNdS0A++j3nPqpiy6yoi9K25"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"uuid": "e10eaa5e-938a-466b-8710-99628dd0f5fe",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "defb79cc-402d-4f36-9a70-0ddcc6a428b8",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a69b37d2-4b55-4a99-944d-8a5d9e821094",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a8a68824-61a4-40af-abe4-28fb9f78a202",
|
|
|
|
|
"value": "10690"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d457b57c-2b71-460d-b5a0-8f8696aca9f2",
|
|
|
|
|
"value": "4.6191733359721"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5d073706-63e2-4e3c-87ab-5b66b0d96955",
|
|
|
|
|
"value": "0f6c2014469d4d94fabc49a64dece60f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "e502acff-fff8-4efc-a14c-3b0cff2f39fe",
|
|
|
|
|
"value": "1832c65a16ad63f677b90d7cb329f73c761c39bf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6485fb6e-a080-4687-ba8a-171fda88d69b",
|
|
|
|
|
"value": "1823ef919a83c315c253dbf31361468320d7c22ae7909966dfb4c41484ff18d3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a9c8fc17-f79c-41cb-b634-2b7f50e900c0",
|
|
|
|
|
"value": "9a5b7f00decf17775e9a9961ff21eb733ed8629e9c896f08832c8f98492a2bc8dd04079a640765e98fb956fad7a7dd7d9027ca3fd7d688c922510096cee62dd9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "dd3c5ed0-a95f-46c7-b914-68131fc69818",
|
|
|
|
|
"value": "192:XqnYJN4FfXSV5a804WKzxi8lmWrqmRYYQFnGBNsJM9zJjF6XrRQMI/hDsSpe4SBw:XqnYJNa180DKzI8lmWrXbQABaJezD6Xe"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656052",
|
|
|
|
|
"uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "0efddb66-b6bf-4244-8fee-2cba6be0f5a1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2232-92c0-427c-a455-40a9950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "ae12d82c-b919-4527-b625-8c178fd4f30a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2232-1d68-4c89-a7dc-4c1a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "91933b10-68ce-4a57-aed6-5f379af1b5e4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2232-b168-4047-8753-4419950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "b4c0cfbc-93ed-4be0-b4fe-b644085f4463",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2232-1364-4ba2-87c2-40ca950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "38ec7e98-19ab-4d57-bb9f-7986d2c6a038",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2232-867c-44f5-98c0-49f1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "a4a5a544-d184-49c3-9682-0b8c96d98c69",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2232-8d00-464d-8fd0-4458950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "632a229e-d0b5-4524-a97d-8816e5792f43",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2232-c7e8-4ab0-8498-49ac950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "e90c448e-ba4c-40cf-8546-cee2c43613c8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-fba8-425f-b804-4719950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "c8acbc26-1989-4f19-abde-85f8ca74b0fb",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-e3e4-4c9a-b731-4265950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "cb41f2a5-6432-4a61-a25a-b54abef32bc8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-6f40-4d66-b4d5-44ee950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "51c1d7f7-0362-43a7-8a81-cf5d558e36e3",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-355c-4dea-999d-44cc950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "39c43ea1-e61e-411a-b531-553326d63b56",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-d728-48ff-b854-4e7f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "1fb60859-3d2f-488b-a56f-1cb8ea504f54",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-3b8c-456f-89aa-4d75950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "9dbf82e2-a659-4f65-a1cb-1a4c1917a005",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-2568-4e1f-beaf-450f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "4dbada84-b2ff-42b0-9263-5f43ec5ce1a9",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-5f14-41cf-ad07-49bf950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "1608b5e5-da24-49e8-b0c4-8609562bce1e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-61c8-4c7c-8e69-4dd7950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 16 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "67da960b-1262-4850-8386-de665b4e1399",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2233-3d0c-49e4-88d1-4a57950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 17 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "af6f3841-8a1d-4348-8e26-9b0f175c048b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037659",
|
|
|
|
|
"uuid": "5c6d2234-99dc-4811-a533-4298950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 18 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "ce498a1e-28d1-499e-afdf-799d6da13d3d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d2234-ec5c-4327-838b-4762950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 19 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "4d9a9254-0873-49bd-9cfb-62a1f0848a58",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d2234-e848-4008-9619-4b57950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 20 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "2cee848c-2326-4854-9d96-93a7fa2cf988",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d2234-32e8-41fe-a010-41ee950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 21 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "d8d201a0-3149-42b2-9513-34b447c1c13f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d2234-6540-4453-b6ae-45ce950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 22 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "1926ac04-ef31-4e89-911a-345958a68ede",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d2234-6500-45ec-8589-4858950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 23 of ELF",
|
|
|
|
|
"object_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
|
|
|
|
"referenced_uuid": "e10eaa5e-938a-466b-8710-99628dd0f5fe",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d2234-7eb4-4df7-b975-4500950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "74132261-0290-4041-8814-3457725edc21",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7c223161-0d54-4468-bb16-de95a5ffb5a6",
|
|
|
|
|
"value": "33200"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f783d8b-18c2-4a40-a4cd-20c031383b9b",
|
|
|
|
|
"value": "ARM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4f95c3c4-e542-4606-8a91-fdd582a77920",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "01dd01ff-4920-478d-8df6-4c73d3fc30db",
|
|
|
|
|
"value": "24"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "82185331-b6b4-4731-9a54-341245df56f4",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "82185331-b6b4-4731-9a54-341245df56f4",
|
|
|
|
|
"referenced_uuid": "6ff6a916-e131-436f-95b6-6266d38a16fc",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d2234-4174-4fa0-b74e-419c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "82185331-b6b4-4731-9a54-341245df56f4",
|
|
|
|
|
"referenced_uuid": "a43da60c-51a0-4616-a935-b8ccfecf6559",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d283e-7b84-4a20-a482-403702de0b81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "82185331-b6b4-4731-9a54-341245df56f4",
|
|
|
|
|
"referenced_uuid": "e1c9702f-771a-4bc6-9dda-605e62b64bd4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c7068f4-8aa4-4464-849a-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "9a70cd78-73b4-493b-a82f-ea0f47241dd9",
|
|
|
|
|
"value": "DEMON.arm6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5973c8b1-f5cf-4200-bc99-c0f77ec8fa3c",
|
|
|
|
|
"value": "116894"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656049",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "18078660-9248-414f-8b5b-b69c4dfdf4c2",
|
|
|
|
|
"value": "5.9260047584658"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "eff73c31-5168-46a8-8d24-90213e1a5153",
|
|
|
|
|
"value": "5c1e43382c73cf79f559506b32d65f05"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "6d7a37de-ffd2-4bd7-a6a7-233f031730a3",
|
|
|
|
|
"value": "234736ebd1f1a33680e21653a70b4d537a1fb0db"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c4ea427e-d648-4fa6-a114-77db820f4936",
|
|
|
|
|
"value": "9bfa55698985096343655c5c2bf7c33f6ec8460c636922437d5109480c60fc8f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "45c82c64-b905-425f-a0ab-0ca96fd2304c",
|
|
|
|
|
"value": "a6517bfc60f5f6d8cb6bcc70da2ef5b5c3d33c1a813588be3bf92f5164e6b410b4e0dcdaaa182402fd2a3361692faab8f5676fad0111832871e85de61c86a467"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "7087bd68-dc42-4d6f-870a-5503389214eb",
|
|
|
|
|
"value": "ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "8b3c0141-a776-4f5c-b404-59dfed7244d0",
|
|
|
|
|
"value": "3072:mijf9ai+DBGm/BRM3/S0XniQrmcQABuXmbp:miD9aRjBRM3qcrmcQABQmbp"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"uuid": "470171f6-6891-4934-a348-9e23bb444d58",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8ecf6198-b083-441a-b187-edd585912be2",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "9d2e973d-1b60-466b-904e-3d199c6c9ddb",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"uuid": "ea29e220-832b-4092-a670-d3959c5e6f05",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c479b94f-c67d-4c34-8962-437e3b236290",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5328aac1-7412-4670-8488-53ffb8a97661",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "423eda5b-ebe1-4408-a51d-297a1347044b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2d56dc63-fc74-46a6-b081-9d65fadd689e",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "996f2aa9-3a95-4723-880b-0abc10ee1f5a",
|
|
|
|
|
"value": "28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "9fa37b52-a2b0-47cc-b318-7b6c0d0e76a8",
|
|
|
|
|
"value": "3.3797060488063"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b60807ba-5922-4b8a-a19e-47810290ccd9",
|
|
|
|
|
"value": "7b5095cf426d60336a0dc670fd1e7fe9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656084",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "98fe4596-a81a-4871-a448-32048b5bd1c8",
|
|
|
|
|
"value": "5d3428b2f91e0d9ee90b9916fe46816c1620fa1c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ac0da871-ef30-4632-a1f9-00969eaec250",
|
|
|
|
|
"value": "77c42d0381b80ab4206c6276d2386078dd05122f9b1798349dbe3e056fec73c9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "0996ddf4-44c0-4232-b403-52e6cf94e54c",
|
|
|
|
|
"value": "c9ff28ed2fa673cf38e3640bbd61fe1cfe371b6713ccdd752d41e84e78bd8ac4bb9fd18ff5b62dc5ea550a95ad84334ffd1e42dc12b9f206ced6462f27e5572b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e2e4082e-c4da-4471-88f8-191f77b7d19c",
|
|
|
|
|
"value": "3:ZB1eFMlG:TG"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"uuid": "8e75def0-9d85-46a9-b3a0-766442a23aff",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2bfc83a1-33db-4f3d-b05b-7a0252ce2ea3",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ba750e8a-8a65-4411-85f5-0c50658983f5",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d199f6e8-4d72-4abe-b35f-ee1793f911c3",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c166e799-44ea-4961-8614-2fcc4efbc56d",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4b11ea9a-5f1d-4df6-b8e1-7195e4051e58",
|
|
|
|
|
"value": "42584"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ab562f16-713f-4613-934e-2c266d0ceb7d",
|
|
|
|
|
"value": "6.4651391837168"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "abdcdcbe-cd53-4975-be0a-ef07641e2fb0",
|
|
|
|
|
"value": "4df6caf5ada1d8ff9fc73bbb65f3608c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "148b5fc4-7b34-47c3-a215-f9a1f348ef24",
|
|
|
|
|
"value": "0f73a1a13f3998a9cd1598983f60d686bb9b7fe3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ce510258-3cad-4809-91a6-6269f5e05578",
|
|
|
|
|
"value": "cd8ff60074f4923499aa9bbc5b809d4144adf6bb9aeebbf5a6ece10098329a6e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "62d471df-a6ca-4f53-ae1b-21afa393f4f3",
|
|
|
|
|
"value": "fba07faf38eb056065f023876a91bdf38e5199e0b0fcc655fb836004c8a4fa3ac9ee118724fc9ee20afeac73e9e46f70bc19d6de18de494a70ea6a079c843b07"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6dab1633-f3f0-4dd5-8ea9-0b712342fc13",
|
|
|
|
|
"value": "768:ZMiEYbgEoCEjyhdsUnO/e+K0Z4X55fjLO5NhbVxcEWnb8TYZ1jPY5Fi5gA:GiEYbgsEjybsUnJ+xCJhMNhVxcEutZBv"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"uuid": "6283cbe6-5c69-44d0-92a5-f9947fb7f579",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b211c48a-702a-44a2-9f76-4e34ed9bb6cb",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f094f6cb-fec8-4f31-9bde-e8ac11d5991c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7e69e953-caa9-4b14-a3ee-565948da55de",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0bff5077-c111-4ac8-af2b-97d00514d9eb",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "7f9d5947-731a-432f-b6e8-c745815d0287",
|
|
|
|
|
"value": "23"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "c545367d-8afc-491e-9bf5-eda65c1e806c",
|
|
|
|
|
"value": "3.827909782144"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "28bd872d-3ccb-4528-a60f-63d144808323",
|
|
|
|
|
"value": "a1f90a45b7c061ca8a989911deccc442"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f21ab09a-5749-4149-8bfe-7da94d1086cf",
|
|
|
|
|
"value": "ad9665406c07f4fb8c3f4b32ba5b22e95ef1ffaa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "33ca0c99-1982-4f11-b2b4-1697593202b1",
|
|
|
|
|
"value": "4fce64af87b4e0e741cbc682ce42bfb0b2d8dbb4c5cd7420e667e189b925a29d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5ad29a4f-2ae6-47cf-accd-341b5b8d880e",
|
|
|
|
|
"value": "5a8fef6eddee73b71c81bac0f22199f2e2a442bbeeb92141a8df7d2699632e22f4e9ea4d6949f7ba84868e18fa3bd010697b6a20240492ba381018d629809a4d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e6828a17-e690-4ad6-957f-d4f8ce5855ff",
|
|
|
|
|
"value": "3:ZBXCRkvrn:Oevr"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"uuid": "857bd85d-cf7a-4c31-835a-d33b78de4309",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656085",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "aa9b97cf-cbf0-47e7-b13f-500f3327dee7",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9c5d8f23-7548-4bd0-ae82-45874dab34c1",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "dbfda02c-3843-4235-b3e8-201447b4368e",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "09ab5625-3725-4173-b8ac-5aa69ecc339c",
|
|
|
|
|
"value": "8480"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "1c31b6d1-3f68-4848-8e33-130af8135f09",
|
|
|
|
|
"value": "5.3919382668249"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "2dd8310b-0c68-473a-a291-3aedc58a3ce3",
|
|
|
|
|
"value": "01b85af6860c10b5ee05f56d9ce7d5d1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f156d177-e365-4388-8b4c-a0276e2ab0f8",
|
|
|
|
|
"value": "089f03232f08d5840a94bd9378e7e6d949e0e025"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9f1eb3c5-08fa-46cc-8647-427b8719c57e",
|
|
|
|
|
"value": "b5ca1fddd3543dc64cef0e53d94c14c2e79c9b542279f99597cdb7859d9593f0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "7917fa9c-6453-4dd1-9bc9-1dcce9236756",
|
|
|
|
|
"value": "4607ad659e4ace973bf056675f2ca764ece0cf28a33dca76f2a2ad0d97b2f24adbc86b18ec111c20ba91c8075398f00f0d988303eaae5c76f0eb6ff2206ec426"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "5c9e67c5-f64e-48c2-b9f1-8230d038a992",
|
|
|
|
|
"value": "96:7+McqAcsBMHHFUaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpeKTQQHN1Ml:FT1HWaEnlRum67bqlOVyQSWB3fY"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637990",
|
|
|
|
|
"uuid": "10cbb692-f777-4e40-b3a3-1530d159680f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b5380f13-27f6-4cb7-a1fb-82e4224758ad",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d19c2152-cf42-4450-90cb-7c4baeef5dcc",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "38554155-673c-4a19-accb-e8d4c89e84b1",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "64c88973-cc2c-4c6a-be90-ef2a4bb6eccf",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "30ab91cf-079f-4c02-90b5-6e2675c5b78c",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637981",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5d49e603-f310-44bb-9e03-d324567cfdb6",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637983",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3bd57d0a-8238-44c4-bbf2-a97a7e74066e",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637985",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "419bde57-f7c8-4921-a332-a05ff359a78a",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637988",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "dad77b72-4527-4daa-b8b9-531e7dc02464",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637990",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "faf90aa3-910c-4118-a145-547cf37ecfe9",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"uuid": "f5bb7808-71a9-480b-8be3-5a131cc7b14d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "61149387-0c24-4270-ab94-ea50d66bcaf7",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7b331311-0595-4599-ba82-2d131ae8ffea",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "284ab2c4-8fe1-4d65-b542-f4c1b411acd4",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b5ce2093-1d9e-4334-bbe2-334de739ec42",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "54526d25-c21e-4808-93c6-94adf8ca1eca",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "94c11b92-dded-40d8-a567-239803c0e52a",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656086",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f8f0e0b1-e0d5-4ac2-a3cb-e34936526615",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "79179c00-8d1b-46ff-9824-8df0584c4daa",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "3baf10fb-ca2a-4208-9324-ef40dc05967f",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "6bcf4770-19b4-49cb-974e-c5361285cf5c",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6ed875ec-82ec-4976-b379-722c16b433f6",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"uuid": "54d38ffe-220a-487d-9d9f-4c9601bcfc26",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2e47dfe8-e9c2-4143-8b55-6c2c64780275",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ba327eb4-1ed8-4c00-a293-256d19d2d582",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "77aef4d8-b48b-432e-a3e3-6f21fa8bbcad",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c7400dd3-b9b3-4f96-baef-c86a1d89d526",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a05644bb-ac52-48c0-8bb9-b6db0fdb5ace",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "f16cacee-5b94-4e5e-a126-4a43172204ef",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "040f4860-1df5-491e-8f8e-4156ae076a6b",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "10327f76-7d84-4fc0-a5c0-a4c363004c6c",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "bf5746f9-e2c3-41ab-a876-1f2f2119f36c",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "da4d3d05-9e48-4bf5-b438-73a383683a74",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "1e263b55-7b6a-4247-99bd-e4be9406068b",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613638003",
|
|
|
|
|
"uuid": "2b50e37a-113f-40b7-83db-8d7cecd7445e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b7bc20ec-b0c2-48e1-93cd-99c4b062c294",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "616befff-800a-44bf-aa16-ce1aa9af8f90",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a5ec2fee-0e50-468d-8fcf-fea8c2aa30ea",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "adc9ce20-feae-449a-b90a-07bd45c884c9",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "76021a7a-ebee-4e77-a60c-899a4cae08e6",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656087",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "25ccd956-5c36-4371-b9e6-474f1ff22dc4",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637994",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "421cd903-e77d-464d-855b-9ae551ddcb80",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637996",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "635042e2-9a68-47b6-bfd9-d9f762859812",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637999",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "999e1aa7-5c95-4873-8e5e-fa1d6ec6957a",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613638001",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "21fda47f-fc17-4f02-bbdc-76746f945077",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613638003",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7f4ad22e-e15f-4242-bd4d-e3f3edbeb7ba",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613638007",
|
|
|
|
|
"uuid": "686654a9-8744-4acd-8c99-882671eb86a5",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3f9da1be-ad09-4dac-86a3-42f4ce9feafe",
|
|
|
|
|
"value": ".got.plt"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d3f344a1-821e-4ebf-adc0-db024050e563",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b751bc12-657c-4f34-8817-6a4f147dabb5",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "42158372-9fdc-488c-a31f-ec247bdd7db1",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "8c4e9754-533e-40a0-9d65-d057494bc908",
|
|
|
|
|
"value": "12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "f33998b1-d642-44d0-90c3-341af0129621",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637915",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "471d28c4-829a-4ebf-bef5-a7af565f5c41",
|
|
|
|
|
"value": "8dd6bb7329a71449b0a1b292b5999164"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637906",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "d92dcea0-3d98-4d34-896e-f5c775f55216",
|
|
|
|
|
"value": "2c513f149e737ec4063fc1d37aee9beabc4b4bbf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637909",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6114c5-aa82-45e0-9c57-b96590223285",
|
|
|
|
|
"value": "15ec7bf0b50732b49f8228e07d24365338f9e3ab994b00af08e5a3bffe55fd8b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637911",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "537070c8-e2b6-4676-b88e-d16a63b1cd95",
|
|
|
|
|
"value": "666a9a1a7542e895a9f447d1c3e0ffd679bbf6346e0c43f5c7a733c46f5e56c2f65e69dfd4769a9cad2b79b31d282f1ca2aa296ef41bd9833947ada194f46940"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613638007",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "b74db7fa-28bf-4181-8dc2-d9d5156d7fa7",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"uuid": "ffa1f4b4-6c33-41bb-a9c6-8497c56cc1c1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "93a43be8-42db-483a-88dc-fc0008dd0b1d",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6b764ff2-2d28-46a2-9b00-dd6ae72259fd",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "02c57a94-f73f-4e75-b131-4157490fcd6a",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "90dbb44a-2dfb-420d-92cb-992ae6177bfa",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "8477facd-5a98-40e5-b81b-06b9a83fbda4",
|
|
|
|
|
"value": "672"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "8d337d26-ef50-4e33-b0e3-7b77054101a7",
|
|
|
|
|
"value": "3.4715707722781"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "821565a1-d223-44cc-9bc4-f20817404b73",
|
|
|
|
|
"value": "8b2a3aed3797d81a16c6f5fbb738c2b5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1197264f-4a58-47e9-99a9-845c39aaf228",
|
|
|
|
|
"value": "defea42a4680abc43ea846bf1205fa09eeb1ea8b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8e5100f3-7203-4a98-986a-50690cdc6c70",
|
|
|
|
|
"value": "5ad49fbd97385bfe9d2ebfc1b36d30c80bfa9d740f4aa65749f09ee716af290b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "480e0601-008b-4b8c-ad9e-fb290bf15929",
|
|
|
|
|
"value": "8b6164db46a2511a3f5d290666a7177e4dc41d75da4c63fb3f61a2e94d7640bfeda4d76bfe67a31c447d471ff47e1241be8606467bde816a5e0e7e88d04e6438"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656088",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "a812fe64-4e58-4e60-af6c-e06dfa8690f4",
|
|
|
|
|
"value": "12:Ur33E0/n33jzxkyEEEmhIKybSvOH/YJ5lqq5o:Ur3h/n33nxThIKLn5o"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"uuid": "076dfd16-0873-42f0-b06f-fbbcaae6b7c8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a4685876-7e2e-4f46-be21-11a8e9a0ed85",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c7810771-2537-47b5-ba5f-362392f06a13",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a4234691-b6cd-494a-9f3b-677e5440d243",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4d02f7b7-0d5a-449c-a2ad-2164703763fe",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "11d97cbd-9a8f-45a5-ae65-3fce42022e9e",
|
|
|
|
|
"value": "26340"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ffd24734-52a0-4b1b-9c77-b55cd49fb54e",
|
|
|
|
|
"value": "4.8831267428962"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "1719ad6b-163a-4da7-8fe7-88d9657b830f",
|
|
|
|
|
"value": "8ebdea94dfc33c68d0f044a4231e55df"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "656daebb-7bb7-4f9d-9e37-e799a5ddecee",
|
|
|
|
|
"value": "b8cb6b23536ef7836b093ef0b911a18a6c576a1c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0626f0a3-3321-4ce0-8ae1-22eaa8f7dcfe",
|
|
|
|
|
"value": "77b5b53101e857e476d030e6d6455b5c075e67e430499f99aacd05dde9648f20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "53dbaae6-e846-46eb-9465-b322f7e446a0",
|
|
|
|
|
"value": "c00e894c475d10031358d4c37289ac5abe6640a4b03c616772d9fb4a0356565df9d89cb59ab61cf8dcf9cbe9aea9cc22cc0d7d53d46b80a1a1b861e67a4634fc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "3a4de677-144b-4115-80b2-bfc95cce9210",
|
|
|
|
|
"value": "384:zxBfhND2Cnci3q+ir1/d3OKkdc7IQ+DIifmmX8015HVMVcFUe/tRfZe/Olo9:zvfrVe+4BmXn1JSVcFPzfE/O69"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"uuid": "af66b768-1c00-49f7-a4ff-803d8ab37233",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "69f60deb-826d-4d80-9e4c-a8705733dd20",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "df175fe4-b793-4b41-a51c-bf242867c571",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "8e4484ba-d74d-417d-9a9d-aa1c40e80939",
|
|
|
|
|
"value": "2970"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "16731ecf-6971-4cf8-a86b-5793b6385652",
|
|
|
|
|
"value": "3.6143694458868"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d25adebe-1f0f-451e-aa43-98788ae80805",
|
|
|
|
|
"value": "b1cd8554072473955f4f920916a223cc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "db146db3-c876-43d5-b667-08f04dd2fdd4",
|
|
|
|
|
"value": "20f0b0f41ba3869658e81d7269a8f28c164f7d94"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f8dbfcef-d2b9-400a-9c6b-172668c68dfe",
|
|
|
|
|
"value": "e394a3cc2e99cf74ad01a38ee5bb9431fdc2a4d816bce290e39a887b914a12b9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "82974676-b0b9-4376-b833-0735bd651953",
|
|
|
|
|
"value": "8fd36402cab1a8c9203924267185190a18fd1cd1a7a31446c4ce43c59565b2978888567441e6328006d432cd8d70b3b03afed15b9781b7fe6986f34d1a90ad89"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "40df97f7-9d99-457f-9893-8eb9885d3b74",
|
|
|
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUg:u"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"uuid": "dd6bb24d-60aa-4447-a2c3-53e4719c1a6d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "418cff54-489a-4b7b-ab36-e89d5a2631c4",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8b3d83c9-79a5-4787-8499-804e3a5b6ab3",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "cffe6b27-aaa4-4316-8985-56bb2dfe405a",
|
|
|
|
|
"value": "111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "72446b3c-4416-4197-aa40-b3f862117333",
|
|
|
|
|
"value": "3.9464055386973"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656089",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "be1c2399-5d29-413e-acf6-3a650fc298f8",
|
|
|
|
|
"value": "d45c87701f772bf923c5372dd4be4e5d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f7070a06-86a8-4bf2-90ee-449a247cdb42",
|
|
|
|
|
"value": "057410d34e0ec72796d60dc2f8b41a82acdd466e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "cc64b092-c32d-43a1-ab29-662384c95014",
|
|
|
|
|
"value": "5095f212da7a3bdca84036162db03dcdcc7bee4a14f70e9592d1088e8f8925cf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c80b045a-0162-4cad-a4bc-f0f7a59af97f",
|
|
|
|
|
"value": "a1397dfaef694805c577db98e7e56d8d954c0e1b8a406e7ed0bab482acdd7ea0fc4640011adf0970fdb1d39ffef396d2e7b3fc108f1fb633b300cea41037424e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "56412861-3ad8-47a9-a117-fb248ec8354e",
|
|
|
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAllZBJR2iLT6:EXwWEgMF84MFTnsRAiLT6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"uuid": "d17533f6-f053-4ad0-8ac3-e4640059a3f2",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c5972de8-0292-4e3f-aab8-17813197d076",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "62b69575-93c0-4677-b148-d55db3b24880",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "54b98580-6cb3-4236-9a61-46bb89ae5090",
|
|
|
|
|
"value": "11536"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "fda3590b-ce26-4ea8-b679-8845c9765670",
|
|
|
|
|
"value": "4.0884626585658"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "7101b705-95e2-4622-9476-2f8d700369ed",
|
|
|
|
|
"value": "a958885a14d7846239acc28de017a758"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "843ef774-9593-414c-b740-f97f4e7ce0e4",
|
|
|
|
|
"value": "85652dfbd122f20c53be1a166b6c9f8f8673bb20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d559cb08-f140-47e2-9216-2e4119f67f69",
|
|
|
|
|
"value": "cd2122a9a94dd37f0c5894949db58bceab065ac50acf612210500500affcb629"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "681977e4-7f54-444e-b1eb-e5460757e3a2",
|
|
|
|
|
"value": "5fdd24eb11d4552fd58af62a37582522995a8b39fb95e85fe89894261c92fe39d7578f92563501f5e30ce6a0ae32533acccac2f15eb039cfbd5b87e1d042f4b8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7a72d2f1-29be-47f8-b47d-0a82932b8757",
|
|
|
|
|
"value": "192:I0ftB/npfN8BUSnczOVCnELi3g/+i/j1/d3MS7qBA2kL:dBfhND2Cnci3q+ir1/d3OK"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"uuid": "925757a0-52b8-4622-a57b-ec05a890b587",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bba83b5d-b4da-493d-90b1-7608915bee47",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f96487de-a300-4e83-a963-003f06ca1a18",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4c3d3f0d-ef9c-4d2e-879f-bed2a3b43d22",
|
|
|
|
|
"value": "8702"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "22646b45-98af-4a10-b5f9-c8e356addda3",
|
|
|
|
|
"value": "4.5989040501762"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f7e7680c-dba2-41b1-b137-fb04c9698ddc",
|
|
|
|
|
"value": "f9bb61c340ab6be7b264a3517d7993b4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "0f372455-002d-4d5c-96be-6d638372dd9d",
|
|
|
|
|
"value": "88fc8fd3bb6bd323a93f80a902d77e09f94e76e0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "041ae994-3f84-4ad8-bb61-84450823f227",
|
|
|
|
|
"value": "a8685d9604974fe9f31da544b400117e0fb1b086bf30c2a4aae6f20c70ac99ca"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "6cfd13d4-50d9-4e2d-8d9a-d5aa5fbff719",
|
|
|
|
|
"value": "3f1692027cb22896355d4b1eccab8125ca769719cfcf9426ee1bac1ff5306e44bfd10252237854c38a4f5065b5092eaa1f2cbe12db32b79c20293dfc46cf4cd5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "39645af8-27de-4a3c-a11e-6e0038f44d6e",
|
|
|
|
|
"value": "192:udc7IQfXpVqbDIiC+xwmX8015s4S2nMVfE0kNCe/tShQlfrFe/OhDZqD6aEJ:udc7IQ+DIifmmX8015HVMVcFUe/tRfZv"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656093",
|
|
|
|
|
"uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "470171f6-6891-4934-a348-9e23bb444d58",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225b-2414-4d83-9212-4fd8950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "ea29e220-832b-4092-a670-d3959c5e6f05",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225b-0654-4a95-975d-4ce8950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "8e75def0-9d85-46a9-b3a0-766442a23aff",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225b-0a20-42c1-88d0-47ac950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "6283cbe6-5c69-44d0-92a5-f9947fb7f579",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-c6e8-4657-93c8-4859950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "857bd85d-cf7a-4c31-835a-d33b78de4309",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-96d8-477f-87dc-44fd950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "10cbb692-f777-4e40-b3a3-1530d159680f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-bf1c-4734-aa41-4ff7950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "f5bb7808-71a9-480b-8be3-5a131cc7b14d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-25a8-4d7b-965e-4687950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "54d38ffe-220a-487d-9d9f-4c9601bcfc26",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-2b04-4946-8a3e-49d0950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "2b50e37a-113f-40b7-83db-8d7cecd7445e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-6370-4182-ad9b-4fa5950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "686654a9-8744-4acd-8c99-882671eb86a5",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-99bc-4332-b6d9-4d2a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "ffa1f4b4-6c33-41bb-a9c6-8497c56cc1c1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-94b4-4e97-9c23-40df950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "076dfd16-0873-42f0-b06f-fbbcaae6b7c8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-f7f8-42b2-9b1d-46f1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "af66b768-1c00-49f7-a4ff-803d8ab37233",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-e370-49da-934d-42ee950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "dd6bb24d-60aa-4447-a2c3-53e4719c1a6d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037660",
|
|
|
|
|
"uuid": "5c6d225c-8004-4270-9692-4227950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "d17533f6-f053-4ad0-8ac3-e4640059a3f2",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d225d-ac18-4a3d-9abb-4b95950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
|
|
|
|
"referenced_uuid": "925757a0-52b8-4622-a57b-ec05a890b587",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d225d-9024-4b85-b922-478c950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656090",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "52800c76-a043-4338-ad2a-bd3f96879053",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ee421d6a-ae10-4297-8f38-a0f00d8a092d",
|
|
|
|
|
"value": "134512996"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bea16ebf-5ff7-4ff0-835b-1398ddb1d94b",
|
|
|
|
|
"value": "i386"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e9b7c65f-0d69-4e10-a72c-ff7a2e789e95",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "5910b2eb-4dec-42b6-a2c3-ee472baa3f08",
|
|
|
|
|
"value": "16"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
|
|
|
|
"referenced_uuid": "519d047d-55a5-45d8-ae55-1f511b364c39",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d225d-6124-46e8-bae1-44bc950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
|
|
|
|
"referenced_uuid": "d25ea6d9-0e80-49d5-98e9-489b46660622",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d283e-7030-4596-a55d-4de102de0b81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
|
|
|
|
"referenced_uuid": "e56872f0-2860-4b90-b6d6-e90e54a7062f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c7068f4-4ae4-4cfd-a7a8-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "d962321f-1084-4c72-a7b1-f67e9835ae83",
|
|
|
|
|
"value": "DEMON.i586"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "9bb8ec67-8453-4743-9625-97daea7ed253",
|
|
|
|
|
"value": "77914"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "041f798d-3352-42df-9664-3f22771d9cbc",
|
|
|
|
|
"value": "6.2564628860216"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b542fc75-c457-4e19-b939-33a40596f14a",
|
|
|
|
|
"value": "0755c04f9f428ade09cd6521ecb21510"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3c5e7661-839e-4321-81a6-ad3a27782b18",
|
|
|
|
|
"value": "512dba9737600b1a9beebcc2b32b1392dab3d20a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6436ec08-0c19-4779-8e29-7cb7092b3936",
|
|
|
|
|
"value": "85a118a21531fdfdc62ffd2f39376fa67644d8cd4041a288b770def0a4f5f5d7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d7f320f1-dbbe-49ad-9a63-b7fa4d214c53",
|
|
|
|
|
"value": "3e4f368ba6c7ce75ae1e1c6b7aa4e59a86f190c7603a418302f20063b10ceb65952d7ecacd5739442a1176537392e444e7436dc57c1e0170242bf76f1ebb4246"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "02ba7344-c2f9-4cae-8b01-60e7a926649e",
|
|
|
|
|
"value": "ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "fad20445-dd3e-4622-a930-9068b609f435",
|
|
|
|
|
"value": "1536:HiEYbgsEjybsUnJ+xCJhMNhVxcEutZBY5FLokXHrqm37SVcFPLE/n9E:HiOjDUJVJhsvxchtnvk2mrSVcFjE/n9E"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"uuid": "e826781f-d8c9-432f-9e69-4d36839e3633",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "15b98676-5615-4daf-924d-fffcc6416d46",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "7d5363c0-1912-49ed-92d0-3a341d55f434",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"uuid": "3986c66c-514e-404b-9e28-7ab45578994e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "343fee90-7eb4-468d-8cb6-1d393562f894",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fe7f27b1-f805-41b5-9c5e-090604ddb3a0",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "efd985a4-15fe-4796-b684-f82646770ada",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "78f74560-c4b1-49b3-bdbd-171476bb094c",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "be52dafa-0e46-4d85-aa25-6e2d003213fb",
|
|
|
|
|
"value": "28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "64c8f766-180e-4cdc-b874-637a8fc2f81d",
|
|
|
|
|
"value": "3.2813172094433"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "65e2d7ee-e7c7-4bcf-902a-4e6ad99360b4",
|
|
|
|
|
"value": "946453b1f624469c9e68fb21aca320e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "ed67f8b7-beee-402c-be4f-136d8f44112b",
|
|
|
|
|
"value": "93b5f942551bd90358a39256eaaa2eb534b25338"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8875dd5e-6eda-4445-a613-cfa94565c8c8",
|
|
|
|
|
"value": "8034e5a1d7bf01476c236e4fd422f053806d2546781678b83d3bb3cefba943ca"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a73e8684-047f-4004-b484-7ce6a0718603",
|
|
|
|
|
"value": "92110fc32858adf02d6f91d6d1ea199481b119d64ab2848ced93b498a09abd34bd7cdae3b5acb02af0e17db85de14be793aeaf79b53076d1a4964ea704770777"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "60ce0d7c-eb34-41c9-a56f-4e94357ac1dc",
|
|
|
|
|
"value": "3:ZB1eFhlG:slG"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"uuid": "bd803983-4b03-49b8-ac03-9d349ce2c233",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fcd0af55-9138-4694-92e1-4a7c1d774ad4",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "dc65544e-4018-46dd-b2f4-6c270ff79d06",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "33972c8b-a038-4294-8ecc-aa75c7b7126f",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "65e86eba-d975-4057-a904-0228f0f0dcb5",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "63bab65c-1e40-4568-9d5a-c0956a43be3a",
|
|
|
|
|
"value": "43508"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "773aef0a-4b5a-4a48-b8a9-3f82d94f9a65",
|
|
|
|
|
"value": "6.4008500745915"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656277",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "e08f0f8b-fdb4-45e4-9cb2-585289afb8a6",
|
|
|
|
|
"value": "2f0c8d67abcd9fd170fa90b68406ede1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "e1eb9a52-f6b5-4fa2-8f87-21af813973e3",
|
|
|
|
|
"value": "2e0d6ab0388b790660a2e8019f5bc5f5513d1f1c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "460a57a5-8f0c-4b68-8e73-b88332736c92",
|
|
|
|
|
"value": "df266130264a3175ce8d9cf9f531f930ec82258075381fc505ec760a674a2586"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a84aa478-4bd8-44ae-98d7-54d08a9c64f7",
|
|
|
|
|
"value": "3cce3276ecf8cc3d529d2b8d3c9ca6d3ef1517ed4a651b85264896b110fec96f8c6b3285e0fc4b84c78d5cea4d3eb02d50feb0d17b3c2b43434b116b275207c6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "aace43dd-a5ce-4117-b74b-df3e35833c26",
|
|
|
|
|
"value": "768:Qmbry54zxxo6vRpFhGQ5l+fjxvAtW6TpRKp1Nt0bNqprmzqEswpQ8egCBFGtRE5:jry5upt/5IbpYWGKXX0bNK+ImCBFh"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"uuid": "c0d75914-c1de-4526-a7ff-48062734a6bc",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5cfeb529-2512-4c91-aa1c-362135ebe595",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8f41cbc0-bd69-475c-8e61-beb7fa9238c1",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1eb231f8-a297-4e12-a378-c9d27b72c6ea",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "492740e1-7493-47ae-b5c9-a9a3e0261174",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "6ebd9949-2306-4fce-86f9-a631b74bee65",
|
|
|
|
|
"value": "23"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "7d93a74f-a2d8-4af1-a8a3-ad39fe1f990b",
|
|
|
|
|
"value": "3.827909782144"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5f9ddd28-d711-48a7-9d47-0407d9bd1daf",
|
|
|
|
|
"value": "7ce407009e96c80aba9fe31c0c06592f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "fc3a2408-bddc-4fb3-bfbd-91b4996fe10e",
|
|
|
|
|
"value": "d8639c8ac95afcbd99e1749a971493d20927c81c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ae4dfb17-39a0-4f55-afae-10f99eaf5c11",
|
|
|
|
|
"value": "457c01283d10bdda529f14fd58d061fd782b7c34de72de35f32372935f5c0256"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "6aa69585-18c6-462d-b93f-11f8030f110b",
|
|
|
|
|
"value": "a74e506546d13e5b742f7e2828a916f62e453542e21d7e52187dfa28e0a2b49aa5438f6df5e475165df822009d7b3c2a0c08ade784150d37b3f2b82e0bb4fdd1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "da3c3b89-b131-44c5-8b1f-0f4a6ed619c1",
|
|
|
|
|
"value": "3:ZBEaaxG:YK"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"uuid": "56631f91-e310-44a3-9ffc-5f87beca5393",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "05dad726-6f15-4f8d-b9f5-054a8fdafcd8",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "41e60890-00ac-4ea8-9f51-c18f72b4054e",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "29adf672-354d-46be-9e90-7c5e5c5f1fc7",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "be1c7774-4a04-4dea-bf06-5246d4f759e4",
|
|
|
|
|
"value": "8480"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "48004fdb-3675-45b2-b35d-bd2b4b6ae82b",
|
|
|
|
|
"value": "5.4139520501754"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4b2f4bd7-d192-47f6-810d-76499e79f1d3",
|
|
|
|
|
"value": "ca320ffcf251ff07dcb6d7c045eecf9c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "2cf9af4a-c82e-4374-a8ae-c0b0bdb56d8c",
|
|
|
|
|
"value": "88baa0a5a26d68a1a3073a4068f05c76564bc1df"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "55874e44-e451-4480-b87a-27fc5b4bffad",
|
|
|
|
|
"value": "b52caf136b40ede2f5941bc11bdf7145e2b2ea2fb854151f65b0a097ae1dbc53"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "68287fee-2efc-4ed6-a6cf-c479de35324f",
|
|
|
|
|
"value": "6ce034c83930c50840d402522a70cbb3b85a8070bd38a3aa6e0c914dbd17a29175463486e358854ae2d850b4a32c562f94ce3d01f65777a1032a312b051d5217"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656278",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "9b59abd8-a2a4-4e8f-8ccb-4c6a2b48dc65",
|
|
|
|
|
"value": "96:7+McqAcsBMHHFUaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fpej2uvQQHN1Ml:FT1HWaEnlRum67bqlOVyQSWB3nwY"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637902",
|
|
|
|
|
"uuid": "fec33774-1305-4cf9-a062-9695c3c0b2f8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "545a6936-ce56-4c76-beee-600baa04873d",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4c84a3c6-6117-447e-83f2-4615a1a21800",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "29c27bf5-f615-42f0-8a6a-fb518a7849cb",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "3f80712a-c25f-4781-a6b4-dad3931cb28d",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "636ece13-6266-44e1-89c7-4e7e8c30de7f",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637892",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "df11d52a-28bd-45f3-95e7-46393bf91425",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637894",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "96475519-a8b9-4854-85ad-ed03ed6cb3a4",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637897",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "1d4e8495-d810-4e2c-a354-360313b7c3de",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637900",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "0f6a301e-969b-463b-a8e3-d7f08a4f1692",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637902",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "95b65b11-1557-481c-86b9-049d7409a2bc",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"uuid": "8a8f8c42-4139-4fbd-8e47-95c67bf44b7e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f069be34-867b-40fb-a957-f17eef48e466",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "50e73624-06c7-46dc-b51b-62d614902324",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a4e723ae-5748-434c-8aed-d3c11b36f0ef",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ff5bae1e-a925-45aa-8451-1c683c6fa63b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "6d4668a7-7670-4e2b-bf9f-980191f35942",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "f242094e-b290-40da-96f3-108b4819be13",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "baa53f5c-ad95-468c-9fb2-493922b8d620",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "00bcf0bc-13b8-44b2-a702-4d875e14d05b",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f6d861c2-eb4a-463d-8113-dc0ea864f02c",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "182d380d-5ef9-42ae-a554-fdc94898ed99",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "dac6c66c-9e26-44e1-b1f5-1802a88085ef",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"uuid": "06eddc48-a6c1-4ee3-b93f-59153e8d07e8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "97f1ac5f-2bc9-44cf-b20c-d912b958f610",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "73f2b130-fc2e-4bbb-bf03-a7f57b2c5b6e",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "090c171a-4324-4e20-bc8d-c7c797eeb0b2",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "33fe90a6-24d3-4042-b0b3-226f9035898c",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "714bf7e6-4c77-4d08-811a-dcd4aac9483a",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "afedffad-709b-481d-ae83-92d9b5060d69",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "7fcef0ad-a124-43c7-aa7c-068f7f0e7fdd",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "0b2ce364-69ae-45de-8c26-806227e5d4aa",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5514d363-baa6-4b53-b85d-0548f15495e1",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "6ff84d9e-0c6c-49d8-a1f1-294bd2019f67",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656279",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "c3b5c7e1-2d68-4917-a887-5bcfb3838345",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637888",
|
|
|
|
|
"uuid": "65ea31ac-3e42-4d1d-b488-ee8a30e3ddba",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "48331a38-45d5-4cd9-b78f-c5d2b107bd13",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a45282b8-9b8f-4f5b-8532-a35c09b5fb61",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3cab8c3f-b7ea-419e-a107-a1996f56e618",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f4d0cae7-2637-4666-a441-3149025a496b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "8f75dc9c-30c9-453d-8853-6c962bb3bd54",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d5ebe091-95f6-4754-ae2f-cc9fbbb8f65a",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637879",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f3871d21-8e1a-44e2-9719-42f7fe1a9833",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637881",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "be820cfa-2145-46f9-96a9-6f36bfa49199",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637884",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "7b1e6e26-09c6-4809-8a96-7d61abc84431",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637886",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c5d5c34c-35ad-4ea6-8ed7-a454cb7a8972",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637888",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7d85f922-28cb-4ec3-ad5b-e7912e829528",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637621",
|
|
|
|
|
"uuid": "c02bb6f8-3bd6-4cab-af0f-d4175ce1757b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "810c859a-4dc3-4540-bca1-a7ddaa6fba4f",
|
|
|
|
|
"value": ".got.plt"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d4e73946-00de-4881-93fe-36df537bc8b9",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "48c653d2-ad66-4063-b62b-5524f0b127fd",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8c6b9cfb-5f15-4e2d-8ac5-764e05d400a2",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "547de2a7-994b-4c46-9ee5-256a58a414dd",
|
|
|
|
|
"value": "12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "6f8ab835-9365-495e-b3af-894fc5d4d22b",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1612880709",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "9cdfc299-e2ff-449e-936d-14c3fddd34a1",
|
|
|
|
|
"value": "8dd6bb7329a71449b0a1b292b5999164"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1612881013",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "00a81644-aac1-4058-ab8a-04c56555b94b",
|
|
|
|
|
"value": "2c513f149e737ec4063fc1d37aee9beabc4b4bbf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1612881016",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e69a1796-3103-4ee6-85ee-f570a548058f",
|
|
|
|
|
"value": "15ec7bf0b50732b49f8228e07d24365338f9e3ab994b00af08e5a3bffe55fd8b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637621",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "8c595343-a26c-4370-8f84-be2cd79d1220",
|
|
|
|
|
"value": "666a9a1a7542e895a9f447d1c3e0ffd679bbf6346e0c43f5c7a733c46f5e56c2f65e69dfd4769a9cad2b79b31d282f1ca2aa296ef41bd9833947ada194f46940"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637618",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "085f4b73-2331-4864-882d-89b5948cc30e",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"uuid": "8e061ff5-a705-494a-8cec-a45f3aa7b0b4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "53f501af-8f58-45b6-8f1a-3380bcbee7e8",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5746c72b-6c4e-43d3-9e88-ade93637de4e",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "857151aa-c532-42e5-82fb-571152518101",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "32ee4f00-a33c-42ea-8a6f-211d45b66750",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a9a2282b-2193-4239-913b-bfb3a14f3d13",
|
|
|
|
|
"value": "672"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "763376fa-5336-489d-b15a-cdb2650ab986",
|
|
|
|
|
"value": "3.5158060441528"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "2b9e57b3-03be-425e-9185-5feae003c465",
|
|
|
|
|
"value": "495baeaab088b47da9a43293adf82bf5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "eac78f21-c401-4360-9287-cb36cadace5c",
|
|
|
|
|
"value": "7507239d7423f6a2678522615b3e00382f654dff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "472f6d25-f846-4b47-a347-8b44006df6e9",
|
|
|
|
|
"value": "fe8c3dccfdacebb0075af3ee243e912019199498bff86025869cbf20620cf3bd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656280",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "b16ed96d-f2b8-492e-9339-7969cf61f3f0",
|
|
|
|
|
"value": "90ccda823874d344bf7e243f67ae7aba1752b9322fb8d0c985e25374e940b229b480a8867fd725a25f956c4a6a021626383f06e627e3bd9c100e335061d57ebd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "64998020-148f-47e1-9b3f-d50071ad5215",
|
|
|
|
|
"value": "12:Ut8E0/n33jzxkyEEEmhIKybSvOH/YJ45y5t:Ut8/n33nxThIKLD"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"uuid": "a30e6ecd-679f-41c5-9535-9bba600cefd1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bc9b6dba-b7dc-40d2-b02f-c3653e1ef8ed",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "71672956-34c6-44d2-a352-30ff41739533",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ef4a436f-522e-45ce-8ff8-f4c4a4cade4a",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c1aca3d1-5526-4cc2-bad3-c2d6bde6723c",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "26e918e1-6c34-4ad9-9236-785d0d0d49ee",
|
|
|
|
|
"value": "26340"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "0eb0d829-f3f7-40e8-be92-44c973dc1f4b",
|
|
|
|
|
"value": "4.8838687170362"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "08c615ec-071f-426a-8a70-7cc3cb5fd63b",
|
|
|
|
|
"value": "1f9055b62fe4f941595ab4f1e62a2e3c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "50cd1f1a-3bec-412a-95a7-570b8eec864d",
|
|
|
|
|
"value": "1f6e1b03ada08a5738acd9f949bb910461ca0ded"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5f32ae6f-b4ee-4cd1-ab78-2d25284dd43e",
|
|
|
|
|
"value": "bed25eedec6353846ad15a3e778d20345411ed785a30ea6ce2e339380d93418f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d753db69-5bb7-42a4-8aa7-b46d3ea603ee",
|
|
|
|
|
"value": "7343a0f67bc1409a106e66e5b6d3227db4712729ad2e4d0ecced34d685593c930809d66c9e089c1bea9577ffc266d2882fc7c17302c2f132102eb244366bdbea"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "f4576550-9d4c-4808-9e9e-8f7be5806243",
|
|
|
|
|
"value": "768:QEW+mFlVFvuBJ2TlmXn1JSVcFPzfE/O69:QV+CABGm37SVcFPLE/n9"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"uuid": "4fe89ca0-8d15-4412-9c39-907e06000097",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8a77aff4-0ac1-44a5-bab1-9ef0bba66b26",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cd18b5fb-1e75-4db1-b175-5c7d0dfe3cbc",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "177815e4-a1b3-4ffb-b78a-2d5bc50fd570",
|
|
|
|
|
"value": "2970"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "70456af5-777a-4886-8736-aab1d9f39d7a",
|
|
|
|
|
"value": "3.6143694458868"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0edee7df-03da-4d69-83c9-4613341e1cac",
|
|
|
|
|
"value": "b1cd8554072473955f4f920916a223cc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f8a06288-d1c0-49c3-ab06-543efde013d7",
|
|
|
|
|
"value": "20f0b0f41ba3869658e81d7269a8f28c164f7d94"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e2f3fb0a-11aa-45b9-b4b6-81911999db37",
|
|
|
|
|
"value": "e394a3cc2e99cf74ad01a38ee5bb9431fdc2a4d816bce290e39a887b914a12b9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "9944338c-68ac-49aa-af52-2988eadcbf8a",
|
|
|
|
|
"value": "8fd36402cab1a8c9203924267185190a18fd1cd1a7a31446c4ce43c59565b2978888567441e6328006d432cd8d70b3b03afed15b9781b7fe6986f34d1a90ad89"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "5daf2e37-8e8c-4052-8ce6-14e77a0ce403",
|
|
|
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUg:u"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"uuid": "14ba151f-dbf3-4567-86d9-a7ef3a3a92a1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "68fcc396-a53b-4c22-b878-ef1673a18fb9",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f5494c6-fdda-466c-8def-c915395312fd",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "af9800c9-4a10-4d4c-97aa-a2bae60b6494",
|
|
|
|
|
"value": "111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "7a7ca466-c18b-41f0-ad7d-c698a3b15a40",
|
|
|
|
|
"value": "3.9464055386973"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656281",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "32d478f5-2fe6-4355-82e5-11f4902ee31e",
|
|
|
|
|
"value": "d45c87701f772bf923c5372dd4be4e5d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3d6058e6-5f18-44d5-9526-110dbc5b4f2a",
|
|
|
|
|
"value": "057410d34e0ec72796d60dc2f8b41a82acdd466e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "66d08dfb-45ba-45ea-b807-6966f2455594",
|
|
|
|
|
"value": "5095f212da7a3bdca84036162db03dcdcc7bee4a14f70e9592d1088e8f8925cf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d0e82ab1-61a1-4f66-8da6-bd8a1ca3b5ac",
|
|
|
|
|
"value": "a1397dfaef694805c577db98e7e56d8d954c0e1b8a406e7ed0bab482acdd7ea0fc4640011adf0970fdb1d39ffef396d2e7b3fc108f1fb633b300cea41037424e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "32b4ce9d-503e-44cc-916c-13939037ace2",
|
|
|
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAllZBJR2iLT6:EXwWEgMF84MFTnsRAiLT6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"uuid": "ab60dc7f-1824-4330-ae97-d4fd35d8b19d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b9e4937f-0618-4734-8043-695883e57fff",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "47de8b69-1967-4ce8-80ac-eb8680260871",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e6907ca0-f7a3-4506-b004-2e781111b66d",
|
|
|
|
|
"value": "11536"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3391160d-7602-4bd4-b87f-cb4a6aae025c",
|
|
|
|
|
"value": "4.0869338685196"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "83111866-2e66-4cb3-a71e-3a168970d86f",
|
|
|
|
|
"value": "bea0764dfbb8077eb389b0f9dc892808"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "de8d1138-0b5d-42a1-8e08-633015632494",
|
|
|
|
|
"value": "1d73427fd3aa3d03409e2797b470afbd7e19954c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e7851e0f-0fa9-4c24-9084-52ce05320ce1",
|
|
|
|
|
"value": "7c0b08b83d7ab9eacdf43858dd4b8821e3d6da350ac4b2370a8c03c113c8370d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "ade09b45-70d8-4a69-b188-2250af24d497",
|
|
|
|
|
"value": "fc604165e7b4c6ad671f2aecdbc8f79dd27143bba3f9ae969bb8f415a86b2d63a3922ced7783a2dc932d0ad39ff3eebf71174e144b461721346d74705d6a4695"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "70ba2316-5ba6-4dba-8e26-2ea691d0576d",
|
|
|
|
|
"value": "192:EB/OQrqB1AVi248/vZS3jzVljvuy4uzG1l9KMNv7VS7vN:EBW+mFWSjzVljvujuzG1l9Kf7vN"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"uuid": "8c00983d-18f4-43af-924c-52e733a3ba2b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f6d4a4d0-9180-41d5-9694-6903f979e978",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2ed3f4ae-0397-4682-b298-ce373caa3e0d",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ce168d64-08b9-448e-8089-b0799e1acb4e",
|
|
|
|
|
"value": "8702"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "24ad1579-ba8e-494e-b572-ee93d1fb3d0d",
|
|
|
|
|
"value": "4.6002506022584"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b4f913d7-8f90-45f2-9454-33dd9644eeae",
|
|
|
|
|
"value": "bd65edfb3834377fddf6069a3497afb2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "25a3b62c-04fd-46a4-b197-80cdfe312364",
|
|
|
|
|
"value": "4ad0fe87fb2e0027a427317a303deff1d7358fde"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5bf54a78-237f-4290-9bee-1fa6a1d212b3",
|
|
|
|
|
"value": "bb24c45c7c4b2472d45e73dd0dd1538f4adac9d7f3d759fd83f57d394113bd82"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "decef655-c8f2-4ded-aad7-814f201746a6",
|
|
|
|
|
"value": "bcc8fad6e3c5f076204fda6bfad9d2ef5b2dda1ba32f48702729af629295365a698495a2a899691298c0c1118396e1a6f1784768aab67442a4a515be42515095"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656282",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6e991ce9-6096-4648-a88d-af7479b4b77c",
|
|
|
|
|
"value": "192:udc7IifXpVqODIiCfxwmX8015s4S2nMVfE0kNCe/tShQlfrFe/OhDZqD6aEJ:udc7IWfDIiemmX8015HVMVcFUe/tRfZv"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656285",
|
|
|
|
|
"uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "e826781f-d8c9-432f-9e69-4d36839e3633",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231b-9e44-4120-9e7c-4712950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "3986c66c-514e-404b-9e28-7ab45578994e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-b958-45d4-8a31-4a7c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "bd803983-4b03-49b8-ac03-9d349ce2c233",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-f458-4ff4-b030-43c1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "c0d75914-c1de-4526-a7ff-48062734a6bc",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-0cbc-4cd8-b0fb-4fe7950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "56631f91-e310-44a3-9ffc-5f87beca5393",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-b398-4108-8d77-482a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "fec33774-1305-4cf9-a062-9695c3c0b2f8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-07d4-45c7-97d4-4ff7950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "8a8f8c42-4139-4fbd-8e47-95c67bf44b7e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-4cd8-4bce-a9c9-4e79950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "06eddc48-a6c1-4ee3-b93f-59153e8d07e8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-7cd4-4c77-a491-4a28950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "65ea31ac-3e42-4d1d-b488-ee8a30e3ddba",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-1a58-429a-859d-469c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "c02bb6f8-3bd6-4cab-af0f-d4175ce1757b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231c-c650-4c5a-9775-4d36950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "8e061ff5-a705-494a-8cec-a45f3aa7b0b4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231d-20c0-47fa-a09a-4e7d950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "a30e6ecd-679f-41c5-9535-9bba600cefd1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231d-b59c-4f38-ae6d-4da5950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "4fe89ca0-8d15-4412-9c39-907e06000097",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231d-db24-4cae-b651-4acf950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "14ba151f-dbf3-4567-86d9-a7ef3a3a92a1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231d-0ed4-4218-9159-42a7950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "ab60dc7f-1824-4330-ae97-d4fd35d8b19d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231d-097c-42c2-b2af-4d9c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
|
|
|
|
"referenced_uuid": "8c00983d-18f4-43af-924c-52e733a3ba2b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231d-fe8c-4eef-aa6d-4833950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d6fcc0ac-5216-4aed-bc66-485534870be3",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "302663bc-8f1c-4aa0-b3a6-c7edfbc73c4b",
|
|
|
|
|
"value": "134513000"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4676d6ac-d66f-4d99-b3c8-9103ee41ebf8",
|
|
|
|
|
"value": "i386"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "36cf7203-46b6-4f89-8e5b-365b7f083f5a",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "5f23d28b-fac2-49e1-8f99-4887a8c64e8c",
|
|
|
|
|
"value": "16"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
|
|
|
|
"referenced_uuid": "2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d231d-30c0-4e03-8706-44dc950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
|
|
|
|
"referenced_uuid": "e3af71ca-c00f-4243-886e-3c4d279bd335",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d283f-d8f0-4054-bd46-4ff802de0b81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
|
|
|
|
"referenced_uuid": "bdd37f7f-ce08-4bf8-a7b6-378947ac1f32",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c7068f5-5a90-443a-a711-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "2ca2fd45-cffd-4d9c-8bc2-f9cb392fe353",
|
|
|
|
|
"value": "DEMON.i686"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ef0d2508-b3e4-496e-995a-04714dd154bf",
|
|
|
|
|
"value": "77914"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "8123b72f-ceba-45a8-8c6a-c50b806d4b6f",
|
|
|
|
|
"value": "6.2701582913484"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "e0ec6489-5495-4e6e-a2d8-f8517482fe26",
|
|
|
|
|
"value": "bde9386fe86ee8981c2eaf2bb37d4847"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "86c14359-ee7d-4f8e-8a96-75ad77f6fd1b",
|
|
|
|
|
"value": "151be1cdc5a490710853abb95f453c367e4ba568"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9d6bf7de-5ff3-41b6-b545-7fe1e156be42",
|
|
|
|
|
"value": "7eefa483e23c0ae2e67ce3c3a399527b3244c6d23af4401842bab88276b26840"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "393a17aa-a79f-4148-8a12-a2536ea46c9c",
|
|
|
|
|
"value": "d25fcdd1f684f8b4fb0bb01ce137efce29280adc73410381693910689a93c257c37307d4d5f594e45335f4f2955b1c58684b93216a70c954df2c2141a5a584a1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "266d7207-4f1b-4c34-99f1-eb290164c70a",
|
|
|
|
|
"value": "ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "97cdc230-95ef-4d02-bd8f-8c7d8c76bf78",
|
|
|
|
|
"value": "1536:jry5upt/5IbpYWGKXX0bNK+ImCBFzklV+CABGm37SVcFPLE/n9E:xpt/G/DHiNK+Im6zk6GmrSVcFjE/n9E"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656318",
|
|
|
|
|
"uuid": "1d2a78b2-cca6-497e-8d34-e4aaf48058ab",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656318",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c6596193-03af-46cc-af5c-7008b212515a",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656318",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e9f5be66-b6d9-4f0d-89af-097038d93044",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656318",
|
|
|
|
|
"uuid": "3736e5f2-fbf4-4c27-9a64-1329ce50e0ff",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656318",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "af1a8a12-8768-4b31-b5d7-1efcf77dfd9b",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656318",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "627c9b20-dee9-4fed-89c2-7f02ddd8820c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656318",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f29738df-db7f-4f56-8638-0cc0c15e7a2d",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656318",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9138e674-d586-43af-bcb1-ad39bf843b10",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d5db1b52-0b36-4c31-9dd8-3e013714028a",
|
|
|
|
|
"value": "20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "c03aadda-62e0-4ae8-b17e-9106475cd2a9",
|
|
|
|
|
"value": "2.901609497059"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "c19a1606-ed8d-43ef-a388-8fcccd5af20d",
|
|
|
|
|
"value": "a9c9be8d9eb9e77aac33aa7bae066731"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "e8a22765-665d-44fc-99d6-e289f8ca780b",
|
|
|
|
|
"value": "0d47d0e8abff08dfdc6dfdf6dc414e7d5aa93637"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "51febb2f-a977-49ec-b562-1b04687ea4ef",
|
|
|
|
|
"value": "4706dd1cc5c80f6d5477304e8e04168891327edae60a4154e2f3eca3001891bc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f78d6880-1efb-4830-b57b-5b503bd08f4e",
|
|
|
|
|
"value": "9be82bc735fc25d99f1bf85f09b6845b49933341f069c9accc22862319ba712eb0ec9bafe1d1ff726038619a60143df3f402c9a1a960b510c0ef1ea878cf7455"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6fa51a47-bf2e-45f6-88eb-872cd9880e8c",
|
|
|
|
|
"value": "3:lBXVQ:jX6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"uuid": "053151e3-420b-4c23-a820-a05687c79638",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b36554f7-7d7f-4429-b401-234476953234",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "df4e1586-0720-49af-a037-78455a3065d9",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "98b41c44-bf85-4abc-987e-d9b5fc6938d2",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1e01be64-44fa-4040-8580-e83a763747a6",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a8718a27-0c0a-484d-8193-8c452561ed7d",
|
|
|
|
|
"value": "62064"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3757587c-4773-45fa-b2c6-c30c4e696766",
|
|
|
|
|
"value": "5.9094029077613"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "1ca2e4a7-d8ad-4bf2-9bd4-b21e4654b1f1",
|
|
|
|
|
"value": "a029a30f3ee421b5f5785bee5f816471"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "97c36135-598b-45fb-96ab-20c783f645f3",
|
|
|
|
|
"value": "f5636d01aeb86593f57604285593120303f7fc94"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f6ffb77b-f75e-4644-b67b-793097b2383e",
|
|
|
|
|
"value": "757f8d44119cc1943044285a440966da712312fc3d478005d0c66e7813c01516"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "695cde3b-e4a4-4973-8402-3d922b091f8a",
|
|
|
|
|
"value": "303707055b7993d86f733366ef9093b9e684c759b83534899531c1f34bcd2bd6fe7203c47158b0a0d1508da989ff844577d5e7599ada8a3a851e86d6bd0b2f68"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "bc594ca6-6455-4b41-b05e-4b966d92fe3a",
|
|
|
|
|
"value": "1536:YuKREOV7Djjd8FHvlpaq1706Tbv5lrOXdyChY3:hKVDjjwveqhb/6dywY3"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"uuid": "42057437-daf0-47d5-8ef9-1265ca9c3bf8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e14b483d-9878-4bd6-896f-14e13cf46f05",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9a93e3e6-9d45-4ab9-9c5b-1d9a2dfb5d14",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8415555d-0652-4763-9476-d0523e4328c5",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a5a56362-2a7e-4979-9490-61efac7efac0",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c543de52-d03c-4897-b23f-6217c45205bb",
|
|
|
|
|
"value": "14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "bbfdc929-57a4-4b9d-90d3-d1e115c17574",
|
|
|
|
|
"value": "2.9852281360343"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "25cc4f8f-ced2-438f-a9d6-3b7578c28ac5",
|
|
|
|
|
"value": "cd7ad9d42e23c4ac3279db8f33c762c3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "bb8b99f7-43a2-45f2-90ad-6ee8ede8a046",
|
|
|
|
|
"value": "0ebb8cf53d2cdc48d66038659e80686533c52ccc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "3ac94502-16ef-4938-81ee-dd75799a880c",
|
|
|
|
|
"value": "e3c4978704e0676fde8d695de54a2241bb17475548cb4547ef223f19a3a97915"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "37a2e3d7-4738-45e8-8f5e-30ac5715c87b",
|
|
|
|
|
"value": "5456c1ac5abc12196ed54c61865e6d1bd48cadabc53960e10921cfb5f30d221b4c931224b1f5e3f4b87e648ba9a9ad9d019f0e22ed1477cd14ea6b8172317e60"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7cfec836-b12f-4c4b-8087-74441422ca22",
|
|
|
|
|
"value": "3:l5n:v"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"uuid": "55e74daf-857f-4346-9f69-051c3955ecf3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656319",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e4543b76-e7ac-406c-8738-6af84f16c77a",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a8815bc2-ed7e-42c8-bb35-630b6b7efee6",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "63e9309c-6029-4e04-90b5-265f09873637",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ace0e900-23c9-4337-862f-60c5117e719c",
|
|
|
|
|
"value": "7764"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "cf0f8efe-0c23-45a1-b607-043690ea7a9d",
|
|
|
|
|
"value": "5.2855067265611"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "21b8c03c-3108-43a9-87c7-8bbfc05f5ecc",
|
|
|
|
|
"value": "1624b5940285ceaf030d8db4a39b12f9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "14916cef-e8d4-4f6c-941e-1537d56861e7",
|
|
|
|
|
"value": "6dd0586ef310836cc490a09428dc8572de4707cb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5e1f651e-f825-4d5e-9127-6b66aa9cd5a1",
|
|
|
|
|
"value": "c1d23cc4c8757bc6f027d2ccec23289e5f2564dc72916b235be15b7e1a887b2b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "18ac6938-2226-40e7-8e76-29e22a0276f9",
|
|
|
|
|
"value": "69f565c6b426cf01b75a60427473b58021d1bb54ca6493a782c563fa4920134d3c9615c3158e284c46df6aa899836c82744d1958ef7fe2d698f8bd54ccc2167e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e03944cc-3cf4-4a70-badd-0f9be8b4ac20",
|
|
|
|
|
"value": "96:5ocRscsYZHHxWaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fpc8EqeZn:59lHMaEnlRum67bqlOVyQSWB3YD"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637875",
|
|
|
|
|
"uuid": "db355308-9731-45bc-bf64-a51def874d82",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "25e8ffc5-ef53-426a-ac93-b18ff01fbe36",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "55fc047f-022f-4133-b86f-8445bfe11f04",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c6460ea2-5a4a-480e-be4d-ba4ed5b84256",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5fe25115-b0c9-459f-9681-a7134f9f0c8a",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3770d9b4-fe4b-4ec6-9c40-085d4e307c18",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637865",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "923427eb-c493-4a97-ba98-580f252a0af4",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637868",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "4456296d-194d-4cdd-a367-a3a5d2ec9689",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637870",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "b13e4814-a784-4af8-b7c4-c146eb00edd6",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637873",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "760e2e87-3bd7-4afa-bf0c-509676c569fe",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637875",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7f62a66a-a0f0-485e-9c27-4aa921c39b17",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"uuid": "51a41008-1ed4-4a5a-b4aa-d61c285491d5",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "dd659746-7b2f-470c-9fde-38d85758c4cb",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6ad66790-2e39-4fbd-8dd0-ffb5d3990240",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1eaf1aaf-a4c1-4bf5-8a72-35f72e475ddc",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "97409492-3bc7-40b8-8bfd-40ec18299672",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c6c6a408-4214-461b-898e-9ef340145a54",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "fc6865af-0bdd-41ea-bd9f-1d16a38032c2",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "e7434aac-b0fa-45a1-8b9e-f649cc388671",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "6e65546d-e913-4317-8d30-1054fe12aa14",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656320",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "db72d7f8-44de-4029-9b73-f8cdbd9e86a7",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "199644ad-eebf-47db-87c4-7e60a6ce16d0",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ed7bd03a-c5c7-47a4-bc63-1870dc6c5c94",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"uuid": "b2e6ff07-699a-4a1f-aca7-3a21fc9300ef",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9e135c8e-64b7-4684-9773-8e866ea7bdf3",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "df86f49d-3b0f-41fa-9bf9-b9e2366b503a",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a8bd8e54-ba96-484e-bcf7-0f294f36e791",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f25c15cc-657d-47a0-bc0d-f4fb7b46f1ef",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "09e1b018-35c9-43ac-ae06-24e97a97b8d7",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "7f64c459-6284-4bba-8f80-089caacc55ef",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "7584e310-d961-4bec-9f51-ff5e4d3da93b",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "d4190874-5dc1-43f5-80bc-9683369fd12c",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "878a492c-5284-47bc-8975-9c7574b276a4",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c11b6df7-f812-4c4e-917b-d4d70f4c3990",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "0a4f37fa-7911-4b14-a8aa-b31385083436",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637860",
|
|
|
|
|
"uuid": "7ebf77db-51f9-4ccb-8d44-0900b626feb1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "324f4609-1b91-42e8-8547-a8719e673ff1",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d2241e26-505c-401c-8fea-040e67923c06",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "54b94f6b-032a-41d7-81c8-e511f7940c6b",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4d0e6ac8-f54a-4650-b483-5d03372d9ee6",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f9dfbc94-4bd8-42dd-88a3-fb72d90a0e33",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ed8da5d1-49d1-4a9d-8d08-a93d49b36b96",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637850",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b353658e-d2b4-48ad-a754-473d9d0e8c28",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637852",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "40992669-aa1c-4ed6-9678-359b65c6180b",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637854",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "160860c2-31f4-406d-aef4-5780b1b25ea3",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637857",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "371e782c-d1e4-4a35-959f-b806eeb09d2e",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637860",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "99e84016-17c4-4496-8b98-a595bfba224f",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"uuid": "31451acb-ef2b-4981-a413-52be999c4c77",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "570d5337-30e2-4b6f-9e48-83a68a129680",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656321",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fa845967-eaa7-496b-8d8d-b586e2c6ac06",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "eae6cc43-48a9-4e53-a6cf-836a45226fc6",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cccb4a71-f731-4e96-8a6b-df0c97cdf910",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "733012e6-4e24-4faf-800f-4def560873e7",
|
|
|
|
|
"value": "892"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "6b0d1ca9-9b43-4e03-a725-dce74dc99b30",
|
|
|
|
|
"value": "2.8135496342242"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "77a4fdd8-9dd7-43cb-ae84-351ebb925200",
|
|
|
|
|
"value": "8ae59cc88bc43e75968ff2ff86e7be5e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "caf3f07f-84d3-4f49-b696-b92edf91e843",
|
|
|
|
|
"value": "74a1a296b0e13ded5e2f156fe32bc6013f682043"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "66c54ce2-0976-4472-a418-70da41e4b0f9",
|
|
|
|
|
"value": "d07cd306bae6845ff3e1e980b61297eb03e78c9659e1c31c7fef6db5e65775bb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "7f1cbc98-7cf5-44e9-afa1-fb1a7f36ee7e",
|
|
|
|
|
"value": "2d18ffa8d3c9c30a4d51a6f1ad3f0263cea33247c2c013af1a31918a963c0b863a277084495f7095c3a03b955d9e721564c943566b7af9a96eaf78bba2b0ebb5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "fa57fddd-9934-44f9-adb2-69d9245707e3",
|
|
|
|
|
"value": "12:3cGScjsgBEkZqKlbJJCKyN/0CfdPYxpGS6lUl68EZ:3wcjsgLABNd/JYC"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"uuid": "843e2684-e148-4805-8002-5680f152c755",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ea44ab3e-dd0b-4141-aba6-36fd2b24af6e",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "99257de7-9ded-4ecf-aec0-2e2ca3246768",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a3612b9e-4f5e-458b-a486-1fe286420d41",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3c6d82d9-d3a7-46fe-add8-64c25d32019a",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "795d44e3-6d1f-488f-a061-c7ef11bed662",
|
|
|
|
|
"value": "25428"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "fd043e4d-ffa6-4c6f-8beb-c965fd42587d",
|
|
|
|
|
"value": "4.9661637892007"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b4160aae-94a8-46a4-aeff-244c24cffafb",
|
|
|
|
|
"value": "1474d7f22cd0bccd7b9450c2d0439836"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "22534e2d-9e12-448f-9b7c-360394426e71",
|
|
|
|
|
"value": "c37c7a1184e0d080a0ed28e6b747766345d28b04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0bc8baa2-3dd9-40d8-8da9-319e11b5278a",
|
|
|
|
|
"value": "dbaafaf47bcb61e4535ffd5a101f76e2aacba92a133f1abf91c4408f42bf2c74"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "435f56de-f138-49b6-aea7-8578048c3c78",
|
|
|
|
|
"value": "d1aebce6f492eccb8ef5c510a390cc53193d8d4ec4465d5d29893740828c9d2cfbdeb01234a0ef32b0c6b184100a41808c5aae94b5c2f1a77f876bb0200801e1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6798a573-ec00-4b5d-9876-747a07d59773",
|
|
|
|
|
"value": "768:TD4Sp5y1ZM9h4ba+omX3xJFVYQP4fi/H61:TkC412Xlmn3FVYQPui/a1"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"uuid": "32380cda-a18c-42b5-9842-d32ed0ac8899",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "54157889-82a8-4cfd-bcf8-b906ce8d91f8",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "68c987fb-c175-4234-8f60-9b5790151b2f",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "36ec25fa-44aa-423e-ae35-3cb347aeef7b",
|
|
|
|
|
"value": "2916"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "64e43193-21af-49e4-8307-0102f113082a",
|
|
|
|
|
"value": "3.6143694458868"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "13d4b4a2-2288-4124-9169-d51c0e004de3",
|
|
|
|
|
"value": "02ec578b208182bee3aa6e8f4d673139"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656322",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "8544a19b-8dec-497e-98cb-b067fbc5716e",
|
|
|
|
|
"value": "7025d6106eeaa93a1c0544e495fee06fcfcee6ae"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d009e2e3-8f82-4075-b211-860ad0959c29",
|
|
|
|
|
"value": "cecc27f1ecb1563a8becc4fce7a9dd06c09d02faf18d387572455a50bd7f3e8d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "4a0870b6-5378-497d-85d7-62e0b8502639",
|
|
|
|
|
"value": "6ac98d2b929584994bbc2e2739ee269e586b762740a945800e2b76fd423f23e142d5a33259b94b66e6567cfb0f30b13fc1992dd35e594320a9f20040f81ba842"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "af260f8a-3d07-498d-9dae-ccc5af5f23d1",
|
|
|
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU5:j"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"uuid": "b79752d2-5f10-435d-aad3-88d65099277c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b0168304-e523-4b64-ac5f-36ed7fb30ccf",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ca466cbf-505e-4de5-bcfa-5ec5b402673b",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "859d907e-989a-4766-a117-ccf1642e1fea",
|
|
|
|
|
"value": "102"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "c8af890d-e343-4341-a17f-6e66506d83ec",
|
|
|
|
|
"value": "3.8692077817787"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "84f947d6-fc0c-4d1a-bc72-471f0c598421",
|
|
|
|
|
"value": "b748e0aa34cc3bb4dcf0f803be00e8ae"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f9b9925a-0f83-438e-a5cd-c15389595c98",
|
|
|
|
|
"value": "f8afe25d02e36248d719e04aafb2f3edb98bf012"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "57936286-288a-47a4-b159-8ecf9422b55f",
|
|
|
|
|
"value": "c42f97c90874af8fea59609c9455cce16e13d894c3279c7d9b799772b2cebdfb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "602b840c-5d94-426e-b311-3b90801166ed",
|
|
|
|
|
"value": "7328069d7164d73b6c2872e2b88eb1f18023c6970d9b2f2e1f6c288e027de32b1990862e14f216957de41c4f427f7fbcec9dd5f98ca7162c3a3973a2ef6b623c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "803e6dcb-4cc0-4ceb-89b3-2e1d843a304b",
|
|
|
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+K2iLT6:EXwWEgMF84MFTnfniLT6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"uuid": "75289f6c-02f1-4bc1-bdcb-c2f34d6f534a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "52a698ef-51a4-4a86-8fa3-00a716d617d4",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "faeaae8a-97cc-44d0-a3f0-eb3c2dac3db8",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c036e659-95c9-4d9e-8d74-6e71c53694e2",
|
|
|
|
|
"value": "11680"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "9ed5ba20-ec65-488f-aa1c-d09e094e911c",
|
|
|
|
|
"value": "3.9799401998576"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "c5b464cc-c8b2-4e74-995b-e3d5783bbcfe",
|
|
|
|
|
"value": "6afd5818f1fabf222e823571d8a6d922"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "2151b969-df9c-441e-a0e9-c00b7638a11f",
|
|
|
|
|
"value": "c152bbd2c76335dd125466923ca43e15cdca792e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "a099eac4-e434-495f-bfe5-d800d9899cb8",
|
|
|
|
|
"value": "0c55d734ad1913d90b9888e02e0f178ccee3b7f53e3414f887ba84ecd893f08b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f0ecca29-3ce8-4f43-a5dc-bd7379dd83e7",
|
|
|
|
|
"value": "f9f28add8127548ba8a8f1c79934770acaebee0b3b5ac4bf585646cc4903f24dda569f01188a3d14c422ed89fdc811f2bb4643116d915228dc571f0147cfbd05"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "85a38e62-c0cd-42bc-b8af-673666711af9",
|
|
|
|
|
"value": "192:h4EDzTdYbjoCVdfcdMrY/BB/R2fAN8GtcR4gR8KIKcxPKNVc0CLZqPimleYJvT:h4ED1Ejndfcp/HZyg83RLMPy7RC9B/Yx"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656323",
|
|
|
|
|
"uuid": "6483f9f2-8ef6-455a-adb4-ee92998a2d8d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d1a00aa8-80ba-4b5d-a884-1eeb2f6b8b08",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fcc3fc3c-b90b-4f16-9721-ca6162a14d62",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "cae9933d-5bde-4256-b858-61349e3e6ade",
|
|
|
|
|
"value": "8909"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "eb0c1ac3-93f2-4033-b4b8-cc0d613e0b1a",
|
|
|
|
|
"value": "4.5796209525534"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "c3d12b2e-b200-4dc8-9a18-4440b61b02d0",
|
|
|
|
|
"value": "ff7d890651974fbd5cf32ce52f799864"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "350f4086-58f4-40c6-a51f-11ba13aec618",
|
|
|
|
|
"value": "f8524bb31f4b4c2ced2b7871a5669a10064129f6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "531bbaaa-bf20-497d-a046-b74199489f7e",
|
|
|
|
|
"value": "d1736559f7d0670362948b07f333f5921535dec89ced5423c3c99d8a08585b8e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "1fc1284c-3736-4f0b-ae24-f5b971a71397",
|
|
|
|
|
"value": "868ab4aa314e91fd9c1742772d58e0842e1203ba4178cf624f23a3612e0b2611779fc385a617392d45db37043d350d5926942c34815a4ab0fde7210054ba9255"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "cc803cd0-6a5e-4d57-a03b-cf008e5acd5d",
|
|
|
|
|
"value": "192:03Bc7L6AfXpbaX0cDI2nYPxWmX8cx5s4vsMVfAQNCexCtSglf4oe/HhDZqLCaIfJ:03Bc7L6gpbaFDI2YPwmX8cx5HvtVYQUc"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656326",
|
|
|
|
|
"uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "1d2a78b2-cca6-497e-8d34-e4aaf48058ab",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2345-40f4-40d1-8925-44ff950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "3736e5f2-fbf4-4c27-9a64-1329ce50e0ff",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2345-ce24-4f2c-b3ac-4d4a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "053151e3-420b-4c23-a820-a05687c79638",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2345-4e9c-4e96-810d-4d00950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "42057437-daf0-47d5-8ef9-1265ca9c3bf8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2345-f730-40ec-829e-470f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "55e74daf-857f-4346-9f69-051c3955ecf3",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2345-116c-47c2-9e19-47e7950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "db355308-9731-45bc-bf64-a51def874d82",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2345-0d9c-447a-87b3-467c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "51a41008-1ed4-4a5a-b4aa-d61c285491d5",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2345-4fec-45c9-9c9f-49dd950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "b2e6ff07-699a-4a1f-aca7-3a21fc9300ef",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2345-d214-439c-ba77-482e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "7ebf77db-51f9-4ccb-8d44-0900b626feb1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2346-243c-4f35-a58a-4bbc950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "31451acb-ef2b-4981-a413-52be999c4c77",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2346-47fc-4ac7-aaab-4fdd950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "843e2684-e148-4805-8002-5680f152c755",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2346-22e0-40b3-98cb-40db950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "32380cda-a18c-42b5-9842-d32ed0ac8899",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2346-76e4-4bb0-9700-4ea6950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "b79752d2-5f10-435d-aad3-88d65099277c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2346-9820-4c80-a0dc-4fd2950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "75289f6c-02f1-4bc1-bdcb-c2f34d6f534a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2346-aa30-4b48-bdad-4d2a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
|
|
|
|
"referenced_uuid": "6483f9f2-8ef6-455a-adb4-ee92998a2d8d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2346-f0c0-42ea-a10d-4170950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ff4c2b4f-efc1-4f0e-bf7d-74f5f066ce5f",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bd8b9cdc-d551-4435-ab33-e4ddb7b8fe46",
|
|
|
|
|
"value": "2147483972"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b8beb835-545a-4267-957e-d2cf27a569d4",
|
|
|
|
|
"value": "ARCH_68K"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "05beafdb-424f-405a-a0c0-f54db93eb4df",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "5610a753-d171-4929-b379-773a28ee862b",
|
|
|
|
|
"value": "15"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550656326",
|
|
|
|
|
"uuid": "6a28fa02-9b7a-4619-ac64-780383067644",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "6a28fa02-9b7a-4619-ac64-780383067644",
|
|
|
|
|
"referenced_uuid": "2510904a-8b31-4775-b820-c2118673d768",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2346-8900-4b51-9c2c-4c99950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "688866e8-b5a5-4a5f-85d8-2220a69d632c",
|
|
|
|
|
"value": "DEMON.m68k"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "68e1d58b-bb8a-49fa-83f3-0f1f8fcbdd18",
|
|
|
|
|
"value": "95137"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d66ef09d-bda0-4c6e-900e-63bfeb755fe2",
|
|
|
|
|
"value": "5.9836813448116"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4e7fc954-3280-45cc-9dae-31cd425e6924",
|
|
|
|
|
"value": "48f3a536cbd7f835451bd2617c2aa80e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "80f8e661-fb39-46b1-8466-9805d238326b",
|
|
|
|
|
"value": "626e8c23d36212f1c6d353929e087c4a69ff9839"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "2dc79bcb-ad2c-42c4-a40b-0bbc80839302",
|
|
|
|
|
"value": "40aada8be181329f7a46854276889c41db3f5bafbf8e9febc458d43a6c164225"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656324",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "6fd04b68-75a3-4980-8a66-2697e5617bf0",
|
|
|
|
|
"value": "9025a93c5b73dbf63b5cd212836289b1b208da3927a1b6354979ef4e103e204c629f631cd1394cd1b7171a035b012a32bdd7ec45d3395f3cb5bd0d7f36b2a909"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656325",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "d0f19529-0402-4dbd-957c-e2942223bb98",
|
|
|
|
|
"value": "ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656325",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "96d0dbac-0a6c-461a-a3bd-f9bdb8e8fec4",
|
|
|
|
|
"value": "1536:CuKREOV7Djjd8FHvlpaq1706Tbv5lrOXdyChYruykC412Xlmn3FVYQPui/a1S:7KVDjjwveqhb/6dywYruypm3FVYQWi/j"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"uuid": "12e6d593-a557-4c6f-afde-5691fa98d03c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e56123f3-0aa8-4cb2-b632-b1b8ce0fa38c",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "b9f68e8d-97e1-40ed-9a51-ba0087a80739",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"uuid": "626c678f-ed94-41f2-8bdb-5c22a0416ce8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3092d6f2-234c-4abe-ae78-f29e9ea30dfd",
|
|
|
|
|
"value": ".reginfo"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4ff6466d-754c-4046-96e1-be15fd240cbf",
|
|
|
|
|
"value": "MIPS_REGINFO"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "863c4c39-85f6-4f09-ac9c-138be28c044c",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "042bb414-a3b7-4201-a358-86050dc778fe",
|
|
|
|
|
"value": "24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "5694a074-3020-4fc2-8648-2f7b28bfac68",
|
|
|
|
|
"value": "0.98335575498169"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "73a3af83-0542-4cea-a4c6-ce1463cc26b1",
|
|
|
|
|
"value": "8d0dbc5cc209bcd3394e883eab88fb9d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1510d779-c598-4b9b-ad74-9c4ff1512ea6",
|
|
|
|
|
"value": "cb075809ab484a86da7a05eb6cb8ee73691dab9a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ed5f65a8-e535-4009-9dd4-09d1921fd99a",
|
|
|
|
|
"value": "d655eb7c6161df197741ef604391f67481156a0d8d97d5a336e36f5569ecf2de"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "3ec4752e-1625-4da6-bf8c-0d4d7451c8a2",
|
|
|
|
|
"value": "e04a2a01ab91703af95773e35cf0d74e07fd79ca8d95917649882a99f9b6007a8ffea94c105d53cce94999a1e31a087a54e63014d2078001838518661e445563"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "59006a8d-208b-4e1c-ae46-cde99364437b",
|
|
|
|
|
"value": "3:H0F:UF"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"uuid": "68122fa4-5fef-452f-b5c7-65856255d959",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3d4d9229-f853-47c1-8a85-5ffa3b5fc4e1",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "33814b10-4b3e-4ebf-bf2e-8dc93b6cdafb",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "53adbf2d-5a20-4a1c-b3d3-72e20ecd861c",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "91dfc356-4608-4bec-be1d-0dda372eabf8",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e9f5728c-7b18-4c56-a2da-e7e852b38306",
|
|
|
|
|
"value": "140"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b8f7a151-9990-4fcd-adf2-e5817925370a",
|
|
|
|
|
"value": "4.0273977714589"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "28232ec3-1042-4e3c-a63d-fe769cf43b38",
|
|
|
|
|
"value": "77d4238a19b265b210efa24d402eed6d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "fc8c4aeb-ab06-40a4-979d-2f7d8837decc",
|
|
|
|
|
"value": "35cc8fa3c819c54ace716b64ee0de3dba2b1fd5c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "40011551-2763-4d4e-83a6-de46e7354f8c",
|
|
|
|
|
"value": "5b51e8a42c9db45c5fcdcdbc413a51e35361e49912a697a23a0ad1bd5832356a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656351",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "fdc8ddab-45a3-49df-a08d-9c53669cbde8",
|
|
|
|
|
"value": "59ca155f7f7190db3f9149f1cd481632424796d681883a94569ac7c25a27b3f114662a5b2d6a9391b5b22b6432b7bac3917dc7fdb907d5bd1c9e5e71a7c7bae1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "c81e6443-7a80-4859-a4fe-e953e988ea8f",
|
|
|
|
|
"value": "3:rxvC8niGdVz0ftC+DyvlT0GdrFEF7/knM6vlY2lUF3C4:rXld50o+OvyGdREFzcM6v62lUF3C4"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"uuid": "98dcda44-bc1c-49d1-be0b-0b84a84cf09d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f6c90cc7-b493-4a6b-bb37-08e059466a99",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "377b9c11-7d90-445c-8288-cd9e7402dcb8",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "abde6e30-d1ac-41f2-8b9f-9eddcccacccd",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "00b6dcd6-a362-4084-a038-0fea1d54ddcd",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c2c532bd-229c-4b40-92fc-4138aa7d8a41",
|
|
|
|
|
"value": "76560"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d5e99be2-45ef-4b61-bf9e-4d319b04f491",
|
|
|
|
|
"value": "4.9479106240765"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4388d4da-29d7-4e3f-b4ee-f3ce689cbe3a",
|
|
|
|
|
"value": "b80eaf5697f668ad090291a6e4818764"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "65a3967d-2571-45da-87ce-5d47bb611c71",
|
|
|
|
|
"value": "6ea230750fe8164634f4251d6a201dbdc06f154d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "75da06f1-2013-4865-b087-e2db1f7eb24d",
|
|
|
|
|
"value": "44979aee8f152d8f86b21711a6df357dde3b56d73373780f7be585a35b632392"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "b4d9203c-a03e-4468-add0-1404f3bcb39a",
|
|
|
|
|
"value": "6a2055e1ca09e78a903e409a6a871d17ceec9aba73792f4b7d4e4dd8da7d29d687ac34e999e9be3db3df8e5f5c058ecb17d7ac73a01195fbc2300fc1c1e60236"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6551135b-c74e-4d81-b916-edd6b28a8e68",
|
|
|
|
|
"value": "1536:sVVNS7KmprxYSkKR2vNRhRdBCxBlUOw2rKwCgbsoq0elFaw:R8F9ulbpqjaw"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"uuid": "8e4b1b09-47c6-497f-9e3f-f3944b9072dc",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "238658f0-d7e2-4efe-a56f-3a2b3e2742f5",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f5f34758-70a3-4772-92ef-6bc9814cd438",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4480f9ab-4e5b-48f2-b6fe-b3760b89b1d7",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3a0ea3dd-2ef8-4183-9c5f-38e9a58b6b14",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "3df47b1e-f1f1-453b-995d-1008848e0bd8",
|
|
|
|
|
"value": "92"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b5920a4e-5a5b-4a51-a81b-70d1af8fc4a3",
|
|
|
|
|
"value": "4.1123020826728"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "fe9e9c96-7c8f-4c1a-9efe-c271f84741cc",
|
|
|
|
|
"value": "5985b8027c0c6f4384e40f145c7bcf5a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "39984c7a-3b34-42aa-9766-0596ecc38884",
|
|
|
|
|
"value": "857f410ff3a78dffe74e36702d0205b84fa7598e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0f558e5f-a153-45f2-b854-e2d7527299c8",
|
|
|
|
|
"value": "3c1d7e8668ac46b94dc1577da106925841c242ca16109aa439bab5024b92be8c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c13d1bb8-c99e-416e-8a73-d018baffdb0e",
|
|
|
|
|
"value": "92903cd5cefcd21445ce2aae2dd8cfe7ce0f1d61de2603154589d7df75d7c4abbfe6aa425308c9de0f5ea15aebdab6bbc9f9c6e9c4a1b0a6b9eda49b4bea8003"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "dc0e7ef0-ca10-4b94-a3bd-c649cebb9e60",
|
|
|
|
|
"value": "3:uMOC8niG36WlftC2M6vlY2lUF3C4:uMglTlo2M6v62lUF3C4"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656352",
|
|
|
|
|
"uuid": "c5228190-32c1-414a-9cf4-679d7b6c5278",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f8cc8075-bc5a-4cd3-9df5-2fdb30e872f9",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7aded904-e2fd-40d0-b6ca-99df721d21af",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b787ef95-98d9-4778-9c1b-cbd73c743032",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a606fb43-c1ac-4219-9360-4431f86a5608",
|
|
|
|
|
"value": "8080"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "90b4948b-8443-4696-a593-ba2c52dc32af",
|
|
|
|
|
"value": "5.3032736629034"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0b55b922-e241-4ed6-9c49-5a96317b26af",
|
|
|
|
|
"value": "92d1b4c42886e41c8426c4129af782d8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "663d6518-fa01-42f2-8ac1-9f84057cec5e",
|
|
|
|
|
"value": "0b78a20514d86471719809ec790931a9d1711c32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "17effb70-9d87-47c2-b3f1-57eccebad3fa",
|
|
|
|
|
"value": "16bba26a4892a37456a3e490cea77501eb6b9fd9667572c78dcb02f344cda665"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "7b3eeaf3-06c2-4c4f-baa7-2aeffda5159a",
|
|
|
|
|
"value": "0c49f44420cbf3d667656b274d0e400b02b6fa8f002ae08e0ad3bf0227073779f85cf80c29baa63eafe129b426ac3b0f526d85c02909b8b34342aa149df6e8e9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ab0f2bf9-1556-4d5d-8a94-c50080ea88b1",
|
|
|
|
|
"value": "96:uuLxgZHHRhK+kaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fpe1pnCyNZn:uPHrKXaEnlRum67bqlOVyQSWB32PP"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637845",
|
|
|
|
|
"uuid": "708f5d2f-37cb-490b-8273-aa0d60d45e30",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "639473eb-6915-4a6e-acb0-e666fcf6e800",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "24b108f5-bac5-44a6-b147-4d3a93d8ce84",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "441014f9-92ed-432d-a8c1-b0cc05eeb2e1",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a56ada1a-55cf-4829-8cc5-b7109ec41396",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "29313669-13ae-419d-a590-f11e78ee1469",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637835",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "237427ef-f24c-4b9f-8e8a-a967c94f754e",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637837",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3281f3ab-154f-4e0f-a0f1-2c7be83d42aa",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637840",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c3f5ea58-f79d-44a2-9c3e-266b51976ae2",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637843",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "b1386c4f-afb8-4fdd-a180-e989d1dc34dc",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637845",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "f103f342-5723-4f3f-8f06-e056aeab13b8",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656353",
|
|
|
|
|
"uuid": "17269a28-42b6-4d6f-94e8-f1c16976b19b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8a59c909-ad9a-4fae-b3e4-98123735e5a9",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "25ad33bf-d077-485e-a900-981ecef281eb",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a2fac2d6-6f73-442b-abb2-c40373ec7bde",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2157bb87-05c4-4526-8b2f-0c20ba6664ee",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "661f8100-345c-4011-9ee2-f9fe7d151fd0",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "84772b32-6b29-4772-8608-62bacf870137",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "22d50586-af5e-4173-acc1-616f537e49e2",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "7f4e98d8-5d37-404c-8de2-5c1fce0272dc",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ca8a5927-49ba-4c31-bd3f-9e0309ed6d2f",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "b0ed3831-926f-408b-9c2c-b81357a70931",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "f8a26364-351f-4d25-866d-ff8660241b23",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"uuid": "c28ef437-adb6-40bd-a96b-c3decc193b3e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8ca462a5-7b1c-43b4-bb46-1935e5b37eda",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "685f763d-9191-4191-b0fb-4083ca7ea39f",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "32d759f7-9ba0-4db6-aed4-e969eb37ff98",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cde2bfad-17b7-447c-9793-ca38657a67b7",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "69905603-02dd-4034-ae0e-a87e0d61cb5f",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "a27bbbef-95b4-43d4-8448-91f0a87951d0",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4fd7eea9-a502-4bb0-8d55-e9e784bde6df",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "aef4dc65-b08e-4739-8a41-6a65c8bb0f0a",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "441e9682-3d60-4a85-9547-1f6ebd12db1f",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656354",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f2ab3041-887d-417e-945c-1402b960c5b5",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "b0bfbe0a-a2ad-4141-8538-d653102a861f",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637831",
|
|
|
|
|
"uuid": "11a4d35a-907d-4351-abcd-dfcd4c4d0aa8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8bbdeed5-74a1-4c52-bb74-45c5802a3b60",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "02ec3d74-da4c-49d4-8b69-f744f5763743",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9aa1ba7b-c8df-4e8c-bce2-9dee267828b8",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cd92463c-f7ce-4514-a63b-538a57f0f9ea",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "09421dce-e127-48ca-8dde-0538d9475222",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b39b45d0-737d-4d1d-b29e-341ee7764ed7",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637820",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "fc9d3647-5683-4d17-9382-e39a3d0ef715",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637823",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f57a5dff-75ad-4cb5-a24e-00185d514006",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637825",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e94c7516-47c6-4ed6-afc5-7ba13b0b304f",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637828",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "940cc9d8-7a58-444e-9992-db5b5d35319a",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637831",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "8808f57a-5543-4852-89ec-11948da005dc",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"uuid": "c3c71253-50ac-4d14-9d85-8f08cba16df3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2755e795-459d-482f-9d61-5bf48b37bf61",
|
|
|
|
|
"value": ".data.rel.ro"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d3edad3b-12ef-4758-98e8-53d16f199a56",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f1dab8ed-bd36-4117-bb03-79078dcaf085",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f3143442-f43b-402f-86bc-d8667a41e5ba",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "fc135407-5191-4870-b61f-6a469399a38d",
|
|
|
|
|
"value": "32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "e4771798-2ab3-4943-85a9-04619cde6499",
|
|
|
|
|
"value": "3.125"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "3368fce8-2afa-496c-ad9f-720aaf41959c",
|
|
|
|
|
"value": "f3976df7ad2b2a30d1d8be891961adc1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "a7644dcb-8b40-4bf8-b3cf-774067f317e6",
|
|
|
|
|
"value": "5195afae0ffb549668051675e120a6a19b917ff6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8ad90df5-8ec7-4a9d-9816-a2045a62fb75",
|
|
|
|
|
"value": "07d121ccdf7ccae17a31ea11ffe8a3341e47a7a61e2e53b9e286984f856799e1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "1f1d8721-5e44-4d1a-a9de-888f7265b5c6",
|
|
|
|
|
"value": "8b2b23268ea11293b52d79b639c490db1dae5405a198c1abaebe9eb019af60fe02f0f351f63023a45b2b64ae4cd1678726e04bb0d93646c1079398b77916b656"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "4a5a1623-1745-4805-8cec-78edc0728ca5",
|
|
|
|
|
"value": "3:rdYwl+GkWffJ:JzkWffJ"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656355",
|
|
|
|
|
"uuid": "db63748e-1bda-4748-bdd0-64159e4eb3a6",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a69642d8-efa2-42c9-895d-72ef5d1d7dbb",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9a83239e-6605-47dc-8d1b-fdc60ea5cd81",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4faa9d73-93f1-4763-8240-f86579ee1357",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ad2b9c45-a4c8-46b7-a4cc-deda85248013",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "304c55cf-4800-4047-a9ff-1d326634929f",
|
|
|
|
|
"value": "1072"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "97f59552-ab03-41e7-bedc-b47c2c9a5088",
|
|
|
|
|
"value": "2.3076413930576"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "9c153736-fdb6-42eb-b31d-359f09d8c3ac",
|
|
|
|
|
"value": "0ef08d65fb5be2b36476b7827c702cb3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "15370b1f-30ab-44d8-ab01-5c1d36bf2139",
|
|
|
|
|
"value": "3fd78c48643636535014ec1c7ed2814ac24c5099"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0e3d2e66-d75f-42a5-8582-1abe6239ec16",
|
|
|
|
|
"value": "4d9a24acb8b19ae5b9898fe62b379d7e7fec099e430356f9f3b8a4b59f91b034"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "36bc28dd-be21-464f-b4ac-e66a554cf092",
|
|
|
|
|
"value": "15cb1f55850d363b1648b66a2d43013910206fa288a585e74d07966762ef2c7b31f28fccdc6a71c5450885c6a7ab580965f82c67a9ce9ca62dd4ac088c06ccb4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "31923083-d5be-48c6-9e11-bcc8ed4f99f9",
|
|
|
|
|
"value": "12:81ALMfERFetJJodD554yKHkPYxpGS6lLSRfCIkMk:86MeFetJJCD55d/JLSRfx"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"uuid": "3ee50d25-47b5-4e5a-bfe1-e6376f8e7e83",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f16e17b6-4ed9-4161-9bb4-3596ab2653ad",
|
|
|
|
|
"value": ".got"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4d25a431-6031-4758-9631-0b3bf570359b",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1e55cd37-e1ef-4c75-b213-26a033dc10ed",
|
|
|
|
|
"value": "HEX_GPREL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "592ea206-6761-4c72-b4be-a87965fa11b0",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "35df7b06-e837-49e1-a228-0baf18a117a2",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "76a4978b-a27e-4118-a285-feb96addca3b",
|
|
|
|
|
"value": "MASKPROC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f7b587b5-605c-44e4-a20f-946717c0e8fd",
|
|
|
|
|
"value": "1192"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "f5dae0ba-9f3b-417d-94d7-8dd601016c72",
|
|
|
|
|
"value": "4.7004378302978"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "c6f6493e-ad79-4f15-ad7c-466294138898",
|
|
|
|
|
"value": "fd8e494e642b43ba998d4c2dcb3a3149"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "47587248-bc81-43ee-85f9-154ab45f095f",
|
|
|
|
|
"value": "76b374aff8381d9cce49c396531182424ad8d460"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5e41a53a-98b7-445a-930f-72170356519d",
|
|
|
|
|
"value": "1fe1e8124d44a22a1f9170b8076f7b75c2321bb7e7436635e2eabc4f52017d04"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "699b646a-bf42-40ac-91dd-598cb5707f6f",
|
|
|
|
|
"value": "7a1a5d734000ba130106a7c030126b93e86afdeb7e8798e30070c028f74e33a69a0843069ed91d4c868412de504d5cafc733607d7b920aaf6aa3e054c9d49312"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "66e4a177-b3cf-4ab0-8a4b-a6fb3a1db805",
|
|
|
|
|
"value": "24:pZ2pMBvEMxS+t2NTEoYy+c5untKNXsyrSdZ90bZ7:KMZEM3yT2A5qtKN8yOdP0bZ7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"uuid": "a9c5f0eb-2b88-4b62-b69a-6de7f6682586",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7a0c4e3d-96bd-4809-8618-fb90ec86e0a1",
|
|
|
|
|
"value": ".sbss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a0882bdd-3c53-42aa-8de1-2b51a3f0ab7c",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656356",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2b4e2b67-30ea-461f-96db-f949e1ebd4d4",
|
|
|
|
|
"value": "HEX_GPREL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "be1ea1a5-4c58-47b9-80df-e8c9844f9a57",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8315cf3c-87ba-4e05-84a1-31903f766f09",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0adfe3c4-82ac-493f-829d-429f4f9551ac",
|
|
|
|
|
"value": "MASKPROC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c9275dfc-308f-4b4b-8777-2c41dd3f1c57",
|
|
|
|
|
"value": "28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "2626bf53-600d-4ee6-b698-93095fb95e13",
|
|
|
|
|
"value": "3.4677201004745"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "3c303ddf-5064-499d-b20d-3b9ac896e16c",
|
|
|
|
|
"value": "c7e412f1d671fd40692fc38e8bed5165"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1f607953-5405-4a5b-b48f-d141ede3c65b",
|
|
|
|
|
"value": "61e230d579d72bfd5051cb4b9148b3dcddecdada"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "54f6242f-3330-4f08-ba00-a9a8a8f7bbfb",
|
|
|
|
|
"value": "a8ed9a374ae1bd36c560d480a67cb987589b123e94f0c36f9da2317b9aadab9e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "63746c33-20a8-4479-ad04-c6802ca16866",
|
|
|
|
|
"value": "0b7dbc7d5e0f76a28c8ef1e0098a40c29c80a2e52dbb8880f758e3fa8e07db17c07377816f61e4a826ba50b1ea9835c2d93d6126a37c037d14064d24cb258e2a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "200eb2cc-59a7-4876-8d84-ddfc58084205",
|
|
|
|
|
"value": "3:yfY5FJroYw:BFi"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"uuid": "96b539e3-df21-4c39-b770-a222dbb1e1a4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "66da7c2a-200b-478a-b1c1-2ef6b7958129",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3eb07d20-94f8-48c3-881a-56b151d12edb",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1ebfd882-cec3-48cd-aea3-67c2e33ae257",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d093073b-173d-4bb6-8895-483884391df9",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "7c3b22d9-2259-47e0-80d7-2a2fe40a5410",
|
|
|
|
|
"value": "25492"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "5200d670-11c5-4e42-98ea-f3efb2f433a0",
|
|
|
|
|
"value": "4.3428583477087"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "bd9564f5-8a50-441b-b26f-1c6414a28d0a",
|
|
|
|
|
"value": "e131d799a97f26fe6cddc1caa0866212"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "08a5da11-4c66-4841-bed7-6d3dba9b677b",
|
|
|
|
|
"value": "6a998fb15de45fef91f61cd7023e19689f8f273b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0a3f825b-078e-48ff-895c-6d1116e915fa",
|
|
|
|
|
"value": "5a819d191a6455e4dd116fef837c0133c49a2a295ca94f1d2047c6d310a88f92"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c2ce1e49-dee5-4948-8fb7-9ea31af70d5b",
|
|
|
|
|
"value": "64ddf490be79f45dfd4691ef1919c0a64eb9cc38ae592ee85716bc72cd411ef1d6dc106cc8872daf334097bf405acafaa1f86049cb8cdcfed39ec6583c8aef8d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "93026993-01b6-4701-b284-2ef9eded03f0",
|
|
|
|
|
"value": "384:pZK7yQFIpG0jwDG4dhA3ZAIZyAMSDDISa:pIteZ4dS0SK"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"uuid": "551ba26a-581a-4c53-b192-ec14f254250f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3aee350a-6c37-4d0b-90a1-53ad006d60f0",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f9f53c4d-28eb-4746-8a9e-627daa6a0237",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "940a5454-ab74-426f-8861-ccb72b88e0b0",
|
|
|
|
|
"value": "2934"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "21bc8d21-2f78-4ab8-b652-91cd6bf389b5",
|
|
|
|
|
"value": "3.6236162569046"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656357",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "026d6242-1b99-45d6-9d8f-2a0a2d79879c",
|
|
|
|
|
"value": "b9413e51dbe36380bd17e86d8c95597f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "52c4aebd-3556-4ffb-9916-2df8b1cc74d3",
|
|
|
|
|
"value": "61fb02dfdb2e71306a38d48ae2a65648ff3454a2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f56705cb-749f-43f4-b26f-a352c9a1c0b5",
|
|
|
|
|
"value": "881478d60c29771ee32339c566a6c43d9157f99b23d031a4f1d342bd1e4254d9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "902a3a05-a58f-4680-b2e6-e7d01ecec486",
|
|
|
|
|
"value": "bacf90b46d6451e9ee5acdc82ff20957dfb62b463cb3caeb10642d1366f7c4fc13f8ec18e03356e960f710ab0691f0e90c7e08784b2d7efa6b5d7d4f913acdbb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "b426e081-4959-4ff9-a142-4ef4e4d60e0f",
|
|
|
|
|
"value": "48:BNUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUz:a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"uuid": "e9c37e32-2ab7-4409-ae3d-23b6911f98a5",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a32708dc-e5b9-431c-9ee5-ec41092d9470",
|
|
|
|
|
"value": ".mdebug.abi32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "432f9fa3-5d19-4617-ac72-dfd854a49f52",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f99e6f64-de1e-4b9c-b25a-8274fc32ed6b",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"uuid": "491db90d-b576-4739-bfdc-15c82825d4c2",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e40d8b9d-6941-497d-88d6-89e335df46c2",
|
|
|
|
|
"value": ".pdr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0e9c8e9b-9eb5-41bf-9ef4-80edeaaf23c3",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "299725bf-ff7d-40e8-8e80-a8897f839909",
|
|
|
|
|
"value": "7392"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "aa87a06f-e664-46cb-92b8-53563c677cbf",
|
|
|
|
|
"value": "2.3625590532624"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b1cdca0b-d202-47e1-8832-08926118bc1a",
|
|
|
|
|
"value": "b84e4223b0d5f6b39d52bc80a7c3bea4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "b52fb306-db57-4b89-831e-0622b10bb4cd",
|
|
|
|
|
"value": "a18f0049e72723b7ae5b251426a48a7022f07bff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "61d372ba-7018-4b69-8d6c-946ff9919900",
|
|
|
|
|
"value": "9bd03ad1339f25832d304c8955b236c3b3e50332efc01a9a709580d897a6f692"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a8e6f994-f550-4255-b4a2-930657fd87ce",
|
|
|
|
|
"value": "bba84495ae6bb5bd92f35406f2d466377816efd7f7f88fbc23a902527cb7c587590a681e2c32fec2e7bfdaedac8b4542a5e167d3cd0fc12a72dbdcff58395f4d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "f0f9bcb4-be41-4964-935e-e8b8d0853155",
|
|
|
|
|
"value": "24:hLWlER8lMDMziKrUEkE1pfc/5KcsSqIxRxwKJM0ucBxy2yl0pMIUQf8cgTTjdx6E:hL1R0MD3EkE1Fck7q+KJDy6dOjdey"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"uuid": "0432ec5c-2735-4638-aba6-74383c250015",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e626bce0-0752-4740-bf6b-3bb58044014e",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1987548f-d8b6-418c-bbc2-5e030a13e760",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "87c85c03-8d10-4c1f-859f-ce3ab0282760",
|
|
|
|
|
"value": "154"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3a8970e0-cbbe-43a9-84c2-19af32347319",
|
|
|
|
|
"value": "4.0531923876455"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "fbbcc479-08c6-4b14-b60c-c1989f2f03ad",
|
|
|
|
|
"value": "12071c1d10e788d633c06c50dad937d2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "b51bb474-05a0-417e-af5c-0a81e89b4e76",
|
|
|
|
|
"value": "4e330bc5132262c6f7700030e1d37ee1aa1867be"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656358",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "497bc0c9-3133-48fb-8b8d-8d85e32a6ad5",
|
|
|
|
|
"value": "82735c98120199d69b1893c6fa072b6611625a462fa44e37de1b1f19e47bae27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "743485d1-2a90-463b-bd8f-9e8264c544f9",
|
|
|
|
|
"value": "5b0b1e1fd30069337dfcaa8a3d256366331f6dd7631d2a819c776c9b0ce1fd61808b07ca78d0537088e90bc1b840613484ad6cbcf500f8beeff343700fa5a5d2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "70a973ec-773a-467f-95ff-1c99fb3b2502",
|
|
|
|
|
"value": "3:mqWxRuRWExqXnMOLKMDlApLQ4lLaCMLn32cxlLPAl+5Jj+LxNi2aXTTiQIuxVBXl:EXwWEgBKR84MFTnf5JjgfaXTTzICVB1"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"uuid": "eea5d69c-5686-4b44-adc9-6d4f0a46c4ea",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b2dd8732-cbdb-4ee3-b9d5-fe35398c3300",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ae578fd3-76d6-4348-ad9a-8db28c7696a9",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "8cc79dfe-d5c3-4b0b-a339-6607e0ddbe04",
|
|
|
|
|
"value": "11536"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "9289b62e-6a70-4b22-965a-d4f88cc00b01",
|
|
|
|
|
"value": "3.9517252645434"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "028d5967-2fa3-42e3-87fc-93f3b1385ca4",
|
|
|
|
|
"value": "0c697d15648cb43a606aa2c679269728"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9a6c7358-b159-4929-b87a-ea43bcbbcd94",
|
|
|
|
|
"value": "4be20b111b69a583571257e71b79a674be2090ef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "05938690-d3d9-46a6-8a6d-a2959f04624c",
|
|
|
|
|
"value": "583f8624a1fe7aeb33832a8f060d7262594fe20cdbdad9bcf68df5dde4472a47"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "14dbf715-1dd2-4beb-a7c8-784a6767393c",
|
|
|
|
|
"value": "0bf731c955982dfc7f92e6597a002e800dcb9eaccea023ccb456167ca4aa3b577c8ce2c74384b1d983c227f8298ebcd82218c76bfbc159c8832b08bf349924a2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "233435a1-9907-4b19-91f1-5cd2e58ad8fd",
|
|
|
|
|
"value": "192:aJN9Q6iUH1UuVH5hIAykTkqANuUIfOwsgRpbprKgyod9Jj5zAF5:a7yQFIpG0jwDG4dhAj"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"uuid": "85b5e80a-bbea-48d8-b54f-72e758c59ffd",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cb54f558-5cc2-44d2-972a-decdec155eac",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "01ff48b8-4723-458f-8171-5f6d75e7bf23",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "0c2a3503-8f67-4e7c-bcde-1b4106c06df8",
|
|
|
|
|
"value": "8592"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ac3ce127-6bf0-4d45-84ea-4c999da5c9c0",
|
|
|
|
|
"value": "4.6041092439817"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "dd4a17a8-8f66-4a03-b41f-2d3381029692",
|
|
|
|
|
"value": "34e109be0d34766858ddf711553e189b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "e6fcde13-c86c-4977-9e81-06a479a8df08",
|
|
|
|
|
"value": "1ab433c7198110f6f293dae9bcdf1d29f1682fd7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "b2758f16-5e95-445b-864c-9dc8c3858e3b",
|
|
|
|
|
"value": "23eda5502d9afd40b36661386fedfcb13d21093cc69636685501aa6d30d98858"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "8237abb8-dbe5-400f-8db4-d3dbb38a6ddf",
|
|
|
|
|
"value": "8026cac01a659a62ced7666ff5c542b02c8f2ae5e4165a3b67e1d3813f5e0473cb6b55ab7d5fbd996e6f9829bd2b2b6af03e4bcb344da2e24f7f9bef94c71ee2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7ac4ef97-9f9c-404d-b448-a8f4ae72c69d",
|
|
|
|
|
"value": "192:TZAIZygfXMSX0sDISCkxwmX8QlJvtt5s4YbMFfb7he+X1l5QckghDZayBrIfJ:TZAIZyAMSDDISfOmX8a9tt5HYIFz7hBa"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656362",
|
|
|
|
|
"uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "12e6d593-a557-4c6f-afde-5691fa98d03c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2368-f860-48c2-b432-4a4e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "626c678f-ed94-41f2-8bdb-5c22a0416ce8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2368-0d74-402d-95d5-4f66950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "68122fa4-5fef-452f-b5c7-65856255d959",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2368-8fd4-4683-b6ce-4199950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "98dcda44-bc1c-49d1-be0b-0b84a84cf09d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2368-4174-4d9e-baa4-477f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "8e4b1b09-47c6-497f-9e3f-f3944b9072dc",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2368-ca5c-4f8a-bfe1-4fd9950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "c5228190-32c1-414a-9cf4-679d7b6c5278",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2368-2ab8-4ce1-bf43-4c2b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "708f5d2f-37cb-490b-8273-aa0d60d45e30",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2368-bea0-4bdf-a08a-432a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "17269a28-42b6-4d6f-94e8-f1c16976b19b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2369-d940-4e17-95d7-413a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "c28ef437-adb6-40bd-a96b-c3decc193b3e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2369-dcf4-4c05-baf8-49f2950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "11a4d35a-907d-4351-abcd-dfcd4c4d0aa8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2369-9068-4a2c-b369-429e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "c3c71253-50ac-4d14-9d85-8f08cba16df3",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2369-51e4-428a-9677-46cd950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "db63748e-1bda-4748-bdd0-64159e4eb3a6",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037661",
|
|
|
|
|
"uuid": "5c6d2369-80a8-4631-9dbb-4759950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "3ee50d25-47b5-4e5a-bfe1-e6376f8e7e83",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2369-fb8c-4d87-8887-43a5950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "a9c5f0eb-2b88-4b62-b69a-6de7f6682586",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2369-7cbc-4be4-a132-4dba950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "96b539e3-df21-4c39-b770-a222dbb1e1a4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2369-4458-4c0d-9031-4461950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "551ba26a-581a-4c53-b192-ec14f254250f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2369-0910-45cf-a752-4b89950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 16 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "e9c37e32-2ab7-4409-ae3d-23b6911f98a5",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2369-1060-4637-af9d-4d52950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 17 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "491db90d-b576-4739-bfdc-15c82825d4c2",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d236a-2be4-417c-b6bf-49ce950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 18 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "0432ec5c-2735-4638-aba6-74383c250015",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d236a-b910-4e06-a37c-4ae0950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 19 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "eea5d69c-5686-4b44-adc9-6d4f0a46c4ea",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d236a-f94c-4e71-ade5-4dfb950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 20 of ELF",
|
|
|
|
|
"object_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
|
|
|
|
"referenced_uuid": "85b5e80a-bbea-48d8-b54f-72e758c59ffd",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d236a-be08-4bfc-9104-49e7950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "00c9af09-b1cb-4d29-8874-68f774a3d082",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0b3fcc00-4635-4b94-92a5-50cb84373ddf",
|
|
|
|
|
"value": "4194976"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9d3fdb1f-038e-4dbe-9d91-ac56e260b641",
|
|
|
|
|
"value": "MIPS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9ed935d6-4219-4787-b612-a03614d93376",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656359",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "c50b4d13-ac57-495a-a003-abc37ef551d3",
|
|
|
|
|
"value": "21"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550656362",
|
|
|
|
|
"uuid": "0b58e05e-34ee-4211-9c13-db3d9083b852",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "0b58e05e-34ee-4211-9c13-db3d9083b852",
|
|
|
|
|
"referenced_uuid": "109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d236a-48e4-4e16-aa5d-417b950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "e2210b27-9394-417f-8bc8-6cbfc6f7561f",
|
|
|
|
|
"value": "DEMON.mips"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c5752770-3f88-4db7-bab7-4130b1946fa3",
|
|
|
|
|
"value": "119796"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "2e01bd70-f7a7-4243-aca5-72e894fb4255",
|
|
|
|
|
"value": "5.1922888146583"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f63df6c5-a857-4b44-b520-ff691984e217",
|
|
|
|
|
"value": "3995cc79b53f95cd127bd9eaa96ea867"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "ce5daa39-aaec-40ed-b53f-141f725ce19f",
|
|
|
|
|
"value": "a54d5e32c544c29469090019b90ddd098b69b40f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "209d9082-0605-48a5-b5d4-a9d897259feb",
|
|
|
|
|
"value": "414b488aa5fd5d2c97b5479d5d9405a308c35b60c185ca16f1e23f8a00b5cdf5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d4f08fde-27e9-4dc3-922d-eaaafddc122a",
|
|
|
|
|
"value": "03ab83e210d01a303977de108caabfa7e5ccbe5d41eb787646fdb57cd9d185de96bfc82e54fdc552dead1cac203a8c2e3ccb8b327bb8d1ea37254377f9fcdbc5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "19cf91a2-159c-4ee4-b386-ef4bc97ef123",
|
|
|
|
|
"value": "ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656360",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "88347e5f-dfeb-407f-ac0c-fda09c48dc47",
|
|
|
|
|
"value": "1536:oVVNS7KmprxYSkKR2vNRhRdBCxBlUOw2rKwCgbsoq0elFagKIAx2m3tDVFz7Vw5L:98F9ulbpqjagKbx2m39VFz7Vw5cS"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656389",
|
|
|
|
|
"uuid": "461050ca-2a51-4f11-99ad-ec7a63b03ff1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656389",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "97e86bde-5826-4549-ba96-006429ebbd66",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c059e7e-e475-4add-be9b-975003cc64d4",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"uuid": "df522c29-c65b-48fb-afb0-d3a4932b1bdb",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "681b80f0-1802-45bb-bc60-c4edccf7fe83",
|
|
|
|
|
"value": ".reginfo"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d718bf9f-0e3b-423f-a389-83ac4f7541f2",
|
|
|
|
|
"value": "MIPS_REGINFO"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d1c560ed-498f-413a-bcb3-d1c6192f5a9b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "37ca0023-adc9-4bee-acae-ae65851a9f58",
|
|
|
|
|
"value": "24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "7a6b6beb-67c0-4f0b-91c0-9f95efbf52f5",
|
|
|
|
|
"value": "0.98335575498169"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4e8130bc-1e5f-4818-9a21-847cbb491c6a",
|
|
|
|
|
"value": "2c4f9f97ef8e3ca925cefe8eab60ff8b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "88262223-19b7-4c20-83d0-b62c4e8efb21",
|
|
|
|
|
"value": "323d4336bcd5a98ecbcf906b6ac64606a7e9ad7e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e14a6c0b-635f-4d15-8fc8-3499aec8f5af",
|
|
|
|
|
"value": "c03e5f5f10bfdae31ac499310ed043273dd2ed9af03aaac3f535ec497406a8c0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "14db7d37-5f0c-4b64-8c70-5d158105985a",
|
|
|
|
|
"value": "e0722964c30fa73fd1a2af55248540f7adc83c61a1f61056b5f3441382dfc44c8c0c6c1f90939146eb63fd90a6772598ad8a8101a1af6b934a26316cbcd5798f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "616ccc12-9077-41af-beaf-ef8c85e6c281",
|
|
|
|
|
"value": "3:1sn:6n"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"uuid": "45c8b70f-1502-42c0-bc02-f1d0ebc460d6",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f1670415-6e76-4ae4-8b7e-c8b8151ba815",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2d06b6b5-ca7b-4ca3-9dde-17fb68f03858",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c9def7b8-758d-4428-86b6-5241bdb38854",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0fb4b435-88b5-4d94-97c9-f015fee9db73",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "6fc7fa36-f22b-44e9-a8b4-5c77228a5d31",
|
|
|
|
|
"value": "140"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ca7d602c-9328-4428-ab29-5703b6f79acf",
|
|
|
|
|
"value": "4.0779122509381"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "477d874c-2b35-4f5e-8972-7670896f31f7",
|
|
|
|
|
"value": "9a9b3bd4fbc6cdccf71c91ac983bc155"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "05083b62-893e-469c-967e-2880d4970d2d",
|
|
|
|
|
"value": "7ff3b2aedbac15cdefa908440d3a7e87a10768d7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9a3881e4-4bfa-4b16-8b64-d1240a02de27",
|
|
|
|
|
"value": "aee98ab84f19bb8ebd855b4af645a41867078fdbaa4e3dc1e61dc5cf7da562f2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "03410093-1304-435b-9564-b9c837c324af",
|
|
|
|
|
"value": "e488656c20d28ec15fb2dc0a1e0620f41ba3f091737803ab32cc239ebfd65bd2284e18a45f17a9279f80feddebdb739a44cfd5c0ece3dd5c50d76ee500ea5b81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "0a92f587-20e7-4b48-b3bb-3521f1d24a09",
|
|
|
|
|
"value": "3:2l1TBXl0Lt7o77llZsHW/Ulbl74FdlW8/UlnlNmFBn:2lNH3n/KWcgz3chl0FB"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"uuid": "33b1ae23-3cf2-45bb-88b3-3af9b3643cb9",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5de42c57-13cf-433f-a83c-1261a3df2fa0",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "95ebfdc0-3295-4a35-8a8f-40e1651ab9c1",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656390",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0219fae7-eb41-409d-943f-556015d0ae6a",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "627e066b-5a33-4a2d-8da6-aa8cb2d3d172",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "16e0a8b5-f4f4-46cc-839b-2c5b45d5bb6c",
|
|
|
|
|
"value": "76656"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "17d5ef63-14dd-4ef6-968b-11f108e56000",
|
|
|
|
|
"value": "4.9479821951636"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "6723fa4e-5d53-4623-841d-c6ea2beb3af1",
|
|
|
|
|
"value": "55b9218e28b6cfb13db1c9aa4a1bf471"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f96aad67-e99a-46e6-8e11-4dc0aacc1524",
|
|
|
|
|
"value": "3ec5ba1e4f8e4fdf21b5b0067732be82345e19c2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6e5b16b8-0b57-487f-9336-8bc938cd22e5",
|
|
|
|
|
"value": "84dc73291fcb8fdfecf68c8d811975c79794c30453793da64a4f806b70f57ded"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "ddc2be15-84ae-4ed8-a6e3-b9cb90b8bfa9",
|
|
|
|
|
"value": "e00fc9d0221adfe3e920da1f06aec7598bc4f36b9c44712f2490362e7fdef9b2131b89d6ac000ae9627c48dcf72f201c43a1b28b09057e9bf0d3291c8d938427"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "35c68687-48bb-4f8d-8f02-a143560159d4",
|
|
|
|
|
"value": "1536:6xJfeTWfyZwcmYAatKGP4yefZ6xHNBHkxMyaDo:YSDHtlP4Ffm0Gk"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"uuid": "6675bbb5-046a-4034-adfd-d70db36993e1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3e0e1ae4-d54d-4abc-b0ab-32070bedce97",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "57d20246-ebfb-429d-9d44-8b9fc60c140a",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "12750b99-6788-4a7f-b697-15787e2ddc02",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b79bbc13-8c19-4da8-9042-20396a779f62",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e4ef4cfa-5c03-455a-a89d-1fb109d80640",
|
|
|
|
|
"value": "92"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "5450ec4f-0efa-4b42-9d22-206a4bfa3c85",
|
|
|
|
|
"value": "4.1123020826728"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f4165d4d-e2bc-4e87-9de5-ec2297e19459",
|
|
|
|
|
"value": "0fb8c6cbe52ada3c85afc7021ca20d97"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1680f707-6d08-4638-9abc-e453b4a67ce9",
|
|
|
|
|
"value": "3974940b73a3481c401ff216c7c4003b2db6298e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "4ca55fb6-12af-4e57-962b-281f727bc011",
|
|
|
|
|
"value": "a30b8fd5e2d2d888c24ce6c9ac4e341fce9c518c49106d8db9888ce4a7e5c513"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d630ac89-b281-4f6d-b683-bbb7b0ca7392",
|
|
|
|
|
"value": "3aeb5c35f12fcd7ef88f3490629f161ff93333064043656a51b0b8e831b6f832d332a3ce7f7b0c86d36a772f65f27d956607bf240ee54b1e92b33ccbfbb86927"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "64c23f44-a4e6-46f6-b3a7-6cba1747d301",
|
|
|
|
|
"value": "3:8ZEmmFTBXl0LtO5ZJFmf7ll7e/UlnlNmFBn:IEmmdH3Hjmz/ychl0FB"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"uuid": "b4262ef0-03fc-4efa-a3b2-8a44fc89a4de",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c5902fc7-c549-40e3-abc6-1bcd767a3bf6",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7f9fc926-498a-4ed3-885a-6d2ac4b8a705",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0f3dcf3b-b949-4c3f-be87-5186127aa49f",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "529c8fbb-015a-4610-96fb-ebb3b612d9ef",
|
|
|
|
|
"value": "8080"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "de4c12bf-0ffd-4563-a3bf-237b6bf59667",
|
|
|
|
|
"value": "5.3020576154413"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "56473755-af30-4816-8ee0-10179f152cf0",
|
|
|
|
|
"value": "59633d814822f4ddcd57c2b55cfdbf30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1b403a03-09ae-4029-9855-15d36f11476f",
|
|
|
|
|
"value": "03df894d6511359ab991516106524faa20af0267"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "762f6071-48ac-4e81-b7d4-870eb06f108c",
|
|
|
|
|
"value": "0f8bce553abd1e4fe60c172a624afd4b36ec0f3f86d03781d6ff439d8bbffae8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "9085ea48-25cc-4ced-8514-842b16df69c2",
|
|
|
|
|
"value": "a15c5c4b1f4c6e567b7b81b3d19f3bf89e26b3d9a7de2490672d5399269f19bd1df1fb870695827bdfcfe4050bc18c28bd5703fca8b760da2be04e7c20915030"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656391",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "9c341170-e3b6-4c0d-8d64-a3c5fe18e5f5",
|
|
|
|
|
"value": "96:r+xuLxBMHHVRs+kaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fpc7qyGMl:0tHHsXaEnlRum67bqlOVyQSWB3KP"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637816",
|
|
|
|
|
"uuid": "05b17a24-12c5-4980-a8fd-d8d54f8d2a5b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "26f519ff-d670-4951-8689-54b1a72507f0",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a7cf3201-cd65-4656-992c-abd0ae17f899",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1271c48e-1d67-45fa-846c-4fc3e5ab2cc5",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "fb8861ac-504a-4fd8-b505-564197ac440f",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "6d743d8f-e436-4816-894e-6e6281dd5089",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637806",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "59aa51de-2421-455d-b4e2-0b12ccb77bee",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637809",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "35c9488d-2668-4b65-9c1e-8039d4f37b41",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637811",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "786115de-4709-4f8b-878e-bb6308a81ced",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637813",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "30cb0490-aea4-474a-a4a2-043f3dbeec24",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637816",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "56f55fd6-928d-4aa5-9111-2a4312177d87",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"uuid": "14689a10-2a7f-48b4-948f-824efe79131a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2f34d985-77d8-4273-8e53-3efd77cdf021",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2d77f6cd-ff48-4c4c-a023-037fd0299f97",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d10bc5e8-e33d-4dc0-a2db-557a15df6dd0",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8a4a493e-0d43-4f6a-bafa-f187a8bbc4b8",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ec74b061-858a-4b32-ae48-ae31e02e8e64",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "c070fe76-0805-41e4-bd67-6985e7745fd7",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "00c92abf-60c2-4366-87ac-dec196a023a2",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "21c27ad9-a40b-46d8-a8fd-e780cc1aaaf8",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "eecdc7d1-295f-4a98-9e6b-d92d7cb92f25",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "4106fd3e-f8e5-43d7-9637-148ada663214",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e8328a0d-116d-4796-888f-032364c412ff",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"uuid": "652eae67-7686-4363-8583-b31aaed4af30",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8c66d0a3-da27-4de4-b9c1-84a89153e16a",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "917bb394-28db-40e8-b161-082ae3b618cf",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c9a1348b-175c-493c-8e86-7ca62523da1f",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1ee74328-7c5c-4501-8244-e360988f7162",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "9041b69d-4c4a-42a8-afcc-2426d23ced45",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "183d11ac-7a36-4925-b52c-6eff2c7704ff",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b5c08299-599f-4b81-b311-85805f3c8eea",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "071b81bf-d908-4bc9-9e6d-f90e5897e474",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "60222676-e8f8-4f56-8b30-b8041216eeae",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656392",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "6179eb31-c303-46de-84bc-4d2d0d2ff04d",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "b9f4d1bf-6936-4400-9b84-6a102b9d70d1",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637802",
|
|
|
|
|
"uuid": "60a5f09c-c861-4eca-9448-5e7bd592ecbe",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a316819d-268d-4c30-a61d-dfceffb281a9",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4efd6e7d-bd9a-4607-b2ca-7ff72330a85d",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2b34b558-a3a0-4bf6-9fe6-0f97f73c0678",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1aaca676-456a-4f88-91cb-69cc21116157",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "786f743b-9fe1-4e2d-b254-57fef94f104b",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4820fbfe-94b2-497b-83ed-048bab790a6d",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637793",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4fba4282-90f0-483b-bf71-8113b98fbb41",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637795",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "468777b0-eff1-49f9-a04d-05b1cae8c21f",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637798",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "4dc40f77-d3cf-453d-bf15-ed8d07f874b1",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637800",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "66d2fee6-8434-465b-ba17-dd096edbbed8",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637802",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "fc0687c5-ba17-439f-a8c4-22756e8d0e3d",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"uuid": "5d8e7117-335f-491c-8980-53cc0c20d4bd",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4e7d349a-6e1c-435c-8bf5-1ccb7c185c98",
|
|
|
|
|
"value": ".data.rel.ro"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b58d1234-084a-428a-8fb3-2f2ecb915386",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "de490408-d193-497f-ba79-02f0bc72be5f",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "032cef1b-e073-46d7-a629-c8b9d316d772",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "76e17823-6f21-4f74-b70d-eed307591a61",
|
|
|
|
|
"value": "32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "a86069a2-aea1-4384-9651-4fbd034bbcdc",
|
|
|
|
|
"value": "2.9528195311148"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b4c23386-de0f-4794-8d80-2b153140a4ff",
|
|
|
|
|
"value": "09942060d6582b717d76fdfb4f795982"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3698921a-7bf6-4ffd-8541-6dab7aba17da",
|
|
|
|
|
"value": "5b6e1e92b9b7f666d304694315c8d282340f0093"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9086e4fc-3341-4a3b-bd4a-eb931015fa93",
|
|
|
|
|
"value": "023b10be8da0ca9bf046f5b85466a8dc0788ca77a7af7d37be6131af268c47de"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "2fe579e0-d8ef-4ef1-921a-602267063550",
|
|
|
|
|
"value": "b28ec1a6ec030a682de5aab732ef12e28e409154a5a7a7ce2a70e74e3fda8f2e5e45f3032542582743c7da29f67a500be002d94327b08d89ab61fb1e7c22e486"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "fb4ce7f5-fa87-42cf-99f8-39def926bf61",
|
|
|
|
|
"value": "3:+XogcaO/WQn:oMh"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"uuid": "11bec101-ea69-448a-ae53-247c2f25a01f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6480ca18-49d8-4b2f-bbd4-9172a504961a",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a0ebb548-35e1-40a3-980b-3c3971717664",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7f057c8e-2714-4f07-9c6a-199517d124b0",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656393",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1d057486-8f2c-4823-bfff-03aa3d5a1b1b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "605eebab-24ca-4ce0-8bd9-683b77da5135",
|
|
|
|
|
"value": "1072"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "2689ff1e-42c7-46b4-8094-3ace570d9e80",
|
|
|
|
|
"value": "2.3024085194807"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "cac0a576-2b26-424b-8747-868de65d9333",
|
|
|
|
|
"value": "d9e26391868cf999a81f61128bfbbc18"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "8dc0f1c2-1090-445d-b7c2-fb6858bfbbb9",
|
|
|
|
|
"value": "821174cd08ee4e8e93c39dc2745054330ecc529e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c45e34a3-b762-41c9-b393-0e0be2fe5d9b",
|
|
|
|
|
"value": "03f8b28b510e94a7b86ec5c021b953868d1cab747c7c10b510e1c7bbbf8f7c93"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "b15ed1d7-3192-4925-9134-af11e09f902a",
|
|
|
|
|
"value": "b127e19e2e306d0a89b608c1928096b9f057b1efe4a9d62084baf1b13b1e69d567ef14a9800012eb00556ae63e73268ff4502707e36524e9216d7828f94dc123"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "83c61936-829f-4e02-8af2-7d9d11e6f0ba",
|
|
|
|
|
"value": "12:MN+s56ErpJZUh7hhZXkmySQM1ybSvOH/YBjSa0k:MNR5Y8+Lzj"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"uuid": "8d079804-d695-4435-819b-3f1a65812d66",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "42e70839-9f30-4916-90dc-816f3a945b82",
|
|
|
|
|
"value": ".got"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bf5d2ae0-fba6-4054-8dd8-f82b54425cda",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "018c0f07-17cb-4fe9-8a5f-acec8c006660",
|
|
|
|
|
"value": "HEX_GPREL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "24ce63e9-5f65-4302-a479-c393bc51ebb9",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8c3fc2a9-a734-4143-af70-5b248e3577e2",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e534c4bb-9935-4786-8d42-8d334bac6a1f",
|
|
|
|
|
"value": "MASKPROC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "47004aee-80b0-4cb6-9d77-b4b19f0b44a9",
|
|
|
|
|
"value": "1192"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d6fd7867-b9ac-44a2-855c-ebfc7754127f",
|
|
|
|
|
"value": "4.6866290623977"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "7f97cc65-adc0-4037-a48c-9be68be9a66a",
|
|
|
|
|
"value": "b0951c5d786e331d1d7f9897c279f4a5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "7ae17e90-a6b2-4482-85d9-8fc1a763b30a",
|
|
|
|
|
"value": "19a7f9b5ba7f42a5448e3dcbe2fef50691bd0222"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5e904bdc-4a40-4e77-881c-d060f664668c",
|
|
|
|
|
"value": "5399971560a867b98aa90a268233908ecd156a80cdb68db8e734b2af5a7db809"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "2b2ed636-e305-408c-b8d3-29b461857529",
|
|
|
|
|
"value": "9f41ecfba873d30f78b82385c39de8cd425d7c35d6e4d58dc3e26f5ea84dfb0b90da9024587198e80393184a46316d2c33b0cd63e6084842913d0b962ee07be8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "32162cde-8361-42f2-a784-e33d6c5934ee",
|
|
|
|
|
"value": "24:4Xzo4Tl6kyjqk8PVqKGK+yFkv/H69ONcGa8gMHT8:aoqlXOqFql1yFkX69ONcGIMHI"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"uuid": "c2730fc7-ccd3-4ce5-8fba-da72a3db38c7",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2a813783-9427-4aa2-b707-c77d4047b9d0",
|
|
|
|
|
"value": ".sbss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f1b52bdd-3b33-49af-84d1-7d5993113581",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b8c027b0-00f9-4a12-be6c-c319f0819114",
|
|
|
|
|
"value": "HEX_GPREL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656394",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fcee84ce-e0b4-44e7-b9cc-a2e21adb2f6e",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bd260e17-8b86-4922-ad77-73daaf8add52",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "db2b5886-6bfa-43ed-9ceb-052ddcd8681a",
|
|
|
|
|
"value": "MASKPROC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "699b9748-0d3c-4925-8c88-f62d1575ce42",
|
|
|
|
|
"value": "28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "35389024-b042-4c83-9040-c827b2b79c6c",
|
|
|
|
|
"value": "3.4677201004745"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b3757ed8-f95b-4ff4-9054-3c8071a75349",
|
|
|
|
|
"value": "c7e412f1d671fd40692fc38e8bed5165"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "14bdc1b4-ea7d-4b00-b1c1-67def2c677f6",
|
|
|
|
|
"value": "61e230d579d72bfd5051cb4b9148b3dcddecdada"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0c65972f-810c-4313-9c58-99afa0991038",
|
|
|
|
|
"value": "a8ed9a374ae1bd36c560d480a67cb987589b123e94f0c36f9da2317b9aadab9e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "fa0ad455-424e-4cf3-83e4-e9b62fcc3078",
|
|
|
|
|
"value": "0b7dbc7d5e0f76a28c8ef1e0098a40c29c80a2e52dbb8880f758e3fa8e07db17c07377816f61e4a826ba50b1ea9835c2d93d6126a37c037d14064d24cb258e2a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "210f86e2-8cdc-4981-a865-87d82d163205",
|
|
|
|
|
"value": "3:yfY5FJroYw:BFi"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"uuid": "f75edb72-2a39-4aac-934d-4980703c3a9d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "12bd7a20-5aa4-4e9b-a042-f9dd39420f71",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0aa719a4-12be-4831-99bd-4205740a620a",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "40b7ee22-aeca-43cf-8fdb-152bd9501391",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ff8978f3-6170-45cf-82a0-d1184515c6a4",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "aae648de-9d12-4d1f-b140-829dd65aaafc",
|
|
|
|
|
"value": "25492"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "74f89792-7221-4baa-90dd-b03236ab9356",
|
|
|
|
|
"value": "4.3356456944418"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c793c21-4edf-4c89-b19a-e2b3226f4d21",
|
|
|
|
|
"value": "2f6024fa96d8cd11b5471717175759b0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "97849e3d-4bae-4788-b4e7-6f073db8c314",
|
|
|
|
|
"value": "857ab20f0a8caf75233339a1ce6dd5df583dd9f4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "b8b245cd-b2d7-4c21-85ac-81f3a62c979c",
|
|
|
|
|
"value": "4e5321401028fb1189575d64c172399b1a08f90cc7ca1554f81bc10eda4612a0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "ba513801-060c-4497-971a-447517a3a170",
|
|
|
|
|
"value": "acff23ad76b7f804c2d949c65d6c3c208d81cee452383db933e6716f87dfaa8d25145ffbe481e6356d9a337846d2cd177745f20a56cf1cc4188b7544184cee60"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d0694c63-9200-46d6-97e1-71fda3b6581a",
|
|
|
|
|
"value": "384:txgGVOasJHvaF90WduzlS7p/QrrOKaI1CyMAnFMNaZrKLIPrRZAIZyAMSDDISa:txg5asF5sIIyhFMH8raSK"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"uuid": "bb14a9d1-e11d-4590-83d1-0165d6c59aa7",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "82875da9-c023-47e8-9f6f-17345dcc23f1",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656395",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5a42d501-f2f5-4276-8ebf-ece7acae100c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "1757e0bc-7e33-4e73-bd1c-2fd1b6467a1b",
|
|
|
|
|
"value": "2934"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b0da490b-6fb3-4a0b-9fd4-00ccc9fce063",
|
|
|
|
|
"value": "3.6236162569046"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "6f72e5a9-2a0f-4c60-9c09-82a88b2ef0af",
|
|
|
|
|
"value": "b9413e51dbe36380bd17e86d8c95597f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "4bf59ec5-3d31-4fc8-89aa-82c0497cbdc6",
|
|
|
|
|
"value": "61fb02dfdb2e71306a38d48ae2a65648ff3454a2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "964e839b-e2a6-4846-ba89-de84ad84344d",
|
|
|
|
|
"value": "881478d60c29771ee32339c566a6c43d9157f99b23d031a4f1d342bd1e4254d9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "8c73c63b-92d7-4764-86e0-e81a93fa8f7e",
|
|
|
|
|
"value": "bacf90b46d6451e9ee5acdc82ff20957dfb62b463cb3caeb10642d1366f7c4fc13f8ec18e03356e960f710ab0691f0e90c7e08784b2d7efa6b5d7d4f913acdbb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "cb6de510-5e15-40e7-9664-455b4fd90588",
|
|
|
|
|
"value": "48:BNUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUz:a"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"uuid": "4a1d8145-fb08-41ef-80d4-50120ea92a11",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "046db483-6227-4d2e-b9a5-2e9a49019568",
|
|
|
|
|
"value": ".mdebug.abi32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ffc7ec7b-979d-4bfc-ae1c-5c5c9bf420a8",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d670c0d9-1836-4632-a03e-df5e1deba644",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"uuid": "609bb5bf-21ce-4df3-ac3c-7c2a3a16fe6b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cab47cb0-cf3a-4e25-add7-399fb88b1b5a",
|
|
|
|
|
"value": ".pdr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "66bdaa0d-0318-4af7-814a-c939f2d93285",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4fbde04b-67fe-4523-a45a-af6b35c26e07",
|
|
|
|
|
"value": "7392"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "a8933021-07fc-48c4-b0ad-df7cf086c9fc",
|
|
|
|
|
"value": "2.3498995477571"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "7650d2f5-62aa-41e5-b542-d6dda1db585d",
|
|
|
|
|
"value": "fa3db47d8350d41cec2eca1e3379567b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5a998584-832f-4bb9-a14e-fe30071be377",
|
|
|
|
|
"value": "047c92caa51964e301fb442a667bf5d9fa965ef0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "31e69cc4-6b05-4dde-bfb7-2337075ce3da",
|
|
|
|
|
"value": "791c3efd39a6969054367a031bd42463adc3d70f278cd0d6b30875ae8076f71e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "3c674346-58c4-4257-a099-3b8a249f08c5",
|
|
|
|
|
"value": "7cf6679f0ac3a3510e8742c3132c7fc54129b5ad9b0c5c06ce5cc7cee92d9ff8693c4d691f4f1aad5ab73ed6c4e0aa43b569b84351aa74af42550f6313ee8739"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e73fcb70-b7e3-489f-b46b-048fa4c1f306",
|
|
|
|
|
"value": "192:RKxB8GDQiqgBgBJLkloWfYzWNZFotH6AHD:wxgGVOasJH"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656396",
|
|
|
|
|
"uuid": "96e3297f-ce4f-4c24-a681-26b10337c17f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "111801e2-d632-45ae-abf6-2114536a9a8e",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8c3bdcfd-2fb0-4e77-a18b-6103b4b8a0b6",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "54c28c94-df74-4918-b0fb-e85a31ef4851",
|
|
|
|
|
"value": "154"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "a1bf4216-ac6a-488b-8755-2dbdd46b7d81",
|
|
|
|
|
"value": "4.0531923876455"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "c1ef12ec-f097-4df4-af01-ad328e852257",
|
|
|
|
|
"value": "12071c1d10e788d633c06c50dad937d2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "b29cd056-a5d4-48ef-9da4-0f2fa268f85e",
|
|
|
|
|
"value": "4e330bc5132262c6f7700030e1d37ee1aa1867be"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d6ececb4-5b4f-4122-a20f-c13c60b169bf",
|
|
|
|
|
"value": "82735c98120199d69b1893c6fa072b6611625a462fa44e37de1b1f19e47bae27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "233741a1-2a7e-471e-ab66-d83027cb17e5",
|
|
|
|
|
"value": "5b0b1e1fd30069337dfcaa8a3d256366331f6dd7631d2a819c776c9b0ce1fd61808b07ca78d0537088e90bc1b840613484ad6cbcf500f8beeff343700fa5a5d2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ac1b326e-13e6-4082-9585-15748c5ae899",
|
|
|
|
|
"value": "3:mqWxRuRWExqXnMOLKMDlApLQ4lLaCMLn32cxlLPAl+5Jj+LxNi2aXTTiQIuxVBXl:EXwWEgBKR84MFTnf5JjgfaXTTzICVB1"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"uuid": "f7f0af2d-7551-405c-ac2b-f1f347b83d0d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "60951006-5655-4e0f-a1e4-0dfe557dbbae",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f5321b5-3f53-4432-b888-4233d79cf16e",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "057a3ae9-bae0-43a8-935b-3625fc748816",
|
|
|
|
|
"value": "11536"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "c0c85f60-5f09-4697-a43e-0d818c0e89f0",
|
|
|
|
|
"value": "3.9437004026463"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "e23b76f8-2f21-4d5f-9857-893537c5a3e1",
|
|
|
|
|
"value": "36ff0ced69d50b1b99e22bfc2cf24ec6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "fcbf8454-7c79-47af-8ca8-2266789c5cb9",
|
|
|
|
|
"value": "37290dc8ed649463d9890d5ee7f028c3d26ca6ef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "731b1628-c440-4faf-b5b3-d0a2f377c586",
|
|
|
|
|
"value": "7b1464ddaed2586f184f77ca365dc3b83ff9758e69cc78254655c5303b149335"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "4ac0be2e-058d-4447-868d-1680364b2dca",
|
|
|
|
|
"value": "246138f1ad13d8290a1b918b83e30204b5fdec238ecc79ac7b02cbe0ab6dd57d4eae227413301d1dfc134c96a08efcea9d9d829fdc431ac70846080821663cc0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "76aa32c1-d569-497d-b901-a744cc87e71b",
|
|
|
|
|
"value": "192:qF90ZkduzlYt7p/QrrOKaI1CyboAdx/vrgCMNahDrjeK2wVGwFsWtxr1:qF90WduzlS7p/QrrOKaI1CyMAnFMNaZF"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"uuid": "7dbd1012-551a-4944-9652-28e708774042",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "756b15fe-e3d2-4eed-80af-2fd46762fcb2",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2ed7aeb3-1ad3-4129-a93b-fae99c548ac0",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "b08eabe5-2b89-4e08-97b8-a001eac17b53",
|
|
|
|
|
"value": "8592"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "7071bd39-de4b-4e41-b6a2-0dc42403b23e",
|
|
|
|
|
"value": "4.6041092439817"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "99d8abf8-ff31-495a-bda1-a0de99fc34a6",
|
|
|
|
|
"value": "34e109be0d34766858ddf711553e189b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3602a827-c1b0-405b-941c-e192711e2ac6",
|
|
|
|
|
"value": "1ab433c7198110f6f293dae9bcdf1d29f1682fd7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "2b68c8a8-24a8-4d4b-b497-09796f9c1ba2",
|
|
|
|
|
"value": "23eda5502d9afd40b36661386fedfcb13d21093cc69636685501aa6d30d98858"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656397",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5a0f0af0-4354-401c-8a30-404fbb3a06c7",
|
|
|
|
|
"value": "8026cac01a659a62ced7666ff5c542b02c8f2ae5e4165a3b67e1d3813f5e0473cb6b55ab7d5fbd996e6f9829bd2b2b6af03e4bcb344da2e24f7f9bef94c71ee2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ff82ef52-b09b-468f-89c9-fff11eac33ec",
|
|
|
|
|
"value": "192:TZAIZygfXMSX0sDISCkxwmX8QlJvtt5s4YbMFfb7he+X1l5QckghDZayBrIfJ:TZAIZyAMSDDISfOmX8a9tt5HYIFz7hBa"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656400",
|
|
|
|
|
"uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "461050ca-2a51-4f11-99ad-ec7a63b03ff1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238e-4444-4085-9dcc-4aa2950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "df522c29-c65b-48fb-afb0-d3a4932b1bdb",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238e-c1f0-490c-97e7-4848950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "45c8b70f-1502-42c0-bc02-f1d0ebc460d6",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-d528-4ee1-ab04-4f0b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "33b1ae23-3cf2-45bb-88b3-3af9b3643cb9",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-c780-4835-b472-4785950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "6675bbb5-046a-4034-adfd-d70db36993e1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-4264-4ea6-ba3d-4a64950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "b4262ef0-03fc-4efa-a3b2-8a44fc89a4de",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-f8f0-462f-bf4c-41ef950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "05b17a24-12c5-4980-a8fd-d8d54f8d2a5b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-d5f8-4004-8e25-429d950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "14689a10-2a7f-48b4-948f-824efe79131a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-78bc-4ca7-8eb9-4185950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "652eae67-7686-4363-8583-b31aaed4af30",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-0c38-4dd9-a47b-4773950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "60a5f09c-c861-4eca-9448-5e7bd592ecbe",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-f8c4-4aed-a594-4410950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "5d8e7117-335f-491c-8980-53cc0c20d4bd",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-0720-4354-b8a9-4379950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "11bec101-ea69-448a-ae53-247c2f25a01f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-4814-4edf-8939-4d2d950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "8d079804-d695-4435-819b-3f1a65812d66",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-60b4-437c-a681-43f1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "c2730fc7-ccd3-4ce5-8fba-da72a3db38c7",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-64c4-47bd-8172-4db4950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "f75edb72-2a39-4aac-934d-4980703c3a9d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d238f-fe88-4dc1-9e7a-4d66950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "bb14a9d1-e11d-4590-83d1-0165d6c59aa7",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2390-a404-4892-83b6-4239950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 16 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "4a1d8145-fb08-41ef-80d4-50120ea92a11",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2390-c2b0-466b-bf12-4144950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 17 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "609bb5bf-21ce-4df3-ac3c-7c2a3a16fe6b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2390-b190-482f-9beb-4d35950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 18 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "96e3297f-ce4f-4c24-a681-26b10337c17f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2390-2c98-474b-8f06-4a64950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 19 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "f7f0af2d-7551-405c-ac2b-f1f347b83d0d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2390-e2e4-4600-9ad2-41f4950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 20 of ELF",
|
|
|
|
|
"object_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
|
|
|
|
"referenced_uuid": "7dbd1012-551a-4944-9652-28e708774042",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2390-4fec-4b5e-ba75-41f8950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "76bd84b4-8635-4410-9487-e4184a596096",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c281b64a-43da-44c9-be40-034bc9ca8ead",
|
|
|
|
|
"value": "4194976"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5b1c3a2b-340e-4f4e-b9b9-b6c4298aa5c3",
|
|
|
|
|
"value": "MIPS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1666ba94-d156-4336-bd8a-0c0a04c0df94",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "1bbf95e0-f896-47f3-9394-2dc51027f96e",
|
|
|
|
|
"value": "21"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550656400",
|
|
|
|
|
"uuid": "ec4f8e6e-5a17-4c5a-adce-434e99f66868",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "ec4f8e6e-5a17-4c5a-adce-434e99f66868",
|
|
|
|
|
"referenced_uuid": "80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d2390-d1d0-47af-b83f-4bd8950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "59773245-ab46-489b-94e9-57e4c53ce15a",
|
|
|
|
|
"value": "DEMON.mipsel"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "bef0091c-adea-45cf-957b-67c8d3b3989c",
|
|
|
|
|
"value": "119796"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "50875007-2d54-4310-ba09-6cf97df62d9f",
|
|
|
|
|
"value": "5.1927499473932"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0cdff659-9a4e-4dd7-8b93-8a0fd08f9eb7",
|
|
|
|
|
"value": "07868f062433f7a90849e365a3005195"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "b38be035-a6f8-4033-87b5-c851bae6dd5a",
|
|
|
|
|
"value": "b4e14664c9730e94d248be7696e36f88fcaf9c87"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8aff045d-2bd6-494f-a49a-dc47fe711e4d",
|
|
|
|
|
"value": "150e4bf4435c1023ee12ec488b828441b63571ded559d3afe5f3c60f7f97dae1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "67a107a5-2881-4526-88d7-656827822067",
|
|
|
|
|
"value": "90d7e17ea7e292d902dd7d2123448a6f3c0b798ee0dbc1a3c71849f522149256ba6029521b80aec6a0979c0c1c951f470886e514d85b09723cd3010b4a7e0913"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "44660f45-4fbd-4103-ba04-f0fe9ec94525",
|
|
|
|
|
"value": "ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656398",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7a9d11ce-1098-4cce-a37a-7c20e4c81f7d",
|
|
|
|
|
"value": "1536:jxJfeTWfyZwcmYAatKGP4yefZ6xHNBHkxMyaDiMxamyoM2m3tDVFz7Vw5cS:lSDHtlP4Ffm0G+uam62m39VFz7Vw5cS"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"uuid": "56573e90-319c-4ca3-ac05-7a9ac20743dd",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "df9c0726-8645-4180-b71b-a0bffdb14ea1",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f3e768d8-c105-4f8a-9117-73c2a332187a",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"uuid": "e896240e-1257-4cec-bb1f-90ca909285c4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f5e7d89f-942f-4ca4-8f9e-4486f961db55",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3ba3f2e6-ef65-493f-9881-059b1198df39",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fcd53396-05aa-4bb2-906b-cd18ed073272",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "38aa2043-acce-4cab-8e09-2c30428ec436",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c406a84b-17ae-4b5f-97c7-449d6305ed7d",
|
|
|
|
|
"value": "36"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "bbd13943-336c-4300-99e5-bbc66160aafe",
|
|
|
|
|
"value": "4.1240504332644"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f554d020-8d7d-4fc0-b81f-0bb01d5f0e6c",
|
|
|
|
|
"value": "2e1eccace3cd3a0db4874520f68bcc98"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "df32d27f-a94f-4bd8-a35c-394857ef956d",
|
|
|
|
|
"value": "124419317ba53dceabdc4d61955a5434fb388d11"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "89692c70-227b-4a58-a2f2-d9073c5c3aa2",
|
|
|
|
|
"value": "993195c25c1cde6015b0945ffa0a9059e58148cefda3bf202ac8e7e962de97cf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "928e135e-d90e-42be-9d1d-33fe1bc16524",
|
|
|
|
|
"value": "b3bdca4b19935dce9f0d1be1e7fd0d950892b4d52f7277a6868d05917944db702a9f8402bff8a0262072f501e843e9dff68412fe76d1be4f08613c69df12c9db"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "882cc5aa-2933-40b5-91a9-4e5b8e227301",
|
|
|
|
|
"value": "3:dVpkrlSlsQlFSfn:dVKxuafn"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656441",
|
|
|
|
|
"uuid": "3e5eaa70-dd1e-45c8-ad6f-35ad3b7449ce",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1b6b662c-d9d6-445c-8f3d-0ac1d81bb20d",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8aa74f68-ef97-48c8-9686-46e48724edb4",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0d832d0e-6ba4-4976-8be9-e8440fb34d43",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c6247e97-45f6-43da-ba2c-16a63b91df2c",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c8705832-d6ba-4216-9dd4-352f967f9f30",
|
|
|
|
|
"value": "56712"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "766bbdce-d02a-40e2-8ed2-49903d297752",
|
|
|
|
|
"value": "5.9430284993611"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "914f29e3-6b7b-4570-8d33-0a888015a53c",
|
|
|
|
|
"value": "4dc715b648f2929ab7efa044b138a809"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "c438efaf-ac85-4544-b4b8-745aef9776fb",
|
|
|
|
|
"value": "6851768b67741f9e70df5e8b5f273b49da6b0b91"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "a9c8e558-4ca6-4477-b68a-3f06a2d4d8aa",
|
|
|
|
|
"value": "b307c6f6430056f17af842b74172955e9fb02c75f7f199cfe0fc61b988bad7a3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f97f0e65-9961-4461-b888-8e9a0b18b31a",
|
|
|
|
|
"value": "c52c567a9c7013adf63a8ae93c6051a80aaa467ebfee660b74b61000b0b6aff60393766610806ad9764cb8cbfa079ec6461743cd77377b8175beed366f03c4a3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "dc641953-cce7-4f35-bc9f-963fe09edccd",
|
|
|
|
|
"value": "768:PUt0yB41XbzcZXVvZv8zrJSi1LbF9/OgS7cZxnZmcjzVLF6sthMiSdmdAcHOon:nzcNVvE1Lbr/dSAZxZmOx8sbHMmO2n"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"uuid": "1d17b468-ce54-48b9-a8a0-99af923ffe3c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "dc7fc3b8-1e4a-4413-9af3-3a384c54d9ca",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bc5807a7-41f8-4450-b005-c7b91438e1da",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "46828901-0f18-4a7f-b7a3-0bbf5dec1fb9",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "eabd2dbe-c75a-4942-98e5-989a3abcbf42",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "08bbd100-ed55-43f7-aff3-7b63883f1691",
|
|
|
|
|
"value": "32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d4ec07c9-dca0-4db2-90b7-a75bc6b8fa81",
|
|
|
|
|
"value": "4.1875"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "1b8fe123-07a3-44c5-90d1-8046518b1f68",
|
|
|
|
|
"value": "0d3573e94d1db3a75d8eba28e8418743"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5a6965fc-9f1d-4856-baf8-7481ceb5277c",
|
|
|
|
|
"value": "47c976c05a6aca61d6b72e5c74291dfed7302669"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d542407f-70ef-4ed8-a137-0baee11a1420",
|
|
|
|
|
"value": "925bd6375293daab50b8d49cb158be1e2bf5871aeeb7e4d6aaefce080d980a42"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "cf0eb1fd-77c8-4fca-afd8-10abf51497a6",
|
|
|
|
|
"value": "81391c8d16e7cf33e42aebbd7bad756544200d1993ac8d9fa1eb380d417b134bbbe9be2183de6b050b24755ca674dda2a8c6fbb0cb3b68586727c17bf47df254"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "239badab-c1bd-42d8-996b-840b5e5cd7cb",
|
|
|
|
|
"value": "3:dVpkBo+alFSfn:dVKCafn"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656442",
|
|
|
|
|
"uuid": "622d5d53-20d6-4c02-ab1c-ed562b45155e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a3a2fd26-e763-4697-8694-e9e572d8bff8",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5ce30d64-8073-4480-869b-25c0ae02eff2",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3aec3c02-2687-4668-a6f6-bcc509212b64",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "0522fda2-f0d8-4578-ae04-218b1d363711",
|
|
|
|
|
"value": "7832"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "f10fea8a-3872-4d2b-a4d2-4be0b129af90",
|
|
|
|
|
"value": "5.2676941229779"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "8051166e-4c8e-47ac-9936-72ca08800912",
|
|
|
|
|
"value": "e777f986670d349450db3790533f6550"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1933d707-530c-4ead-a388-9b1374ac0a93",
|
|
|
|
|
"value": "b6d273bbb6cc1cf360e02633b2948890a8b49ba9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9b484a30-42dd-4588-8d8f-4fc0c4e0a537",
|
|
|
|
|
"value": "49dc0c717af879e633e03a3bde39e6cadfac8e885f8d570cac390d8da5b04971"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "0807ac87-44da-4933-b7f9-10925df33932",
|
|
|
|
|
"value": "c7d20735a195e035374585ace95e69f4ea16c272c7d906d0e333a5a41e4251b7f49b6379dfa08ea6a6997a5568e5923b3e897a8d432a59cae553a401ea83eac0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "743c3585-1ea0-4c3d-95e5-080705182633",
|
|
|
|
|
"value": "96:9HeI4xgZHHRheaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpkB5ydZn:9HesHreaEnlRum67bqlOVyQSWB3Nf"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637787",
|
|
|
|
|
"uuid": "c3b033c9-8301-4eb9-a7c9-042bf5a2947a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "07326300-772b-43c7-9fc0-472727db3831",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3a7a3da1-2c03-431c-8a1f-ec1fef2789c4",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "61f536da-a45a-4297-8828-bc2a6baa8ffd",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ddff8b55-1ec6-4932-a6f7-6edb7b0842c6",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "9243b1f9-7f05-4d1f-99e4-c99f3db8351e",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637778",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "77432f27-a068-4e51-ba51-da7bf1915a05",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637780",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "a284458c-1150-4100-94f2-faab51d30a35",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637782",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e87f6ac3-56ee-4c16-9dbf-2af1689536e7",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637785",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "9e2976db-147d-4d2f-bbda-b1b1ac71178c",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637787",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ebaa3080-c51e-4213-9155-3b751dbc93d1",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"uuid": "2595727b-8ac2-42c0-a335-601eb9968f76",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9ae2bb96-89d2-49c1-a85b-b08b8b7a9c3f",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "14c28292-8244-4b7e-916d-844887c9f2d4",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5cb30d73-38fa-4605-8391-6e4f8cae57b5",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5605b459-5a46-494b-9a21-202d00319d9b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "de0236d5-6a26-4dfe-b5bc-8705ba4002a0",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656443",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "93711513-3805-4cbe-a76c-91554b88436b",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "02985e69-c2ba-4f0c-a4f1-9e9fc7e5736a",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "6414f005-8f1d-48b9-961c-4dc6205c6c99",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "38996803-cd2e-4f03-ad3f-c1c373531ed8",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "eb85947b-a4fd-499b-8df2-fff18eab2ec0",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "c4641792-c91a-45d3-9f9e-f82a45c3537f",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"uuid": "c805be7e-462a-4067-bdac-5a2da1a49d53",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "672fc06a-b0bc-4259-a173-bbeba8b08cdd",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8ea3388e-8e49-4617-b90c-c5c6e66c39d3",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "95511729-9fad-4d4d-9f13-abb5b48c241c",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6e1e643b-9554-457e-a107-72e0d7ef2bac",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "81e971f7-7c08-4b66-9955-980b97803f4f",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "497cc97e-de47-4f3a-80a2-c423f61ccdbc",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5041fe56-ba0a-4606-a281-c6314ba2b73c",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "d3df4b46-2bb7-4c91-9e88-0ce272ad1bfd",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "fce1c987-7e21-45ad-a1f6-505877c6edef",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a09d1778-3873-45a2-9c99-f5770162e751",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "22d7d139-223e-41dc-841a-c03e1fb0a999",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637772",
|
|
|
|
|
"uuid": "67665457-214f-4ca0-a9e2-1caa8f1a4c1e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f519e92c-201d-479e-95c6-5571a26639f9",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f6f727a5-fff1-4ecd-9ba1-7ae3adb389fe",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5a2f0433-9682-45ca-a1c7-4f44fede0156",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5a42b4ea-7cdb-43ac-ac02-953e6649664b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f453bbd5-10d0-417d-9ff4-a54d5f9a127e",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656444",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3ab2052e-fb52-4b13-89d4-8f23dd75d651",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637761",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "9ace464c-7c57-4afd-a22c-f84c1cb0a263",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637763",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "37ec6b1c-a630-40cd-bcbb-695a79ecb89a",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637766",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "3b53226c-b7ab-4398-8bff-fc3c8ed18a2a",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637769",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "620a5bcc-79e1-4fb7-a03e-697a717721b0",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637772",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d0c94521-a81e-44a3-9311-e809200ab76f",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"uuid": "4b8a75a1-68c0-498d-bec0-ac8af7b192d1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c17e971b-2829-4e52-9997-30bb8e75af3d",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1e667d6c-acd3-4646-9d63-f856382d6555",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "253ceb8d-f14a-4adb-ab9d-b2da798b17f0",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0f49b58e-3da8-4a20-af6e-5a663b4b5106",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "de7a862b-8f1b-498b-8de2-59a5723a9a43",
|
|
|
|
|
"value": "832"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "1bd96f70-9d59-4cdf-9c52-2bab43b38e96",
|
|
|
|
|
"value": "2.4410465132468"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d392ca33-157c-44fd-a71e-a63735db95b1",
|
|
|
|
|
"value": "8dcf185f399d2eb71dcc7247da9f73cf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "d9cffea8-eb4f-41fc-b812-bc52cde7ba3e",
|
|
|
|
|
"value": "07bf9f61aa36d88b7df64e39518044d0c049faa7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "89858c0d-292f-431f-b5a7-74a47d5f9a52",
|
|
|
|
|
"value": "9109b8548ced721ab13c8b52e06e00f978b9e1d6b27b94ad001ad72b375e7ef6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "bee9feb4-01e0-4eb4-9817-5291aded1def",
|
|
|
|
|
"value": "bd3fb78b127ba830880416a271bd418a39c298da9373aafae8bdce070c7e8b732f2102228141a15d80e984fdde70759aec2d3481ef15e8a15e3ba92d8cea7775"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d3c79086-d5e4-4a53-8990-3eab94e95187",
|
|
|
|
|
"value": "6:0XlkEC//Sk004yCWP1HEEoKy6SyjSRuen6PYEqknNuTQud3Ova5xz6lUc8E:01kECXWyrzy6SGqH6PYxpGS6lUc8E"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"uuid": "fdfae2ea-c125-4b8d-85fb-34052ca74b95",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5eefdaec-9d57-469d-b751-9c8954d7d30b",
|
|
|
|
|
"value": ".sdata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e55b3c68-9d03-4149-a61a-941f514e26e7",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b51e6d0c-6a37-49d4-96ff-c46da2d9a521",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "aaa569f6-ad17-4b4a-9d51-aa48db45868b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "dc921e65-5469-4081-b87a-6f64aa92656c",
|
|
|
|
|
"value": "68"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "a0670cba-4c10-4317-9b32-cd8c02c998c5",
|
|
|
|
|
"value": "3.3800181402741"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "736fe0bd-8c3e-4679-bf48-83824d08abcb",
|
|
|
|
|
"value": "9565360592f39f7fcbc1c036b903c8d9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "2ba0fad4-ec9e-4e82-a550-41e5f765cc45",
|
|
|
|
|
"value": "214f6bceb3de17ed05670dad06472cdc209e72f4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "fdcc9e24-e093-4d13-a960-99b42e86ad86",
|
|
|
|
|
"value": "8de50173729cbb4084343b7a697ef9c87e70ee01f483a6b1be9359fc9111e7ff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "efbbe0af-29a2-4b49-8da9-b46f5b6a4567",
|
|
|
|
|
"value": "61dde8799b101498c817ab9a9d3e7b9e213d9a992c57f0dfecd955a111b20cbd9193a300fdbbf94a514c519dfcb70f0702edab38667a193d7e75aa5a2ea97abc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "227fdf45-8c31-4e77-bd33-21fbd7dbfa5d",
|
|
|
|
|
"value": "3:5RR14evr151FmGV1lfdv1n:9/rZICv19"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656445",
|
|
|
|
|
"uuid": "c5ea61b2-3a24-44c1-b223-d7405de29f18",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e0780ca6-4b91-4cec-b52b-554ba2c0ba26",
|
|
|
|
|
"value": ".sbss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "91b6f36c-e17b-4a56-bd75-a63dba12302b",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "94016cb1-8e84-427a-8011-c89e636bb575",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8a29bdf3-a91f-49ce-bb24-540cb320bb9e",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "3d11831f-9442-4147-8a48-d83a0dff3ddb",
|
|
|
|
|
"value": "120"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "f9360430-faee-49d4-9f1d-83a6aca79fd4",
|
|
|
|
|
"value": "3.608382925976"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "596d8ea6-d2d8-48b3-8d18-69340017f2d3",
|
|
|
|
|
"value": "74dde6fb505f230ebc52d0b1dbf5aed1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "82eba3da-d684-45c8-b043-7d306377b970",
|
|
|
|
|
"value": "4f26671e106436a5881bfa8e19f5258bd9dc6376"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0bc4163a-13f5-47a7-ba7e-d945841482b4",
|
|
|
|
|
"value": "27e7be1f328c2e806a74fc698865c23cf92be7ba2d007d59c4fabaf3855644c5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a2737138-22a2-4cdc-8a7e-13a47a768fd4",
|
|
|
|
|
"value": "290d3a2af947b8b72d86fd2ef488e928315230d93a9db08f09c16bc00ac9a5c6175836815680592e93df5462c7f29eaf69b1cc686a09c5ee842536367e445f6b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "5ce78c3e-6195-4a12-b64c-cb6dd12df0cd",
|
|
|
|
|
"value": "3:yfY5FcoY5FcoY5FcoY5FcoY5FcoY5FcoY5Fn:BFmFmFmFmFmFmFn"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"uuid": "521c8b9c-76be-4a62-9dca-73e4c9b9c218",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c4a03422-39ca-4854-ac78-4ac716927138",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e65a79ef-3463-4407-a51e-0af98f99fd5c",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9d321669-1f31-4c96-8138-c6a58ed52c19",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cb8d4c44-e7cc-43c6-8692-40cf457cc5f9",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "fad992d0-8c8d-44c9-8858-fd26aa799789",
|
|
|
|
|
"value": "25312"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "703e6d72-3b0b-492f-80be-a67d6f82c2ef",
|
|
|
|
|
"value": "4.8941435322883"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "c5e17999-7399-4ec9-be95-fb347da5d052",
|
|
|
|
|
"value": "bfa4b01747ad7fc1f7607438534093c4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "ef51b39e-e417-42b8-85fb-48bb1fb1c735",
|
|
|
|
|
"value": "fa2158b7f875effcba47d7b3c9eb51f5dd39ff33"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d242547b-a0ec-4ed6-b103-293cf2e30b5b",
|
|
|
|
|
"value": "f3b3078fb5e41bc5db64bd8f5d5941768949c51eb740b2259cdfcaae0e36a185"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "540a82da-e259-4a67-b7cf-e01d48b4dae6",
|
|
|
|
|
"value": "16ce5d1ddba1c9ad989f06bbf4ddb087213e695bd10beb7b6ded8df1b873e45909b9d38f554ce2aa9f991834c70a89363e9f95527d7e537c6c60062c9ae9dc7d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "8d9caaca-c95d-4464-9bf7-9beaeb577c5e",
|
|
|
|
|
"value": "768:49PNVFTOg9aZSSkWmX3xJFVYQP0Cs/H69:491jOuaHRmn3FVYQP1s/a9"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"uuid": "c2b4cf8b-9b6b-4149-940b-11d0d691318d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "70450538-3164-4079-89f1-9219113780a7",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3c812164-21f3-4d3a-b378-5ad154c42290",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656446",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c14a03dd-bcd8-4e41-b9f1-a2eccfb8f470",
|
|
|
|
|
"value": "2934"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "bfb7db88-2eb1-4129-bf95-5ed96e018700",
|
|
|
|
|
"value": "3.6143694458868"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "081d1766-e165-4076-804e-79f7f297eddb",
|
|
|
|
|
"value": "3f6134f42dd3dcce96f346b89e536733"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "68c8d7fb-7fd6-42fc-9f2d-8707909d0ba2",
|
|
|
|
|
"value": "98c8c140c01dd71ac3ded4a5fb00e21d2866f6f1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ece4a824-f72a-4a10-9932-f7931728effd",
|
|
|
|
|
"value": "a06d6ebbe98d3d9cd389886557806d5a3c4f26c5b118882280c83a91eae847c5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "308b7349-cb77-4b8a-9453-8c809bebfb27",
|
|
|
|
|
"value": "ff4458a4c099f2da9609780a583382ba6cf8e29afe81955cf15c5bb94a5ef70c86a3fa93fbe9b3c8668bc5482127ceba698cdd867154fc0fef79867f555111a5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "a5887918-76bb-45bd-8e2a-a43acf425ba9",
|
|
|
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUc:6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"uuid": "d137929b-9eb3-4c34-b326-d9a7014b134e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bfa4f2a1-acbb-4b1b-ab72-30f703f3af46",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "68142592-cd38-4778-8690-25f8eb0a101f",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "17461f94-a735-4e4b-9b8b-215255e1ad13",
|
|
|
|
|
"value": "115"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "6e7b5e90-b020-428a-b8b9-516a89749137",
|
|
|
|
|
"value": "3.821145980503"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "1ca050d6-52b2-4c1a-b80a-1c182f8ccd94",
|
|
|
|
|
"value": "ae9e4dae6918a0243132b1082e3b080a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "fdfe3ef8-cc53-4ad6-a29b-dbcae1e667c1",
|
|
|
|
|
"value": "53c48b73f63eb3e977bb720ac986b17d250d45af"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f8ecbe54-993f-4b25-b4ef-889572997ba4",
|
|
|
|
|
"value": "314352c3771ede484f1af7aabe81b86ad458b0e58f3785539ea8452fc60adb44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "625582f5-ac0f-43bf-b04f-7c2391866c83",
|
|
|
|
|
"value": "1ec3ef91c7563cbfc61039bec6d056ed6f13f130143ac31569bc75a7d73c4c3a936c9e2455ed90104382f76927c983ae0121c8df3c2c90cb70154fc665528398"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "c47c7ab0-ceb8-43d2-9ace-964fc82ff178",
|
|
|
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+KdEkXT6:EXwWEgMF84MFTnflkXT6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"uuid": "3555c174-555f-4e29-9da8-5a6bb5018d8b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "820dc061-4291-4496-a5c0-46d02c71082a",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "611091dc-8c9c-4dc4-8664-e56e3ff2885a",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "2817039a-7033-4a2d-930e-5a95e6ba4a4e",
|
|
|
|
|
"value": "11456"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "8cf6a754-530d-40f0-827c-eb5ac4c6e9a8",
|
|
|
|
|
"value": "3.88084309271"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "30a45d0a-293c-4084-a940-eb2895de677e",
|
|
|
|
|
"value": "cc97933cd3211ae741c843fdd32cd18a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5071e415-e68b-4d5c-933a-0bee35e671c1",
|
|
|
|
|
"value": "79da2efdcaaefe3a4f7b18c2e1dc706f6978423e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "10016ce5-4927-4966-8456-f576d1752271",
|
|
|
|
|
"value": "28a70f6b3d62f766c5fee21714597f4a7d960f502a15640111ca9f057fe2b149"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "757e03e8-99a1-42e4-b932-a059385be0a7",
|
|
|
|
|
"value": "9fc5e3131542bee71998c28e17eb088f6102474541b04a6f6ee6ee76993482979162536b03a9b59afcad1e596ff24635729d63c51f7c56caff25d13b4249efca"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d4be8dbe-19ba-47bc-afff-b426665b7ce1",
|
|
|
|
|
"value": "192:Rc0E40I8REkoLSIOCEFm9HEcEeClJkG4b0ubWaNXJUi:6d40ZR/oLyCEFm9kcEPlJkG4gubWaXJB"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656447",
|
|
|
|
|
"uuid": "760f1ed0-af91-44f1-a78b-2860b083a1ad",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "27068a38-655e-44bb-aa8a-281be7a43620",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "501b8f78-826b-4334-b425-6cb24d198875",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d69994af-b8b4-4cb4-80d5-ac593af4bdfa",
|
|
|
|
|
"value": "8662"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "96047220-8187-4776-a1a1-2878fc27eaea",
|
|
|
|
|
"value": "4.5944060969025"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4f85a602-9f19-471b-9dd4-2cb2ec382d6f",
|
|
|
|
|
"value": "9b31ad6057c761cc49e96cb1cfbb25f6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "67a68406-b0a2-4cf8-9441-bf624583a871",
|
|
|
|
|
"value": "10f1592b6fb396a5a5e4a248dd2aa56d0db9115e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6b5cb2b4-27cd-4c4c-9937-96e2ae44ddc3",
|
|
|
|
|
"value": "f252b92fdfc85c8b22672144f21743a8e3c6908f72a37373a6d2cbaaf3ad5b07"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "6e7aee21-0a81-4627-afb9-35380505c115",
|
|
|
|
|
"value": "275071f023fd09a1f7c41ed41d1d0fa691aa7c59945ef17dfee57dff684a6a0d3437151525cdf570ce23d2ac9fa8d8503efce0d98f5a1301d9a49b1ec88d01d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "72633fa8-c04d-44ea-aecf-1670213e94d3",
|
|
|
|
|
"value": "192:+Xc7IsfXMSX0QLDIhH7vxwmX8cx5s4vsMVfAQNCexCtSclC4me/HhDZqLCeIfJ:+Xc7IsMSLDIhbvOmX8cx5HvtVYQUectL"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656450",
|
|
|
|
|
"uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "56573e90-319c-4ca3-ac05-7a9ac20743dd",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d23c1-651c-41fc-bd0f-4c99950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "e896240e-1257-4cec-bb1f-90ca909285c4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037662",
|
|
|
|
|
"uuid": "5c6d23c1-e3b4-4122-8294-41e5950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "3e5eaa70-dd1e-45c8-ad6f-35ad3b7449ce",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c1-2b3c-44ec-93c9-4ba3950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "1d17b468-ce54-48b9-a8a0-99af923ffe3c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c1-68d8-4b75-8e84-492c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "622d5d53-20d6-4c02-ab1c-ed562b45155e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c1-4dbc-464a-ad78-40d1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "c3b033c9-8301-4eb9-a7c9-042bf5a2947a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c1-5aa0-46eb-ba2b-4904950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "2595727b-8ac2-42c0-a335-601eb9968f76",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c1-1e08-44ab-ab0d-41fd950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "c805be7e-462a-4067-bdac-5a2da1a49d53",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c1-978c-429e-b1ec-41e8950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "67665457-214f-4ca0-a9e2-1caa8f1a4c1e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c1-6d0c-4b03-8e6a-4ae1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "4b8a75a1-68c0-498d-bec0-ac8af7b192d1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-2a58-499b-afc3-46e7950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "fdfae2ea-c125-4b8d-85fb-34052ca74b95",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-a598-47f9-8c1b-4b6b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "c5ea61b2-3a24-44c1-b223-d7405de29f18",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-49dc-4bf3-ba8c-4e1b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "521c8b9c-76be-4a62-9dca-73e4c9b9c218",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-080c-403b-8c38-446b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "c2b4cf8b-9b6b-4149-940b-11d0d691318d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-2c88-4671-87ca-48ee950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "d137929b-9eb3-4c34-b326-d9a7014b134e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-4da4-4b00-8cb1-4cd6950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "3555c174-555f-4e29-9da8-5a6bb5018d8b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-0094-4348-98a5-4aac950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 16 of ELF",
|
|
|
|
|
"object_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
|
|
|
|
"referenced_uuid": "760f1ed0-af91-44f1-a78b-2860b083a1ad",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-5ce4-4d8e-b647-4a47950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a150d100-412e-4a81-847c-89fba55590b5",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1582c2fb-2eb5-4f8e-84cc-0317e6585aed",
|
|
|
|
|
"value": "268435952"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6012520d-d31a-495d-ae5e-1702e11c8b05",
|
|
|
|
|
"value": "PPC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6bd20793-61b5-428b-8d07-f4e9f330cfc4",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "df593aa0-c0a7-4e7a-ab42-d038b58b35ec",
|
|
|
|
|
"value": "17"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550656450",
|
|
|
|
|
"uuid": "5dc63b80-216f-4ae2-9c4e-c0d92e1608f2",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "5dc63b80-216f-4ae2-9c4e-c0d92e1608f2",
|
|
|
|
|
"referenced_uuid": "7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23c2-fcb4-4ab3-901d-4e7f950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "73e4ad35-2521-49d8-af9d-55ac833bda0a",
|
|
|
|
|
"value": "DEMON.ppc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ce3b45ea-7b47-4acc-8a20-c341aa43cd5a",
|
|
|
|
|
"value": "90310"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3c4e1d71-76c2-4997-8eb8-484d10ea167f",
|
|
|
|
|
"value": "5.9767377179887"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "24bb75f3-3ceb-4bb4-a67c-0a02df5abc38",
|
|
|
|
|
"value": "a60266b9cc093e773c60293efc5263c9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5988ba95-65ee-4046-823d-81e793a88165",
|
|
|
|
|
"value": "9de9e897c3190ad441bcff2955e7f281f560352d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8c39ec5c-f7bc-470d-911e-e17566fb49b6",
|
|
|
|
|
"value": "9db4a8c633657ea325473b1cad48381819752b5212c393a35aaec5fb901c5d6f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c68fe312-e301-4e71-92e6-515b805f37bb",
|
|
|
|
|
"value": "3eb5beb725e6e5ca366f6a163d730644dbcfedfeb9d85f63741f6ef33455e1be6b2c9b58ac7a01e0481f49ae96a9f17f573d26c545802f9326aa940eff775c3d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "7e529de8-ee35-4c02-964d-d0f13eb72f51",
|
|
|
|
|
"value": "ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656448",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e802ca98-54d5-4164-a77e-ad5df9168af2",
|
|
|
|
|
"value": "1536:VzcNVvE1Lbr/dSAZxZmOx8sbHMmO2xb91jOuaHRmn3FVYQP1s/a9S:NOmBj8GZmOx8sNb91haHRm3FVYQts/a8"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"uuid": "7bb5de32-42dc-492f-9f15-dcc7b301e494",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fbd3b5ac-60d8-4b09-9990-87b2daed41e3",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "3b028ea2-9690-42d3-8dda-635dbcabaa42",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"uuid": "68eded72-59ce-4d08-bef1-668df62db58a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c49e310e-0cc7-40e2-be50-19dc3ca0759c",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "732856c6-6fd1-46a8-983f-49ec9489d551",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9b4d0f73-ff49-429b-b43a-ae9c51d0ff74",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "181ff3a6-3e77-4730-95f9-aaeba1230678",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e269ad4d-340b-4d48-8d4a-99e01e4fc749",
|
|
|
|
|
"value": "48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d2f0e1fb-4833-4cf9-ae3a-c0d92a863c26",
|
|
|
|
|
"value": "4.3656015629507"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "a7a9b1b4-6500-4944-97f3-cbf43fc0e247",
|
|
|
|
|
"value": "781a401b2deeb96b8895f724f09c8caa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "8a4604a6-0fbb-48e2-a206-343daffd3fe9",
|
|
|
|
|
"value": "ca844b28ad7a6e81cfd45ae9d76e5e8a10121ab9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9634781a-bfdb-4dff-aa86-6e0e98050a2d",
|
|
|
|
|
"value": "9d6a74edac3f403b2ec5cd6e7e8e2f0bf0a5c72a146c78a0111bcff3a41a18e4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "2e6611b9-2d3d-49e1-8ce2-ca5ad86951af",
|
|
|
|
|
"value": "ae9a73bc2f835c831647033758d9c4345c772ec5317d9db5eb7a016ebd8bf32f77725b0a506ca6702dc129f7b587ca3c503662385202aa95e527c18d13a008ac"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "a8ec15dd-59a8-4e0a-ac0c-f00ad52cce26",
|
|
|
|
|
"value": "3:kcr0nlk/zn+rl7Mln:kI0nlkj+x7Ml"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"uuid": "09c61fed-920a-412b-a271-ce02a84a1545",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fcb97818-68e9-49c8-9f81-7d656f4cd703",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a1582a46-a279-411e-bb95-1b5e3746ce95",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e8648993-13a8-42a6-8ce1-d70b0a7ffee9",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "91100d22-852b-4649-9abf-9a4d4055f702",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656505",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c1482ef3-e3ce-40f7-ad9a-0ec1f963f020",
|
|
|
|
|
"value": "49184"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d4471cd8-97bd-4c0f-bb41-bf59f9980eaa",
|
|
|
|
|
"value": "6.9092838224984"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "2cc1ce44-033d-485b-8093-6522fe7bba16",
|
|
|
|
|
"value": "1d033654260071f53ff4a0b1632a5774"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9a15bede-932d-43e1-925a-3852ed31f994",
|
|
|
|
|
"value": "72206f7190dff946f596505a0e3c2230da655f79"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "aa117e37-ad4f-43b6-8089-f23f0bb791c3",
|
|
|
|
|
"value": "5aa4a563544b4a08a59e0bb08c172bc6b712a8d3df51ff6666f3ace2db59a8a2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "77d74826-cfbc-4d43-9786-157dc2458b7b",
|
|
|
|
|
"value": "d3d7e67f5d08fe6276b8c877058be308b7a30fbb1a98fc4b64cd6209057ca4147e28478066f753e294e7a7082c86ea245a3e7481e14855c0b2fb2ed29177cebf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "2a853b61-8c9a-47b3-aa14-9999415c7593",
|
|
|
|
|
"value": "768:b2zoqE6VaXXg+RL4ElYnhDKHgm9gHaOoaBXSPVLsVBf7MOtxh2mhbUCw:Tq/aHJ7OBKHgm9LRa4PVSvh2xCw"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"uuid": "6f2f215b-e90a-407c-a890-9b4e7b6ddc25",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f4fdcee-e081-4a01-be13-ea45fffd71a6",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fdf8a2f1-6650-4209-9b12-e3b9831b169e",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d40bd6a2-a0bb-4c8a-b318-cdf9903ec60a",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0369e3ae-5287-414d-ab12-889e7b4dba8e",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f3fcba1f-2982-4a65-ab0c-3817cfa90cc3",
|
|
|
|
|
"value": "36"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "aa500e09-c439-49da-863f-b1a8de085e88",
|
|
|
|
|
"value": "4.5588138903312"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "937c8d88-ecd7-40d8-bb8e-a83e2550bce9",
|
|
|
|
|
"value": "b5e73849c1480f79295374adff5639b2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "38e55e60-52e7-4fe4-8a00-1ae968045983",
|
|
|
|
|
"value": "b1071f74cccbfa9f16200d54f5affb9ba0a2c5fc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "1e63c9f9-1c5f-4080-b960-9195caaa8602",
|
|
|
|
|
"value": "d48918d3e8a6923717e3fc01c99fc71d92c4f73b7045155bdd1ed5569c681a9d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5140a9e9-9523-4ca7-b9e3-632672d40d2b",
|
|
|
|
|
"value": "20b9505475503f05c0673e05f90351cf8b149beefc9f6fad1426b771fbaa9173d27736922535c4b461bd66be500533ea8fb20ee15a5aac4fd72b84483122929d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "da217aae-57a5-43ac-8cfd-5d232088d9e0",
|
|
|
|
|
"value": "3:kcr0nlkrXK9Mln:kI0nlkTK9Ml"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"uuid": "ee43fd41-f5e9-445a-b64e-591bae9edac3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f722160a-b731-40e6-a251-0ee99094d3ce",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cbb6f2c0-c794-4ce0-9a49-830edaf5d263",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e1228a07-37e1-493c-beeb-3217f05a305d",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "7b2514b0-1b12-4170-a6c1-963d5606e313",
|
|
|
|
|
"value": "7752"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "e4246228-1a0b-4ca3-b67a-1a337970426f",
|
|
|
|
|
"value": "5.2574679852852"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656506",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b71f00b0-9351-466b-8f31-eac1145c6b0c",
|
|
|
|
|
"value": "cd2ed1165b1de1c5f856c9a59a765250"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "6188804e-7d49-426c-9f1a-ec183869a344",
|
|
|
|
|
"value": "3541f46428482a3a45d3089e8f59da89d70c8ac5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c71ed914-39d6-4619-8c3d-63e0e5961e77",
|
|
|
|
|
"value": "152045c5a9a1d9b6df328d6a458a62b7aaef1602c28dd8dbd7aa3c332425f3f5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "346ef457-f6df-49f2-b163-848b757ecb5f",
|
|
|
|
|
"value": "f734289f2a0eec28ae7376cb4bd0bedec13c0010d75dd882d3dc3fdd0e758fbac6cd17c3a00b1e3bd2e9c902e75216e4d5793c485fac2d77b10917916e6bfcdb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7c69c3e5-ee18-4222-8dac-fd2476cbe0da",
|
|
|
|
|
"value": "96:r+kzI+xBMHHVR8aQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpuEtyWMl:FOHH8aEnlRum67bqlOVyQSWB3Ef"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637757",
|
|
|
|
|
"uuid": "1a82c8d5-cc26-4b68-87a0-34c96ed9245d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b1a739fb-8f22-40e5-9d89-ef32205742c5",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cff6002e-3c4a-4207-adbe-67a0c70042ce",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "af5791b8-747a-4b03-a4fe-9277cde8dc8c",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ca8a6f18-8f5e-4dac-bf33-687311d4cfc8",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "356e3831-c311-4036-95cb-50363911360d",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637747",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "bcb00aac-6951-462f-8445-fa9fc65fe9dd",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637749",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "260c1ef3-5ace-4100-bd01-6c3a85f485c1",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637752",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "3ddb38fa-c30f-4690-82d3-48dd89f88646",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637754",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "e3be2487-626d-477d-ab7b-f09b531695b4",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637757",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "a4145af0-58aa-488a-b2e8-b29f0b50a805",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"uuid": "289f1b4c-540f-4f29-8969-e9ebcd0e670b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "133a5a73-7657-439d-8533-622342e1606d",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2d7d1eb3-c743-41ba-882d-7c1049e00a85",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "71f06ffc-1a4e-4311-a033-9e88ef859abd",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f080baf0-a6fb-44c6-beac-17d30db89351",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ae4b55c8-9cd0-4f3f-bc09-2352b06d34ab",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656507",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ef63ef58-d53b-4124-b286-305d62a98ffe",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "6af6f850-776a-4dba-ad48-6de0a6c6d5f2",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "edda075f-c183-42ec-80a3-c012d4937558",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "3d8c3969-19a0-4b74-a948-353e146e982d",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f604bbf4-a335-4fac-b04b-d8f25a6d3ccc",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "3f411d58-71f1-4a5a-b391-4cc2a52f4afa",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"uuid": "e30070e6-2fe3-4492-9dbc-8a6ba6399a0e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8adc47a1-1a77-418e-9433-449ca08ec971",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f90f006-3d46-4b59-b6f6-540ec4c18316",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2daabb41-fa0f-4910-bf0b-7336bf6a6128",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e346d441-40fd-4373-919f-a2e769c7fe97",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "974d6efc-3b44-4eff-bc21-03c827e28bed",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "e29530f0-19d5-42f5-9f20-dde703ca70f4",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "4dee7705-e281-4941-8fda-ffb95aaf767a",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "c5e1f384-0faf-4889-bef6-a631be14b75b",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6fb20699-7b6b-4a1d-b1e7-4f50bbf31fe6",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "0aad3c30-7bcd-4d92-af8f-f21d5b11dece",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "778d5a1f-bf3c-4ff4-825d-8356db352818",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637742",
|
|
|
|
|
"uuid": "8aba5cf0-1929-436e-b447-dc91c761dea4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c324eb26-fbcb-4bc6-aa44-9e63feccc778",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d18eb355-de9a-4b04-876b-589e5795eb05",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a4788044-4970-4b0b-af4d-e80cf8f1d581",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "96546037-ee6d-48bc-afd3-ea48aab816c3",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "465024f3-a0f3-4100-a4fc-cff8be41bbf4",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656508",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "2537d4b0-d3ff-4f36-8689-29fdcff977b8",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637733",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "9269cdd9-7ea9-44bd-9f02-0aed1a1b1469",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637736",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "2df008a6-7a50-4da5-8e2b-7eb1a0a9b1ea",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637738",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e2d18b9f-d83c-4a1d-a4a5-36898a291c12",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637740",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a4bb6859-615a-4f4d-aa91-ad426accec9c",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637742",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "5eb46e60-90d2-4703-bd72-3048f1697fb5",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"uuid": "14cb1917-5119-4963-a18f-dac5e7d2e59f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8f7a0040-f8c5-40e7-828b-d3585d18849a",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b4c81eb6-d5cc-4212-8d9f-9c18ec405178",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "64d171b1-a5e0-4f77-9959-1004472fa5e4",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5b8ab3eb-ccd7-4146-806d-0d187662dd5b",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "cdaef1f5-08a5-4d15-be4a-1f8f475670ac",
|
|
|
|
|
"value": "892"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "5879c5c0-8e27-4ed0-a57f-6a6354ec657b",
|
|
|
|
|
"value": "2.6846998401111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "a49a8da2-751e-4ca1-b450-ee09206f8413",
|
|
|
|
|
"value": "1f42bf1a1eae4d4cd658394273d856bd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "bbe966a7-8db7-4d91-8d72-5b0e9f1569c3",
|
|
|
|
|
"value": "f66b9f058b711179f724b25abb392ca724263ac4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "028497c8-adee-4b41-b8b5-f586cebdce6f",
|
|
|
|
|
"value": "e530eb79ad22a9cb617efeb676de60ffbd2355a7abe1b4a212e46e931f799cf7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c7aa6d03-04db-4812-9d7d-de2d461bfac4",
|
|
|
|
|
"value": "417b65e33da3b947f6597a4b8dca67856bf13fc4805d5d139b5f7edcd1850d1b3f4f3cc156bc8fdb2cddd8f8ca2477227de63e8a5803e7bf13752905865db82d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "feca3cb5-443c-49aa-ab96-ca15895e74e5",
|
|
|
|
|
"value": "12:AxMEUSXC8wGyJ6E6Bg5dybSvOH/YJAk/kn:6MB5dLwH"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"uuid": "daaf43a3-100c-4fe3-8e89-4adfd9057efe",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a451d2f3-4691-47b4-a19b-a82bb0c23426",
|
|
|
|
|
"value": ".got"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9a9669f8-4ab2-4847-b5c1-51e68fadb612",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2a548edb-9c3f-401b-a8a0-64230060df8f",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2e1f8bdb-1409-4548-98f1-b2d124cf14da",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "eaa33483-f348-4957-aac0-ebe3d38693a3",
|
|
|
|
|
"value": "16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "38a4d235-31fb-42f2-9cc8-8838fc44c9ee",
|
|
|
|
|
"value": "0.99339272901036"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f0d4d27b-9dbc-4e9e-9390-8b7047c06a39",
|
|
|
|
|
"value": "3b6400472dc206037788539e9acb4d45"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "eb8701aa-3be2-47c5-8b7d-cf1ccb38d3ab",
|
|
|
|
|
"value": "ed3984a457b5a2c57cc1a929a6b6b63110e04173"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "13cf0499-fdef-4e5b-a4ef-23c63ac5919f",
|
|
|
|
|
"value": "296b4428be76f5b2aa62dd6d09bf6b207e2f6692bccd765842514029348b9d01"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c8c99c68-b72a-4342-85aa-36cfef95fa06",
|
|
|
|
|
"value": "6603115e234fb94190367963b93097b2712ab2a4a6cc41ab7cad9ff3793d96b165139d07baf713e7dd7be8877392a2d45920972c73e261835e22d7c67f35a30a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "070d7857-6509-4e2c-90e9-333439d99864",
|
|
|
|
|
"value": "3:H:H"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"uuid": "e92fec30-1048-41d7-adad-639103eaa63c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "413737c9-a6a2-418e-89d0-c0e76e667fbb",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "948bc352-d93b-4d41-aa47-c003cbc75475",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5333d49c-2474-40b3-8531-840a96e429bc",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fb77d865-3f94-4913-b9cf-a668131b7c72",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "35edd3bc-7cf4-4e19-abd8-8c169fc3bb9f",
|
|
|
|
|
"value": "25428"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "97027bd9-f4ed-4ec8-b33e-e6c1b69dcbf7",
|
|
|
|
|
"value": "4.8752630053652"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "6a5ca404-694a-4e7b-bc4a-ed6fef81fed0",
|
|
|
|
|
"value": "e8ed22b372d91ebcd32e2e3921163b28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656509",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9d1a7e82-d22d-461e-bc0b-8cacf5f484e5",
|
|
|
|
|
"value": "fdee3f84993fbf88ae7dfc431f525b6b881af4bc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "25a49040-62e3-40b8-9fb1-ecb599fce4dc",
|
|
|
|
|
"value": "aa8b7229c17bee6cb52fb5c8c9ab5af80cb59e73b10277f1e6736a418b7d5abe"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "fbad6565-3ab6-4b64-b09d-e13f17acef08",
|
|
|
|
|
"value": "dbd574d733f4a2c3681b30ecb0618cef5a3304aadaf318a3ea50add78d20489cc0453d06c3400775af6301fd76bd414dc9bbd471c211915efff22bcd4d88c7a0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "bd4521cd-329e-41b9-9887-008954c5173f",
|
|
|
|
|
"value": "384:AK//V+aR7SvmO3CjZ7IeQM5DI75mmX8fx5HvtVYTfct3fZe/Hloy:AqVpSvmLHmX6xJFVYTf4fE/H6y"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"uuid": "020ca0aa-39e9-4f7b-982d-0ca840149593",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "53bfb2e2-4ae4-4af4-9adb-7afbfd7fed01",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d87b218a-afe9-4f06-83fd-14ed5444074a",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a00577ae-912a-4873-bc32-fd8bac11c8ac",
|
|
|
|
|
"value": "2916"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "00a5a0bc-ebdc-4ed5-a8e6-15f55a0ef879",
|
|
|
|
|
"value": "3.6197042079518"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "0505ce5c-fbc7-4753-a231-4e89e007ab96",
|
|
|
|
|
"value": "fe5bf2f7d18d9eb5abeef8f8ee14c891"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "0d9cabbb-8d77-4263-8d93-78ef2116b8c6",
|
|
|
|
|
"value": "c9dcf3394e02ee96f00f3f138b57e1a74d57dd70"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "4bab5f12-083d-4901-892c-45f82de3f2d4",
|
|
|
|
|
"value": "42ff8a77054fde20fe4cb61c28478f70c0244984850d95492668840356d0efa7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5f862e8f-e1e6-49ba-92ad-1c50d2f72b6e",
|
|
|
|
|
"value": "b38e6660f6263c6d23f184d55a8306ef4e967b3d376fb17603481c347c9f8e27caf2e98c85c50ccca385e623c2906ffa4e4a9638842a53ac7142c931278ed290"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7e3f31c2-2549-4ee6-847c-5c262b540872",
|
|
|
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUi:M"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"uuid": "23e9bde3-6221-41de-943e-87d5c9c1d128",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "07f2dcbe-a13e-456e-9fb6-b69f776674a8",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f5af51b4-76a2-49b7-9c2b-870e96e8e358",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5893878e-1c1d-4d23-8da2-08b1110e3936",
|
|
|
|
|
"value": "107"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "39a591d7-f777-4804-a7e7-1851adbf76f3",
|
|
|
|
|
"value": "3.886961236137"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "48da199b-0895-46c1-896b-e410057f2dd2",
|
|
|
|
|
"value": "be26005c18aabe4e53f62df4db48b00b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "46d8e7b8-6dac-4c88-9181-156248a3da52",
|
|
|
|
|
"value": "99df1329249536e4ec2b83ccf1fb21436a270e51"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "a3c34295-03ee-4196-a1aa-59a5f740c7cf",
|
|
|
|
|
"value": "108bf61e358c1760deddb88c93545496bcae9301147b293449975db078bd53a1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d52d778a-5a2d-4dbb-b39b-0d050c93fe4a",
|
|
|
|
|
"value": "8ef6df32dcba65c1bdb5fb6762c99a74cecd6c6c3a5518195e06918df209672bd444159ad53f746b1bc44f986c4e388ed328af20e75e3c37938eb91d286b2a14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "69a26a9c-573a-4290-9f36-0efff56d2486",
|
|
|
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+KNzXT6:EXwWEgMF84MFTnf4zXT6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"uuid": "614810d2-58b6-4b26-a507-2ed5e82abab6",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "03c40427-e501-46da-9229-a0445a702444",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "64acac31-745b-4524-9c15-7b8f19bbb285",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e79bc1e6-d216-405f-8230-3af274e15858",
|
|
|
|
|
"value": "11472"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "05fd1b7f-76d3-478d-b203-7239fb4dfa14",
|
|
|
|
|
"value": "3.9042769327508"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f8b75341-5a33-4d38-84e9-23dc5dea5f44",
|
|
|
|
|
"value": "64d8e22c3bcc75b77327ca1c47a72a64"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "7384fa9b-4305-45e4-bb0a-72c09d86fd91",
|
|
|
|
|
"value": "a5d2e2524b71a5abfc2603e5583f52523914933d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "a46d6f32-9f2e-44d1-b177-4cfb634782b2",
|
|
|
|
|
"value": "93a2bb8082f94d6dccfef242166b4c04773f1d9b74e8f5c6f3fb8b7905783344"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "14eca97e-4abc-4b25-8753-a720445bdbe9",
|
|
|
|
|
"value": "7eb3e33f952e37986e5f042136c94bfc8a07bea0b4c58ff114c881bf4bf3d45fce5e1b9e0c34e0a3612cbf353a1b83ca87d43889f0cd966f963d080f4c95892c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656510",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "0a6b6b86-0df3-4d46-96df-40246d32f258",
|
|
|
|
|
"value": "96:rNCwlNHTdDlwQGqF1u1e8p6lxRy4whbWWnqhoo7ihpjmEm8UNZizA0gPDqG5:EwlpJS1e8gV+qhR7S0c1zFgPG+"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"uuid": "0b73ecde-d78d-45cd-8c84-be00190cd1c1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b3879411-4117-48ca-834e-550632582a00",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "adc19d3d-62ba-4f3e-a27c-80f5fe859d37",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "7e2cd560-bc54-424b-a122-566f75e0f757",
|
|
|
|
|
"value": "8657"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "6f437dc1-d828-417f-b50c-33bc7d2bd6a9",
|
|
|
|
|
"value": "4.6059623866442"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "661cf444-463f-4a2c-a2e2-58f4e4f20f5a",
|
|
|
|
|
"value": "6b28078938fb4e8c16c8800a75132225"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f471e038-72e2-4851-9cff-5da55d689f82",
|
|
|
|
|
"value": "b001485eedc408968a0f1a1bae6324e300c8d9a1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "772de10b-8e5b-43bd-bb9f-48d85f546cd4",
|
|
|
|
|
"value": "22ed0701da14c3d8c41b87699171eeb20da6e47bb016cd5a23e36135201e6ece"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "b7447180-5300-4ebb-ab97-8d95f5c2d53b",
|
|
|
|
|
"value": "edd3ddb76fddcee3b6c588abca6902991f9042ea2a9fa70ed580150d579fef928dcd065ceaae5aeb7b75612d2fd7c3e9385f9ba008b39dcfa31ab2b2c93e9cfd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "4a42cf76-edb5-4bdd-9aa2-9def37efec03",
|
|
|
|
|
"value": "192:MCjZ7IeQfXMtikDI7COxwmX8fx5s4vsMVfATNVxCtSglf44e/HhDZquCaIfJ:MCjZ7IeQM5DI75mmX8fx5HvtVYTfct3V"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656513",
|
|
|
|
|
"uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "7bb5de32-42dc-492f-9f15-dcc7b301e494",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d23ff-62c8-4cc3-9dd2-4a0c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "68eded72-59ce-4d08-bef1-668df62db58a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-27e8-405d-8c31-402a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "09c61fed-920a-412b-a271-ce02a84a1545",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-f764-4b9c-b5ad-4993950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "6f2f215b-e90a-407c-a890-9b4e7b6ddc25",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-254c-493d-8190-4e9b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "ee43fd41-f5e9-445a-b64e-591bae9edac3",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-09ac-4b2e-803d-4871950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "1a82c8d5-cc26-4b68-87a0-34c96ed9245d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-0f04-4ba0-9b6a-481c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "289f1b4c-540f-4f29-8969-e9ebcd0e670b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-2260-4649-8346-4f9b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "e30070e6-2fe3-4492-9dbc-8a6ba6399a0e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-d59c-4d52-8c14-45f6950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "8aba5cf0-1929-436e-b447-dc91c761dea4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-6cb0-4767-adae-47b0950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "14cb1917-5119-4963-a18f-dac5e7d2e59f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2400-a03c-43f8-afee-4f3b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "daaf43a3-100c-4fe3-8e89-4adfd9057efe",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2401-d8f8-4562-a22a-44c8950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "e92fec30-1048-41d7-adad-639103eaa63c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2401-61bc-41cd-9c54-4284950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "020ca0aa-39e9-4f7b-982d-0ca840149593",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037663",
|
|
|
|
|
"uuid": "5c6d2401-e0f4-42d9-91a7-4900950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "23e9bde3-6221-41de-943e-87d5c9c1d128",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2401-6694-4f6a-b8d0-4b38950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "614810d2-58b6-4b26-a507-2ed5e82abab6",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2401-72e8-4814-95bb-445c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
|
|
|
|
"referenced_uuid": "0b73ecde-d78d-45cd-8c84-be00190cd1c1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2401-f5d0-4624-ba07-421a950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1f2bf26b-a5a4-4b9e-b1b0-95d258eb242a",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0f7f4618-b272-4f58-a3da-57eaafbd3f89",
|
|
|
|
|
"value": "4194720"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e60b43d9-cc30-4aae-a9e6-2460127ec8e4",
|
|
|
|
|
"value": "SH"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bfbad028-65c8-4741-88a7-82ebb712bc17",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "8a1bf0a8-09c1-46ed-81fc-35754f9c5446",
|
|
|
|
|
"value": "16"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550656513",
|
|
|
|
|
"uuid": "bbe86c8c-5387-4624-b3db-0d287317db87",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "bbe86c8c-5387-4624-b3db-0d287317db87",
|
|
|
|
|
"referenced_uuid": "64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2401-a1e8-4b39-aef3-4ff0950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "b847f862-883c-4ed3-a3c9-ec45ede6f92a",
|
|
|
|
|
"value": "DEMON.sh4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "bd3dd78a-442a-4628-b152-fa97cb0dac65",
|
|
|
|
|
"value": "82065"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "e958512e-a5fc-45e0-b17d-78a2a86ed0e4",
|
|
|
|
|
"value": "6.5598416757144"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5299ae76-f2c8-4e12-8691-8f607231c87c",
|
|
|
|
|
"value": "afc3c9b08ea495b3c2701dd3d62de906"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9865f910-0b4f-4645-8650-de22c81695e0",
|
|
|
|
|
"value": "1ca6eb84d4b96c02eb74cc2e3ddee51caa0a45d9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8c0eaa99-3251-4612-ae55-74136967ec70",
|
|
|
|
|
"value": "bb567c020b859c5f371433324fbffbbea0d2fafc7674d39bca493685372d30bb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d9ad2d57-b97d-4f64-9409-f7127cd7830a",
|
|
|
|
|
"value": "ad2e390cccbcb0f9407f19bd390e5ff6e61266713a117066bb31f62554d2c92599996c0f2bf778d55416d1b3ef9efef1a6ca85e99cc4eaba9789687a691dbfdf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "33f26be4-7772-43fb-bc6e-5cd5ae38fb2d",
|
|
|
|
|
"value": "ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656511",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "bcc4a0f9-8e6b-403e-b6a6-96b536decb11",
|
|
|
|
|
"value": "1536:Fq/aHJ7OBKHgm9LRa4PVSvh2xCsPqVpV7mq3FVYTfuE/ayS:o/qJnHra4PTxTkvm6FVYTmE/ayS"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"uuid": "9551bb88-fa96-4aa6-b707-cfb4cd8623fd",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "43209772-35d1-443a-a956-bc929efbf1b2",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "dfcb6195-d7b3-4336-b99c-e7ab73c13935",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"uuid": "2fcb8fce-1cef-4ef9-9efd-7a0b98c6a106",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a5dd0b59-c7dd-466a-a41e-9f5b4457c2d1",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "871ae425-eba7-4ece-a197-92a1e1b1e0bf",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "88eec833-1cba-4077-be87-b585224add6d",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "53989f73-d521-4afa-9c23-360f7387f897",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "2ce4b688-ddd2-46a8-9664-b08fd16e48ca",
|
|
|
|
|
"value": "19"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "9145c96a-d786-4161-ad34-f03dfac8f91a",
|
|
|
|
|
"value": "3.2158411726838"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "98b1b36f-c316-4b2d-848b-d2ea79eba91c",
|
|
|
|
|
"value": "87200fb4223b81c55490c9cc36314c65"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656528",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f56540a8-131b-47f9-82aa-87d37444daf2",
|
|
|
|
|
"value": "84e128e36ef1900da77feff84848132dd232ea6c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "08a8539b-27f4-4ac8-a1a4-8c7a221e9f45",
|
|
|
|
|
"value": "7cd558581d563131a3bd3d9cd00395090295481f94c159e7b7e1fbd6c5e12719"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "ab8bdbf6-2e54-4c54-90ea-ffec3982c86a",
|
|
|
|
|
"value": "6d39530c7eff6c1c337af40cc7b32744fbf1f3bcc3ab9c96a2126a387c57842c6e3f1918b12605141cd33a22ab6b791be5e4ba8baab839714d19f6ead025327b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "78d2d9cb-d7a9-4e60-a102-93c7df2a8916",
|
|
|
|
|
"value": "3:4o/CYm:fqL"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"uuid": "1aa3230b-657e-4e2d-9e07-84564e79d11f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1b35328e-ce77-4950-a7e4-6da45b4279f8",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8fbfe0ac-54eb-4d1d-a60b-4ab061bd63a1",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "46478e66-37f8-4a58-9d06-cf8ffb8a1ca8",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8904600a-06a8-4019-b7f4-dfdca1a02b86",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f8acc62a-c1b5-4cd7-8c22-20c3879a7606",
|
|
|
|
|
"value": "49160"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "38a901f9-e36f-463d-bdff-944c1510a3f0",
|
|
|
|
|
"value": "6.2779611812814"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "83afb1db-a6ca-463e-aeed-010e755220fa",
|
|
|
|
|
"value": "1010ccfdf40c3802438864352ff7f412"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "3d64b00e-2155-454f-943f-539df19ba1ed",
|
|
|
|
|
"value": "83dcab928a97717f96651fabcdc130529e843dab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e2233613-d319-4164-a64f-af3f8db85296",
|
|
|
|
|
"value": "3d47cbc3155f56a053bb30ae68863656d656be54852299490e6400334a9d6c11"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "754bed83-c238-4e87-9c23-fabbe61d2525",
|
|
|
|
|
"value": "4f6c62453e5ffdbef028efa1bea5bc287846b9d9beaa9da7439c14ddce11758094a2c4961ec8ff7226b331bdf240ddecf9dd9dcffcf94e870bea5f092b64d14d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d262fc06-0b44-4e87-813e-a2387f8f4be0",
|
|
|
|
|
"value": "1536:zqdcFQuHZ91/0iiMsaURZoNbDLfacTmJ3J:zQcFQG1/0iiwURZEbnacT4J"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"uuid": "d9cb1d67-bc67-4288-843e-fc58b2bcef1c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7063bdaf-a46d-4a58-8066-ddb2bd5ef499",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "be4b8f33-ad09-4fe0-90e8-1e9df9b1433e",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a43d240d-02e1-4318-a8a5-7945668387db",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cc808986-5216-49f1-9437-2c87c4098001",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "db640d2d-47be-4e70-b3d2-efd042aeaffa",
|
|
|
|
|
"value": "14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3e5d6a44-816b-43e3-bd08-77bd95da1e72",
|
|
|
|
|
"value": "3.235926350629"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "ba976c78-3dbc-47de-856d-922fc71ece9e",
|
|
|
|
|
"value": "2f7e66fa9961933c506f9c37f03a1ad9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "0ec8d85d-c8a2-41ce-948e-661f6556276b",
|
|
|
|
|
"value": "246a56cff84b97ed1fb00d25f0047528ea53b8ca"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "e9b45e03-a95c-4cc2-bea9-955fe445b9c0",
|
|
|
|
|
"value": "2a3d013513a85f2ee97a564567a365e0bf716a0736780a7fefcd51cf313af785"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "b5458974-c83f-41c7-9d02-329d32f377f3",
|
|
|
|
|
"value": "35bc30c6a87e3227189e98313ad4c6918b9a8345a86512d4817219591a48e14b6320375d94e6397a0678e48d2535953c458315a2bcc5b97d6e7dc255e9510e6c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "7b644af8-ce83-4a5a-be63-ae1b44b6a41c",
|
|
|
|
|
"value": "3:4YRatd:v8j"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"uuid": "1a3da186-1bbc-4a48-97b1-6440eca59723",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "71cfd0ce-712a-423e-9cf4-8e434d9f78cc",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e39ad123-eb85-4cb3-be70-9828e2c11377",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "aee32467-66ea-4d1d-ae2e-86597eecce38",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4f74aac4-3514-4c59-a243-8682d1bbc01e",
|
|
|
|
|
"value": "10304"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656529",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ea7e69ec-8bb4-4970-b687-ac98c2f871ec",
|
|
|
|
|
"value": "4.8364258622742"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c8a32e2-03e6-4991-a21e-abc30ac05797",
|
|
|
|
|
"value": "375e0e06002a56ad532ddba8976011af"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "96294027-3771-40da-b60e-0504d0b22fb7",
|
|
|
|
|
"value": "23b7c61df88025caa97d84abad2d2d1219c68061"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "da0fd398-4e1c-4451-b758-d42d77457055",
|
|
|
|
|
"value": "73a5591a69d64b32883abce071d53a50447bfc7f6ba96c9675c796cd8f5a4990"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "8012360b-70c6-45e4-9f1b-040dfd11d474",
|
|
|
|
|
"value": "927d7e2bc55ecda9c8d72ded1225a45dc3dd348f016d1cbb844cc7fe0487c46433d82911fdbf6156d64a4e193b55acb649378ded439b075671deb2e7f68aed25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "99d88773-7f51-48f0-8ef7-33bc07087019",
|
|
|
|
|
"value": "192:NElHOaEnlRum67bqlOVyQSWB3ey96qjpdd9dvf4ejMh:K0ePuhqnMh"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637729",
|
|
|
|
|
"uuid": "c216228a-4acb-47a3-8d5e-3f4a1beea28f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a2deccac-98fb-4d4f-b0a0-1fdc53aa56a6",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "854684fd-3821-4365-a7e4-12480e177459",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "dcc2b0db-be0d-4e05-a0c6-231556f4061c",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "018361a3-25d2-4a97-abdc-9838684fc31b",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "0f48231b-c3cb-4429-a263-89e24fd579e0",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637720",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "6bb83bd1-4750-47c5-8259-4bca23c3fd39",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637722",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "dc40a038-93d1-4e62-b939-5fc21144d24e",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637725",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "058b7b70-3bfa-412d-abd6-385320558199",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637727",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "ab642d87-d462-4596-bc63-bc290724da82",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637729",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "a2bc3d62-232a-45a8-888b-c711a40afede",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"uuid": "733971a9-763b-4866-ae77-1700627e83cc",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "acc2b674-42f2-417f-9356-b544be3d6244",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6e922750-66aa-4e6b-9159-7278f323c728",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3852b5b6-d56b-47cd-a5e9-ac723c98708f",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "68cdebea-fed7-4b11-8232-f377d7e9482f",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "839e706d-4ccb-4827-95db-8a79a704e65b",
|
|
|
|
|
"value": "16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "de51c211-f917-445c-acee-a1cdbcb47b24",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "73ab86a9-c3d6-4e70-954c-13dcc8fea3f9",
|
|
|
|
|
"value": "f858d36231ba743ad8c898d86a67a864"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "c1baecc6-5651-46f6-bfda-1cd6c97c40cb",
|
|
|
|
|
"value": "f7fd9f0c0324c1723e1eaedd80f457bdf62aa9dc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "cc5bf08e-a6d0-4d24-820d-3534915f75ed",
|
|
|
|
|
"value": "60c69a3e87bf5c4f1e546bec45f262690bcf5494c4ecac2616bf2f731afa152a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "e49ece9a-fd00-4839-a29e-7a20ee350c12",
|
|
|
|
|
"value": "2e68bf09036a490ce0e8d579ab0247a5cccf12f6ba44c3727ad22420e13e26c588a9fbf7b4dceeeced9d7148d9c29ef33ba6ca174596a65b1d297d0d7169bd6c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d2ef3aa6-e57d-4d54-b359-61f425fced05",
|
|
|
|
|
"value": "3:RRR//:LRX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"uuid": "f9aae507-1a91-4b11-aafd-2a42fbbc55b3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "05771ce9-7477-4aa3-a13c-870b987cd0f8",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e5a12335-3753-4e6c-988d-d0f100713541",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4a28337b-dc60-459c-8f61-f86eb59ebbb2",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7bd7e77d-6cfc-4e70-a065-19c76e0ebed8",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656530",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d2ada2ff-4a0f-470d-a06e-d54cb0008d00",
|
|
|
|
|
"value": "16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "0c24ace2-2376-4e40-90e0-88f78942667b",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "7caf4296-310e-4652-8302-34ea33a3cfd5",
|
|
|
|
|
"value": "f858d36231ba743ad8c898d86a67a864"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9ce91a4a-d134-4b88-8812-93c9141c9b94",
|
|
|
|
|
"value": "f7fd9f0c0324c1723e1eaedd80f457bdf62aa9dc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6b74ceeb-ee73-4393-98d6-461ccc071787",
|
|
|
|
|
"value": "60c69a3e87bf5c4f1e546bec45f262690bcf5494c4ecac2616bf2f731afa152a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "baa70a0b-91b2-49b1-af2f-e547fab2a23b",
|
|
|
|
|
"value": "2e68bf09036a490ce0e8d579ab0247a5cccf12f6ba44c3727ad22420e13e26c588a9fbf7b4dceeeced9d7148d9c29ef33ba6ca174596a65b1d297d0d7169bd6c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "3b578bee-c28b-49ef-9393-6c37dd9f18ad",
|
|
|
|
|
"value": "3:RRR//:LRX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637715",
|
|
|
|
|
"uuid": "a494e224-56b1-43cd-8678-60dff775e87c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "22eaa771-a2a4-4fed-bc1a-ecfa65034912",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f2e0c55-4cf6-4973-b4c0-bd982520ad2f",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "51720b37-1f3d-4ce6-ba1b-1656e344f7bf",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6340786f-576c-4b26-9777-eb6af33c4e4c",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f6b27588-27c5-4968-b66a-ebaceeb8a522",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "9aed8f08-d7b1-4531-a7cd-704a723f348a",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637702",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d967b090-1885-4517-ae9c-82f162d122cf",
|
|
|
|
|
"value": "7dea362b3fac8e00956a4952a3d4f474"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637694",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "219ee904-6e40-4b11-bc87-723a7e75f41f",
|
|
|
|
|
"value": "05fe405753166f125559e7c9ac558654f107c7e9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637696",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0afaa2e4-d6b6-47d4-84de-91742b2fac66",
|
|
|
|
|
"value": "af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637699",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5bfaf501-4cb7-43e5-a730-e7d2ae36ee98",
|
|
|
|
|
"value": "1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637715",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "bdc979de-d348-43eb-8310-fec64b85745f",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"uuid": "4efcbd17-7421-4e61-a49d-ad3da379ac93",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "03270424-42d3-41bb-8d2f-4cf7bfaa3738",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "875ca0ee-54ee-4061-9a38-d0d9d2af0498",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2197e177-376c-4fea-ab92-d1c81ec813c8",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2019f7f3-e941-47d3-8a77-615cb6bf37dc",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "2afd5c28-b8cc-4c8d-b053-93480098b504",
|
|
|
|
|
"value": "1176"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "24359137-8ae1-4238-9ec1-8d4a473f61be",
|
|
|
|
|
"value": "2.0387950584364"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "1c842187-3384-49be-997d-2eb9c0aad250",
|
|
|
|
|
"value": "9150c6ec104815f638a724d27670d5da"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "243dd9a3-99d3-4d70-9a2b-139352e0b0e6",
|
|
|
|
|
"value": "784886a8d099d6f9ac040cdc281600198a232c09"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "18360691-5595-41b2-bbe2-4b8c7cb565b8",
|
|
|
|
|
"value": "89ba94b9a12cb88ce514c84b65bf6dc0daf0bec255264acdbf326770c65b37bf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "1716d97b-3db1-48a9-9e22-acad8401aba3",
|
|
|
|
|
"value": "b1538d443d02d608cb7adab3302dc00f1fcdd1f94262b4eb91b4d4431e6f5da69696111fe2580211aab83923ca4b5a90bd64f1f9f8b8292dd1b10cc4ec7f43c8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656531",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "cfd60db9-4824-4017-8e16-afa4376f539a",
|
|
|
|
|
"value": "12:SXEQZkfk0TfSEkkugaybSvOH/YpxlEkwmt:S0QZkZzaLL"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"uuid": "9ab8c8f5-6fa8-4f4a-a71b-3835066ce15c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "20faa440-bb51-4fbe-90ce-bec1892c5bfd",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "38de6c6c-e8ea-43b7-af53-b3b7a1f19ff4",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5771b9de-5cbb-496e-a5a1-90f2dc0eb6fd",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "a1b1951c-4bd9-4e6b-85b5-5bc2981429c1",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "c285183d-ff79-4831-9be5-a47eb0b4b770",
|
|
|
|
|
"value": "27504"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "e42ef729-6d40-428e-9c5e-a55b7f001d0a",
|
|
|
|
|
"value": "4.2147603464837"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b406a7b2-e430-4070-b9df-dba640854755",
|
|
|
|
|
"value": "5559a0ce323926dc510afb3339da6229"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "b34fd44d-9aca-44de-8899-9f2b4ac64839",
|
|
|
|
|
"value": "b02987eec671911d97cef05e8addcc19558145a7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "84075bf3-27ea-4a6e-b745-24f891f95382",
|
|
|
|
|
"value": "f1622ed7cd5cec84ebac5d89d7d27dadd784193ab5494673de8dffd01216586f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f73ba742-63a8-48c1-8741-816173bf0754",
|
|
|
|
|
"value": "dfaa2d9cfdda5d6bd625607b610294b38083a51c85f8a68357603a62c72058f3eef0e957dd7c93381f798390d65d3b2d6ab4102a365383eb2994d4a2819a8568"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6899ea4e-231a-4db2-be5a-7078c8614ad9",
|
|
|
|
|
"value": "384:ddpMllAkT+Wq9mrBqYaPwHq2Tdc7IkUDI/2HmX8p15HV+ucEUect3f5:xMo727K2nmX01JUucEP4f5"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"uuid": "4f972a14-ad50-49dc-a95b-26939a450cb2",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "59fe12fc-112b-4aac-aca5-8828180ae588",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1e2678dc-daa3-4651-a9a8-8d822cf09343",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "49c6c061-2f78-4218-9285-69eeb5f1c54e",
|
|
|
|
|
"value": "2808"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "1f5af388-d63c-4d21-919e-03716066acac",
|
|
|
|
|
"value": "3.6143694458868"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "da2b1788-7406-4eac-97dd-b39c66106f43",
|
|
|
|
|
"value": "8b9823b5371fe7899822e5e5395d9197"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "7e11d206-68de-4197-987a-2beb892ea24c",
|
|
|
|
|
"value": "b6deb8982d33fc22cd79b7be3536b891791979c9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "cf4aa99a-4915-4cf9-81b5-5814885db586",
|
|
|
|
|
"value": "d18b722c6ea9212db8e347a7991b36f1460e3c69cba8aabddadfb3f1829e1dcf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "22c94778-af73-4099-8707-5313ca080e6e",
|
|
|
|
|
"value": "2171a443ba400a03a4543b2a46f7483cba3a7ba28dab68191dcdd6e9d9ac3c9d9f96440a9a746a8a69ca6b842c231209ff74a760b60d269bced14c3954f2492a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d5a0fa7b-3087-48f1-8f92-637ad8c01467",
|
|
|
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU1:P"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"uuid": "dc0ed1b0-554c-41b1-98bb-de6a6bd8363c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8b55919c-5b8f-4dc7-add1-f6ab1e2ada6d",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f8f2574-45ad-4f5f-854b-b24ea35e70c1",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f5572cb6-e3f3-4c7f-aef2-0f3e0ea7a560",
|
|
|
|
|
"value": "102"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656532",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4d797f65-495c-435c-8832-870c8d89780e",
|
|
|
|
|
"value": "3.8692077817787"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5f7d4bc6-b197-44cc-b145-f9e3243ce0d2",
|
|
|
|
|
"value": "b748e0aa34cc3bb4dcf0f803be00e8ae"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "181ddd47-b1b8-4e43-9d56-bb962284465e",
|
|
|
|
|
"value": "f8afe25d02e36248d719e04aafb2f3edb98bf012"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "07521035-3454-4959-b9d1-571d1daa0de5",
|
|
|
|
|
"value": "c42f97c90874af8fea59609c9455cce16e13d894c3279c7d9b799772b2cebdfb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "3c4f6633-e05d-4ee7-9972-24963605b05c",
|
|
|
|
|
"value": "7328069d7164d73b6c2872e2b88eb1f18023c6970d9b2f2e1f6c288e027de32b1990862e14f216957de41c4f427f7fbcec9dd5f98ca7162c3a3973a2ef6b623c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "89625f83-3033-4e39-8a9b-f999ce300a68",
|
|
|
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+K2iLT6:EXwWEgMF84MFTnfniLT6"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"uuid": "7d20a574-f708-4c7b-83a2-4b1e863e5034",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d4c1dc27-2102-4b77-bc1a-71f918b0979b",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ad36041f-e3a0-4573-8b20-abdb3bdf45b8",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ec003f16-b73b-4353-a5d5-cbb8009c0be6",
|
|
|
|
|
"value": "17328"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "0f54a2db-df56-4298-86f7-15a8548f25b9",
|
|
|
|
|
"value": "2.8699228419081"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "fe4fee40-70f1-4751-9c9f-0b967610406f",
|
|
|
|
|
"value": "9867543465622991096c27d1c5fcb92c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "aa5741de-cd4a-45bf-9bf4-2c52d0def8e7",
|
|
|
|
|
"value": "43aa13a5855811f9fa6a617de495595f7de85dd9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "3be0c50e-11f0-45a5-af2b-dd71617e9714",
|
|
|
|
|
"value": "1d5215f34e3189b498d2ed94e5ed2f0c4407910e76686cbbe5a992bf943aceca"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5b94925c-508f-44b6-8354-72b6e9b62f4f",
|
|
|
|
|
"value": "6f1a769ed7d4eab5b8a98e772a4810294348aedeb0a69518f93eea5188dded188a4d2d07e9afbdb0265dc7afc9565a263a6af50bda21bc24880b2ff458c8f482"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "33db3576-b55d-43ff-b47d-e3cd9b57861d",
|
|
|
|
|
"value": "192:34dzV1Yz2HyNMOAkTzbgZYf/pEOUAk3mTvHgxeVqYnB0PwHq2:odpMllAkT+Wq9mrBqYaPwHq2"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"uuid": "29ee112d-4c89-43d2-8ba2-eaceb48e47ea",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d19631ba-33e0-4140-9f96-513b7d73d47d",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0a180530-7343-4fb6-b8ec-73c41177274c",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f387ffb9-605b-4b6e-812b-29f059a2822c",
|
|
|
|
|
"value": "8813"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ce917ef9-4a14-4d9d-ac83-8a0abac82fbf",
|
|
|
|
|
"value": "4.622286223545"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "176ced50-1e7c-4dfb-9e40-c811355ebe47",
|
|
|
|
|
"value": "f1624940a002473c30ed4abb631ba982"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "8ecc60ab-ed89-4f72-81a9-77ecbc477d5b",
|
|
|
|
|
"value": "7231e9abd6864460086fc108090f8e5ad76b3714"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656533",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "7ab89d80-b425-4f47-88e5-9eb0947e8263",
|
|
|
|
|
"value": "113874644738cff75aff3545db73618d85ab59472708351491d40fcf5bfbbcf7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "23bf7642-d831-4fa2-b2ea-1806672fc1fb",
|
|
|
|
|
"value": "896e0893db2288f63f99b9cdf62488f5b247fece6e6a8c0f68514db55899aa85c7629ae2561bd71cad99ed48dbf99a98e34e9ba72361564a90feff36b5a6a4db"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "9f09d368-cb5a-4452-949c-9c1ab366b7f7",
|
|
|
|
|
"value": "192:9dc7IFfOpVbADIWK90x5mX8p15s4S2BMufEENCexCtSglfQWeBLhDOqDMaIfJ:9dc7IkUDI/2HmX8p15HV+ucEUect3fpF"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656536",
|
|
|
|
|
"uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "9551bb88-fa96-4aa6-b707-cfb4cd8623fd",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2416-9770-46f8-a9d2-4d4e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "2fcb8fce-1cef-4ef9-9efd-7a0b98c6a106",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2416-4fe4-45e5-9c3e-457f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "1aa3230b-657e-4e2d-9e07-84564e79d11f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-12e8-4b9f-9153-45b4950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "d9cb1d67-bc67-4288-843e-fc58b2bcef1c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-cec4-4ee8-991a-4ab0950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "1a3da186-1bbc-4a48-97b1-6440eca59723",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-d760-460a-af38-47a9950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "c216228a-4acb-47a3-8d5e-3f4a1beea28f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-5010-4ab3-93bb-4d11950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "733971a9-763b-4866-ae77-1700627e83cc",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-7724-4e48-bb08-49ca950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "f9aae507-1a91-4b11-aafd-2a42fbbc55b3",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-dce4-4376-a98c-494b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "a494e224-56b1-43cd-8678-60dff775e87c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-bc8c-4cf9-9ab2-4bbb950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "4efcbd17-7421-4e61-a49d-ad3da379ac93",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-1d40-4a97-b094-4ee1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "9ab8c8f5-6fa8-4f4a-a71b-3835066ce15c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-c968-4112-9815-4cfd950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "4f972a14-ad50-49dc-a95b-26939a450cb2",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2417-e27c-479c-9ff0-4007950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "dc0ed1b0-554c-41b1-98bb-de6a6bd8363c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2418-3fe8-4fc4-b47f-44a3950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "7d20a574-f708-4c7b-83a2-4b1e863e5034",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2418-53d8-41cd-ae66-4ffe950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
|
|
|
|
"referenced_uuid": "29ee112d-4c89-43d2-8ba2-eaceb48e47ea",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2418-17f4-4e55-b28c-41a4950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ada8a58a-c908-4ffa-8d32-9c3a262a9ad9",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2d0f41b9-1e64-44a8-beb4-059d8655576f",
|
|
|
|
|
"value": "4194708"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "434bba83-a363-428c-a8dd-74420f6e5dda",
|
|
|
|
|
"value": "x86_64"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9daf2bfa-0dac-4fd4-879b-ccf3eb12b15d",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "5bed9154-8045-4e40-8216-3eea3e83a258",
|
|
|
|
|
"value": "15"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
|
|
|
|
"referenced_uuid": "a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2418-6664-482e-948b-41d8950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
|
|
|
|
"referenced_uuid": "a2ea1f52-91be-4888-86e0-af75ed6a01b9",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2840-93e0-4efb-9f4b-481c02de0b81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
|
|
|
|
"referenced_uuid": "db87582d-4bc5-44e8-bb5c-692c0a1675b3",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c7068f6-25e4-47c0-969d-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "57a247a4-96c3-4ab0-ac62-4cb20fc2b7bf",
|
|
|
|
|
"value": "DEMON.x86"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "58ca72bb-6cde-4969-9036-20f6b5b6ad18",
|
|
|
|
|
"value": "90997"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d447b1bf-ee79-4551-ab1e-108ecd950a79",
|
|
|
|
|
"value": "5.883945324921"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "3f54e3fe-af6b-41ee-8281-368966269ec2",
|
|
|
|
|
"value": "5cc7a387d8a068459271572741ffeefd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "fea6c5c2-9859-45e6-beef-84a6ac6fd9ea",
|
|
|
|
|
"value": "929ddd0f6d45852e0037132b013eef2dc940df5e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5d67fab8-77d0-43ad-8a71-b54510606b30",
|
|
|
|
|
"value": "25eb40f52fbf71f729b4b7422e181e22ef19e38a461ce450446d47fa765cb153"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "3125a756-5801-4071-9737-cba52e96114f",
|
|
|
|
|
"value": "4a5f4b7990a6fa3ff5dbcc74eb021165ddaf58f90782adb9674d68db22d60ba0d2af2babae03e7184bc597dc57330946b99e48ac0edc83b7a9c1712b2f7f4841"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "18294b32-2e4c-4e0c-bcd3-c7ae23387959",
|
|
|
|
|
"value": "ELF 64-bit LSB executable, x86-64, version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "280e86f1-84ff-409e-8736-d6c36a97e708",
|
|
|
|
|
"value": "1536:tqdcFQuHZ91/0iiMsaURZoNbDLfacTmJ3d0pV7/mE7UucEPu0BXPS:tQcFQG1/0iiwURZEbnacT4d0D/mKUucz"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"uuid": "3c4ed87d-5198-4427-8fb2-cc8522bd9471",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "6a8b18aa-ec28-41e4-a486-855f9c2c9cba",
|
|
|
|
|
"value": "ftp1.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "bb0758f9-b110-4498-8e1c-d86856443401",
|
|
|
|
|
"value": "2334"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "8b5b44f9-f77f-436a-b26a-dc3ad710b05e",
|
|
|
|
|
"value": "4.878257245644"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "6cf86362-5127-4a43-8696-6b2f69a6d15c",
|
|
|
|
|
"value": "97eb8bc13daffaaf0c444d4cb4d79f51"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "23526195-6f56-4b48-9178-4de928fd0157",
|
|
|
|
|
"value": "76b8913a2bba18b12906dffb3ac9eb8f9086fab5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "39db550e-8ec3-4ffe-8d19-4889875fa4dd",
|
|
|
|
|
"value": "d01d29951368399f26ecc648a58dd2b673135d7c9e4f6d0a02892aaf0061cc1c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "0ff2e8d8-9c13-430a-8be6-75921aaded27",
|
|
|
|
|
"value": "35adbba5ad9435a0e653d2b005bb8418be099a7e17dbe6c1438d1eaf3fe4fca05150794824611363c625ef412b7191334eec603965c297faa767b6b2d4c5c023"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "7e1f1c25-1778-45e5-852e-4f6c73db71d3",
|
|
|
|
|
"value": "ASCII text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656588",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "303245fa-5da6-4aa2-8d7f-dd6e74c1fb0e",
|
|
|
|
|
"value": "24:cE56l2nNfKJM3kg0Q0e8NIBRzk00z0sW6W0GP9Nml+3nU+y8m:J4g0wgSTRzU1x0F6+3G"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656603",
|
|
|
|
|
"uuid": "11a24eda-644d-4f56-b930-c983aac96f18",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656603",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8ea85ea2-767f-4ebb-87fb-8dcaf0709147",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656603",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "e36e7845-3cd2-48fd-bbba-faaee523ea56",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656603",
|
|
|
|
|
"uuid": "bff723ef-9525-4a8d-bbcb-753601d37d1f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656603",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f796e98-01b5-4b24-aa75-63dc5ea007bd",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bdb6cbc6-9173-4102-9b97-91a088b06fee",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "fc7aae56-e157-4de3-8797-99cdca8e7785",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d39286e5-9650-4b31-ac27-a1c8d5013daf",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "57381266-3014-43eb-98a5-8e2ec3ace61f",
|
|
|
|
|
"value": "24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "aa0720c5-e838-4533-850a-dfadbf9dfdb4",
|
|
|
|
|
"value": "4.136842188131"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "bf1a8a81-e835-40ef-9096-8cf244db02a0",
|
|
|
|
|
"value": "b376fba4583df1cf6ac81c22437b8314"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "01e0334f-e3ff-4838-a33e-6c81a1131cf0",
|
|
|
|
|
"value": "bd17fbeddeb6968e5175f1e9bb9091395d83dc4e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "06c913fe-4fd6-467a-9103-d795ccbc41f3",
|
|
|
|
|
"value": "e53cf4123e45901504237a74da371c8004c7d3eda8c8fd84463000800f13ec6a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "fc309c8d-b698-4493-abf5-b40de15ec410",
|
|
|
|
|
"value": "5cc7a39e19afd74d9f20c486bbe69790118aca37a3cbd376eb94a17c3209e1cc32faa68c69febe1b1b2d7daa12bf7813dc907ae5eca12be3d106925610f42a64"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "357fe9ef-dd6b-437c-851b-60ba759c319b",
|
|
|
|
|
"value": "3:4FcMhZU1K+Mn:4+gq1Kz"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"uuid": "a49c56e4-b1e1-4a90-afc5-94f7685081b4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8761b170-b7a4-4bc0-a59c-4e02e1da0f06",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7c08fe3b-7dfa-4c1e-b4b5-2865914a76c7",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "56998982-c1b1-45ce-a440-7d71b799c469",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2bb95de8-007b-400e-bdb8-5692384da375",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "45024899-bd0f-4e34-8aca-33ea3f9aa62f",
|
|
|
|
|
"value": "57256"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4b23609d-7559-4571-872c-1f21ce38ed84",
|
|
|
|
|
"value": "5.8394386834036"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "54533351-42c4-4a86-ad67-2313e6904c5d",
|
|
|
|
|
"value": "5852a3062d2fd2f8e0a917b7658696a2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "201e00bf-e0b0-46bc-818c-487afdd16f66",
|
|
|
|
|
"value": "e4895043b923aa21dbbcd56f9c90da6179dfa79c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c74db223-17ea-4d69-9d41-20659967b051",
|
|
|
|
|
"value": "d3e811dfddb657b21a76d0929f9b7d69d2257c7e14742a13705d7e2221f4b066"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "acec6f40-3bd3-47d7-a30f-7192c88f77b4",
|
|
|
|
|
"value": "f1b92f77d29dfc574d8fa249313d5812f38495860f696b9fadb9f9f7248360b99805634fef067bce06a8728734356ced8abe32579b34195b9d0eb347b3a4e68c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "857ddf14-6d3d-4821-8fbd-e7d5cd4406dd",
|
|
|
|
|
"value": "768:pMksAduF9bB2PiJ+kemC7b3d5Me6pZwhMaFPM2Sq1KPVKXjrUuVCzZOSVzabSv/:uCoF1+LTPgek051yq1ggrUVzZOaxv/"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"uuid": "b0776b62-9478-444b-9c3c-c2a23fb56166",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f3fd6582-9081-497d-9860-7cb4e0db451a",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0c1272d5-67f7-460b-8432-b8d4850ca49c",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "88ae57c5-dcec-4d07-8b4d-b5b857687dff",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "40d8eb99-6102-4bf0-8e65-a588df55cbb9",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "60b7d75b-ea4e-44e5-bcfb-6dc9276b4eb4",
|
|
|
|
|
"value": "20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ed2f1c03-75bd-4e3d-8a17-f894c3eecd30",
|
|
|
|
|
"value": "4.1219280948874"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d45ce5fe-610e-4e03-8fe5-9f0c39384d0d",
|
|
|
|
|
"value": "4dcdd74dfb5b3a9b6432e2d3bccf9bf9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "229e26ca-09e0-48ec-a6af-d5e992801133",
|
|
|
|
|
"value": "26087fe3c86e143e04aed6f10c777cb1f92d92c4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0443eccc-9f91-46f6-b9b2-ecaa00121b99",
|
|
|
|
|
"value": "1ed59b58f97e7b87ade6ce7151167d0723c5217efed1b310948f3d908eb3a7f2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "9065fcfe-24f6-4e5a-a761-508fbc9bc209",
|
|
|
|
|
"value": "b2ef06c1096f966e581bfbb9da5939d57d98de923f2c4d1ac7cc85240965fcf16f3c83ac12a6d124ed9d44286ec1cbb073cff82d16ca0f94bcabbdb1cc30a429"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656604",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "3e687797-ea15-440b-89cf-07c4536af645",
|
|
|
|
|
"value": "3:4FcMh4aRn:4+g4aRn"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"uuid": "ecbfe0e5-1dc5-4622-8b31-9936022825a8",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ae5c0b5a-481b-4aff-a9ea-63b68fe6a82d",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7b293323-60bc-4ba3-b509-e5b091a81b8f",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0bd6d18d-0569-48c7-b7e4-45984dacb327",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "caf5893f-b86e-4e84-a622-20038e9aa16b",
|
|
|
|
|
"value": "7784"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "47fbf41e-2ece-4c76-8814-4d8b0e7e4693",
|
|
|
|
|
"value": "5.2632892424263"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "bfb4c4f4-43a5-4376-af0a-257599c81929",
|
|
|
|
|
"value": "a942180a7a94c475da9059f5fe46ace8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "728a1d54-a717-419a-9526-63e64dc89fa0",
|
|
|
|
|
"value": "ea72db677be8e79cf9b06e0cee1cbc15dd3208ba"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9377583b-0870-4838-8d8a-b8fc97659d2b",
|
|
|
|
|
"value": "858e5c9fba9870f69c8dbb7e38ef8f22df09e863b99b2554bb9393ba91949799"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "771e4fbe-88f8-41d7-ad12-cce39191a5e3",
|
|
|
|
|
"value": "bd886d1c24bae1c5c99923edea1781ce93649042d53ad4c7e7b186dd97a21b9132de18ff8ad33bb793a79d519ff273ee1f062774d83c0348b76bfb338be74cf3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "3430ca91-afff-4cd4-b334-5effc71b76f6",
|
|
|
|
|
"value": "96:r+fJUXGxBMHHVR8aQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpuEx7yWMl:uJ6HH8aEnlRum67bqlOVyQSWB3tuf"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637688",
|
|
|
|
|
"uuid": "88733aec-0db4-4ead-919d-7dcfe9a62add",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7fb74601-8d7c-44f3-a8a0-27707b7d22d7",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9194b9e1-c45c-456c-aad6-397d1446593d",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cd7dcf99-beaf-440a-badc-042be21fbb2d",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "152491d5-315e-411d-ae42-eda9361b1530",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "9ae9b27d-bf1f-4d75-83dc-aae237cf06b6",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637688",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "e7cd5aac-0332-4b78-aa64-7e314288da96",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637686",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1d83479a-a2a0-463c-af9b-34ae11d6d530",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637683",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6e5d6e29-8f7c-4849-b549-bbc02f71f1fa",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637681",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "de49758f-4c6d-4f70-a225-d44768f0ee7d",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637679",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "3a0b0ba0-38b0-4946-b683-0e8c16fa5630",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656605",
|
|
|
|
|
"uuid": "d0db047a-afca-43c5-bd64-7dffd0f35bb1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "36f74038-0940-49d4-85be-bab3fa2e7521",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "64ba8a9c-ec17-49fb-8d40-75bdac3c426f",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "568fb56b-6eee-4534-97d0-0423b2e176b6",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "79414da3-32db-447a-8576-baad4e36b568",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "280f9bbe-5db4-4567-b6be-b80a384ecc84",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "02f8f7f1-a3b4-4521-a0cd-ff6465e23389",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "d3564450-2d30-40f4-8022-ad5c804413c8",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "c708a0c2-8d7b-4aba-99ff-57329e4adf90",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "0ba7432f-85a0-437a-80f6-83264a68ed99",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "3032dda1-94df-4d4d-9e8e-14a8e7873072",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "287de044-c7de-4096-84a6-7000248b17fa",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"uuid": "69f51d30-c609-4518-9971-33891e74a22b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "076d1112-21c5-449e-b891-434881c0365b",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7c18a458-6cfe-4505-b35e-c70c0cfa72a0",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "121c9b8c-175e-46a3-bdb1-1b79dc7b0437",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1dd47322-770b-47e0-ba7f-9ca2662b10ca",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "bb3bd1d2-acd4-4988-a02f-a0db07f79d76",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "fcb17af6-c33c-401c-891e-4f5357362287",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "e21e757e-1ef0-457e-a11d-fc570dfa130c",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "41ebdf6d-ffc7-48a9-97e7-248dd285e55f",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "432afe99-24cc-4101-a67d-d864e6e4412c",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "11993d48-c7a0-4d6a-8491-461f6a85992c",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "3c9fb4b7-6aa4-438b-9d13-944c1790292f",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637675",
|
|
|
|
|
"uuid": "928e4d64-d370-4ab3-ad61-288a74833311",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656606",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3bda6dee-0625-4012-9e47-ce6611c7901e",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "38f7d993-9ad3-4464-bc38-37c531259900",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "85fe7f66-b2b9-4b39-ba68-d1bf8e97066a",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3de30297-0154-4511-8927-a2d167dfda9d",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d1d217f1-541a-4b56-8a66-3bcf3ca32209",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d56fa97b-733a-48bc-8e86-fdaaf927185a",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "6642fad2-ff77-4f88-960e-82eca4294c4c",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "a7976cc8-6615-44fe-9968-18f9c227964c",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "b7087e26-80bf-4476-9cf0-c8d9fa2b6398",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c2c4d86c-0aff-42aa-9b84-b5a4e9eca42c",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637665",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "4a4651a0-e416-4b02-8136-40debf7a4d5e",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"uuid": "0ff49c85-00fb-4092-99b7-c6e1b843f89f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "acc0642d-62a7-44b2-8a9e-b2297c978adb",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "60ac6046-d8f6-4641-9afa-f0e13616e1e8",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "15f5176f-1b94-4ca6-9642-37a87660c4e6",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5a9e98e8-b272-4031-9012-5effd0fc791d",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4c624c9f-c535-47ff-b66e-d996e2250ef5",
|
|
|
|
|
"value": "900"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b50f1cd7-16c0-4fe8-b759-28f01ef43c48",
|
|
|
|
|
"value": "2.5768685268986"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "35f11302-6db7-4703-ac4d-e2daff708d17",
|
|
|
|
|
"value": "a1b9a655df52fb2d4e8c0aff1b83c4aa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "7816ae87-7a66-475b-b58e-193718a6f4d7",
|
|
|
|
|
"value": "5cdecafb0503e97a5dcba5ede0fa65efd5137b6c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "470acada-9c3d-4838-a261-0a39628e204f",
|
|
|
|
|
"value": "e1bc0c8e6c9558f31d54b20218274cc98fc71545960c2fdb3040ebbf63697d97"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "13b18479-221e-40da-8114-4aaad89a19ce",
|
|
|
|
|
"value": "f5fde0e4784f98607422e93c08a48482d81a2d2f2e91f6ba0eacc1b1a89ab1d03caf7a591dc0deaa10559857daf6685b9fc9bdb76362b7e8b9ea44e9e2017b2b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "94b03c68-95e4-4689-899e-ef5a65bbcb70",
|
|
|
|
|
"value": "12:vnEUv/fnjjLiyCk6EFrEWybSvOH/YJwtk/:vB3jjLeWrEWL7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"uuid": "7343fd4a-fcd7-4dd8-959b-7e502301d511",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cd3c5301-5e09-4616-a9e4-375cef7e1dd6",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cc74e4c6-88b8-4477-a08d-404f66fb45f9",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b390ce8b-f5f0-4273-9768-bedf12dbe6c6",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d9f130b8-1aa9-4c9f-a045-3ad06a5218ff",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656607",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d87a00f0-7a1e-4de7-b2d0-4913671ed9b2",
|
|
|
|
|
"value": "25428"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "79f60eb2-82b6-4251-a4de-139f398ab42f",
|
|
|
|
|
"value": "4.3553697898795"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "bc7506d2-1de2-430c-b197-88b2cb9092b3",
|
|
|
|
|
"value": "16e91875abc831cd719470372f9f602a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "6fc5db10-bbfc-4639-bd90-cb99f57dbbd9",
|
|
|
|
|
"value": "a57a0c322c8b8718adf00ad55367bf7244d470f8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8c9082ef-622e-4bae-8add-fe066c2facf3",
|
|
|
|
|
"value": "e20af18f77141d1038a6cef48b4ce7df5984fe7be8a3f2c9b43e6d5f83832ad9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f620329c-6fb5-4f28-8880-6c30180a6114",
|
|
|
|
|
"value": "8c5a628c473b4812b20d39669440d228198cd50faa1cdcbbf6a670c7a4f175b786bd91567c0d6fcf520e53cf35bb958ed43717830f904a3b86081d3ea23b4bff"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "8cc09bcd-a7d8-4349-aeb7-1be2a7a369c1",
|
|
|
|
|
"value": "384:Z3Sws3WxJ+rvo+M+d+ETo2h9Ce4/T5IUAo0h6zvNoRojOZWuAUoAKTB4sJ2NrioH:Z3irBtkKlPAr5F0h6TYfKTBor7"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"uuid": "055a24f0-2875-45f3-a7ed-4a44945d23d2",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "aade4675-cd50-42e5-88c1-20772a8f0ea4",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "62f13332-f62f-4e54-8bff-c48139fcedca",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a8356bb7-c1f7-4085-9fd4-65b344d3973a",
|
|
|
|
|
"value": "2920"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "bdaee407-978f-4ad0-9262-b1a1a4fcaa6d",
|
|
|
|
|
"value": "3.7316466793579"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f24f1469-8403-492c-bd07-3a92c62c738a",
|
|
|
|
|
"value": "02eaba63128184570a4bdfcd8c29d929"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "dfd870c0-7b57-4de2-b076-ba96326373cd",
|
|
|
|
|
"value": "9f8b551a43fcd110a2e5eeaf4c613ccb928351b8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5ac70a88-ad4d-44bc-87d8-3906bad68307",
|
|
|
|
|
"value": "cb592889f9a91adb49129a3bbcb3492c6e81b51da830e5da936e0e00998b47e7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "bbcd6265-c19e-41c7-8b91-1cee93475f49",
|
|
|
|
|
"value": "98dff98a2e5e0c016ac00b0d0054d555ae5801b995bbbaa0f22ebb5fa7d6b9577ace852ef7b9b1097a411000d2dd272a233d517c6822167745fb091befc4d40c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "b6207c62-c673-44fd-af4f-02efc7bf350f",
|
|
|
|
|
"value": "48:BVCEoUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU7:fRNRw"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"uuid": "4788fcc5-b819-409f-a970-8e3fef7d57f1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "876d05b3-7e97-46ed-9674-e9b801921d64",
|
|
|
|
|
"value": ".debug_aranges"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b87d4a87-8f88-45b9-add1-b8da900bd96e",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ea630f63-43ff-4977-a271-f5dbfe97b134",
|
|
|
|
|
"value": "288"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "99603f4f-32f0-41de-9aaf-e9fb372b1e09",
|
|
|
|
|
"value": "2.0203931890935"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "7ab31c49-31c3-42ba-ac7f-b3a0366ffaea",
|
|
|
|
|
"value": "175057ec23e2dfc23a01800a8eb66a03"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "57f13cf1-f063-47f0-be70-af823999a945",
|
|
|
|
|
"value": "d48624577124805a8136c14f90f21a52993c97d3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "18d09856-04a9-4ee0-94bb-5986af068a12",
|
|
|
|
|
"value": "7dc2b7cdfa6373f02ccf0f5d68dfe69d0f62865f53de2ef5c7c542a3b1c19942"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c2993534-12ae-4f81-8063-25bb6cb6b26e",
|
|
|
|
|
"value": "392e9ff148fc7b5294a03569cb4724710983c02545cf9e6ccfbb276a3cd8dc379c44bf5d2cf8b24a31c544d3a732545e7735d512a37b8ffaa4a3c9b01dbc8964"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "8d9efc6f-d005-40c6-b85a-16a82a353d44",
|
|
|
|
|
"value": "3:Ll/5lNlxl7Ltld1ltzlmpXlhw/ptzlipltlNJ7tlllhlNlrlRVxlI5lRRLtll7lb:Wpkx2pXMTvqt0meL/"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656608",
|
|
|
|
|
"uuid": "e13cf509-faaa-4fa2-8905-57403bcd10b0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "05a48874-b3eb-4d4e-91a7-29f45e392289",
|
|
|
|
|
"value": ".debug_info"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "efcde5aa-cd78-47f8-8697-d280ce3352d0",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "7ba26ca0-f6be-432b-98ce-fad2db12906b",
|
|
|
|
|
"value": "1400"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "0ac33ac2-a6f2-4175-9b14-269a210e0ab8",
|
|
|
|
|
"value": "4.9900825086808"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "849e27ed-1cfe-4255-9ccb-de89c7688669",
|
|
|
|
|
"value": "7e108f958296c7356902a9ae487a67e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "36bda3bc-4047-4d50-8c4c-3837930b3944",
|
|
|
|
|
"value": "a6e0f8dfa36d511773d5976482d07419adf5479f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "a18c39d2-7f27-4456-a35e-8172cfbce3e6",
|
|
|
|
|
"value": "ac5fae4e1b089faead8cf7cba0ffc8422f45521e59d9d45b6b93fcbe1e2254f8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "15b4dfb7-99c8-4d39-b2f0-56a01e5a6190",
|
|
|
|
|
"value": "ed07500f48ca0e185180d1a1d2743b576e46b4e119bd20e0bb942060b177838a4453fb99bb386b8fa134218c195eeb41718587972522680c19dd20ef55cb628a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "bb898a0e-0dc5-443b-8e21-3d53c01cf62a",
|
|
|
|
|
"value": "24:9B0KQIBtMxsB0KQIBt4B0KQIBtlB0KQIBtMB0KQIBtNB0KQH1CTBt1aTB0KQH1Cq:9zLMGzL4zLlzLMzLNsATLSsATLesATLP"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"uuid": "fa037f31-83f9-48a6-a6b6-d705198c4000",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9c6a000f-929e-4c36-a0e3-f5e64a6d3880",
|
|
|
|
|
"value": ".debug_abbrev"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f5ca1ce9-f7ad-4874-a2b3-d68dfa2338cb",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "3bc70b46-950b-4687-a6a8-6e8d7cc1276b",
|
|
|
|
|
"value": "180"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "e53bf730-0723-458a-b6be-6a8413edcbdb",
|
|
|
|
|
"value": "3.346439344671"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "90dd3206-bdd6-40fc-8ffe-67c502603329",
|
|
|
|
|
"value": "9c73dbc21d64061426888668129808b5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "665d0102-b224-406f-b5d3-9cb8d094ee57",
|
|
|
|
|
"value": "ca3a3f3d7cc917b499c7bc57495c2ee1ede15afa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ec1af63b-4fd9-4aaf-bd2b-f657688c27c4",
|
|
|
|
|
"value": "f578d4fcbb990c569f82fbbc14d0f3e657a90eeb70736da6f19a6c5c6797e305"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "770ac65c-d8d1-4687-97e0-8d8b4df4150b",
|
|
|
|
|
"value": "0d033ea0503ae5eacf60c84e7b7ded5740871f166a1e1d88cfce29de3b68f95b4d876edd473cd7dae4da3140a74144e15edc1e5fca532aaff4f781f586fa8c2d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "8977bc6d-089b-474b-b246-30efbb8a5d7b",
|
|
|
|
|
"value": "3:PU1utPU1utPU1utPU1utPU1utPU1utPU1utPU1utPU1utn:Pk6Pk6Pk6Pk6Pk6Pk6Pk6Pk6Pk6n"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"uuid": "c4856c35-6cb0-42bf-a9f3-d3ce5619e33c",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "38a37ccf-7028-4385-aab3-e50c09d5645e",
|
|
|
|
|
"value": ".debug_line"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "239e2da2-0b18-4e9a-a564-421b54d3d5a5",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4879014d-0a74-4cc5-91ae-5c23ad929640",
|
|
|
|
|
"value": "2237"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "cc4fd0a6-c5fe-491c-9995-4ccabae4bd48",
|
|
|
|
|
"value": "4.6270747071739"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "a411d794-ae04-455a-bb72-f93377cc0a0c",
|
|
|
|
|
"value": "2d1d5a1397c4afe8171434844af3d92d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "75be8990-ad9d-4780-b580-96f3e532c99b",
|
|
|
|
|
"value": "f1c0ceb62911615aa9b87c827731e8d54d0f728e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656609",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6f2fb594-2114-4269-8475-0b186b2e064d",
|
|
|
|
|
"value": "b5c51c639542c8ea6beea8d708393e86de6dcaac09b530372c0872acee469767"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "58bf6dff-a61d-47f7-8060-3245aa3e3b76",
|
|
|
|
|
"value": "f004cdeb2f51ff0d5077dad3f563e0f04c35c3d57f79de1c11fe74e42cbada3d894108c3887189ad09f22bd2ee6b57b72fed3408dadfaef9df8e167b3e2b3318"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "3485b58e-84bf-4b2a-aa50-64ae091f7a00",
|
|
|
|
|
"value": "48:FOI9U3JFyBRo567A+PlJvhF7A+i4m+7A+K37A+o:wRJFyBRO67A+rvz7A+37A+K37A+o"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"uuid": "ef892eee-4947-4c5c-b2dc-02c4e857d362",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e537decc-9046-47bd-aa09-9c5c009fb65d",
|
|
|
|
|
"value": ".debug_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "92c3f210-8961-482c-855a-7dfdf0af33c4",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "f81f7295-f105-4836-a715-5af4350ea7ed",
|
|
|
|
|
"value": "160"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ef043340-e276-4640-abb2-605b3341676a",
|
|
|
|
|
"value": "3.3172090733526"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "78f9bb02-c721-402a-b08d-c494c0c3e75a",
|
|
|
|
|
"value": "55f5653b7f77adf1565329b1c8aadbd4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "681765cc-f806-449a-a280-309a5fd3abf8",
|
|
|
|
|
"value": "ac5a62ddeab1947ae93554d61613d098b4b759f0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "75945b73-d565-458f-8775-ef36cc0fd609",
|
|
|
|
|
"value": "d093cc4f1fc52ee07aede570d3884e55082570707c4fa228beabeee3d154ed73"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "e61e0efc-6fda-4c63-bfa4-9ffba48bbbc6",
|
|
|
|
|
"value": "74b5e4d3b3d0a7a22c88fc37d4d5f77471c7690ed020990118a715907eb388d61241235722010134b9376e1e592fdb0b21ff142bdd529e117c9b1086590eed66"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "742c504d-37ca-436f-9350-aa823239e36a",
|
|
|
|
|
"value": "3:NRCxajlpRCxXHxzlthlpRCxNSlp1hlpRCxJt7:nJCFT9Qp"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"uuid": "07ea2ef7-9551-4312-9f4d-c35eb8644384",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "de507fc0-6b95-466d-8401-aa52376abfc6",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5af5f200-e4da-4a67-a39c-ad1bc76221c1",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "cdab58b7-d56b-43d0-968f-a7925b9c832c",
|
|
|
|
|
"value": "168"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "dea549be-030e-4326-a051-62f0673109eb",
|
|
|
|
|
"value": "4.1672851010934"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "84f42a01-af93-4da2-95f8-a1669895d579",
|
|
|
|
|
"value": "3c77484bd9a7a5025d604b50bcf6d0e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "dede0cbe-c97c-4e34-a970-1795a3f95720",
|
|
|
|
|
"value": "219c22469be20c3183270f148c6866c569955439"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "10e08756-98d1-48ca-85b0-d9505f7fb6a4",
|
|
|
|
|
"value": "07254bdbc45884f0dec220bd72d26adbf2ee1e7ce515b19ecea11e14505ef01c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "abab6286-afb8-481e-8f3d-cacd7eba2335",
|
|
|
|
|
"value": "71117837c8e3be5e401448ea31a16c289428e920d9dee5cae7e1ddb0ed32790e6581c8a02aee7292b014ab327c95f5c6f5a95c62213104956e4d246553d1757e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e094d38c-5c69-4a26-8835-42102111020b",
|
|
|
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+K2iLTpeWnz/mI9l1AHQVhA:EXwWEgMF84MFTnfniLTpttHKwVhA"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"uuid": "3655f618-c369-48cd-ac03-09c998b3d4df",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "eef1c226-a880-4cd5-afd6-5ff48f99de44",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0dee0951-7869-46c6-a433-ac5cd34beb0e",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "27e09af7-397c-4a2a-b6a8-ced66da2729c",
|
|
|
|
|
"value": "17856"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "cf45333e-decf-441f-9f76-a225cfdd1c0f",
|
|
|
|
|
"value": "3.4286023008418"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f1c73fab-ecaa-46e9-8528-161b317eebb1",
|
|
|
|
|
"value": "11356a4abdc60cc61670361c939d1e4d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656610",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "935932f2-f45a-4ea4-908c-4ee869cb7e6a",
|
|
|
|
|
"value": "c6dd23ebb06d7b48dad82914ac9431afcec97138"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ec4d7029-97be-4a97-a2ac-691be40e4bf7",
|
|
|
|
|
"value": "46cad2ced552c35a8eaea1232a4d07062a6db95e3ed29b7626155caf119b16a5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "843a83f4-573c-4acf-827a-be240ad7e7de",
|
|
|
|
|
"value": "3e350a87f74d12c2da195f93c41334cfdaeab5d3b15b04f8939a97187b429c2b671bbadfce81b3a3a0691fceabb6f48f10f5e0e25419315d31dc4dc731ca865a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "10be0efd-ad23-4bc7-a7b3-810ffc5d37c2",
|
|
|
|
|
"value": "384:22h9Ce4/T5IUAo0h6zvNoRojOZWuAUoAKTB4sJ2NriostJ:XPAr5F0h6TYfKTBorOJ"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"uuid": "3028e64b-ce69-4bb7-9130-bf908c6d8a71",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ed6538d8-3520-4f6e-a1b3-c109bf43921b",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ede6cc24-839a-4d48-8cfd-cedacb2869ac",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "b8188763-9ab2-4fae-90b4-90dcdc136920",
|
|
|
|
|
"value": "9510"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b1611a3b-c589-42a1-914d-87e46004838c",
|
|
|
|
|
"value": "4.6139060113974"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "ab5129a1-aae1-4f21-a415-4b5b7d82e6cd",
|
|
|
|
|
"value": "7b6d2237526494b855fb5427b0d82a68"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "dcd95b1c-594e-434b-aaca-7ac5e769b3b1",
|
|
|
|
|
"value": "8e2c8145757decce58ea4d0df130f25e71430ed6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c92a249a-5d7d-4a6b-b780-f99df34d5c70",
|
|
|
|
|
"value": "c89b6c2c6072ef8d4d0bb4e6966a2690c5f09f6ea85f158cf027faf9ed594ca1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "7482495d-181b-4626-a990-0160d8eb8c92",
|
|
|
|
|
"value": "5fa22ebddb08400cfcfe10ee8ba3273a838902a58fce187316301bdd890ab85e869b52ed6645eeb70c7a1721b243a6e2bf24cbade850a26f09ce19647f7dcc40"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "94045651-f42c-47c7-ab94-4d084e97c3c8",
|
|
|
|
|
"value": "192:pRdc7IyvCfXMtivDIQXZxwmX8V+5s4v9AMrQFU0NXYx9XtLBln4PPHhDLqIUtJuS:pRdc7IyeMiDIQpmmX8V+5Hv3rQu0FY7d"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656613",
|
|
|
|
|
"uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "11a24eda-644d-4f56-b930-c983aac96f18",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-2c64-45c9-94d2-4b77950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "bff723ef-9525-4a8d-bbcb-753601d37d1f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-4b48-4aae-bf3f-4363950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "a49c56e4-b1e1-4a90-afc5-94f7685081b4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-ade8-4ec8-8ff2-410f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "b0776b62-9478-444b-9c3c-c2a23fb56166",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-7e94-43c6-85d3-4066950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "ecbfe0e5-1dc5-4622-8b31-9936022825a8",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-a550-4979-af0d-40b6950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "88733aec-0db4-4ead-919d-7dcfe9a62add",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-c79c-4ff8-8a26-4b1f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "d0db047a-afca-43c5-bd64-7dffd0f35bb1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-b068-4244-82cd-4a82950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "69f51d30-c609-4518-9971-33891e74a22b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-df4c-4ba4-8830-449e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "928e4d64-d370-4ab3-ad61-288a74833311",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-8fa0-4b9f-80c5-4fe8950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "0ff49c85-00fb-4092-99b7-c6e1b843f89f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-1c34-42a1-8ec4-4ac8950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "7343fd4a-fcd7-4dd8-959b-7e502301d511",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-77bc-4a74-a052-4312950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "055a24f0-2875-45f3-a7ed-4a44945d23d2",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-b988-4212-a59a-4ba1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "4788fcc5-b819-409f-a970-8e3fef7d57f1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2464-0558-45fd-b80e-4e2c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "e13cf509-faaa-4fa2-8905-57403bcd10b0",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2465-0f3c-44ea-a787-460e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "fa037f31-83f9-48a6-a6b6-d705198c4000",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2465-d1c0-47f4-a473-4884950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "c4856c35-6cb0-42bf-a9f3-d3ce5619e33c",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2465-c438-44e5-89e1-4c2e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 16 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "ef892eee-4947-4c5c-b2dc-02c4e857d362",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2465-e3d8-4438-a8da-426a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 17 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "07ea2ef7-9551-4312-9f4d-c35eb8644384",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037664",
|
|
|
|
|
"uuid": "5c6d2465-dda0-472d-b8ab-4156950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 18 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "3655f618-c369-48cd-ac03-09c998b3d4df",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d2465-519c-48ac-a8ff-4066950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 19 of ELF",
|
|
|
|
|
"object_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
|
|
|
|
"referenced_uuid": "3028e64b-ce69-4bb7-9130-bf908c6d8a71",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d2465-7cb0-4f7a-877f-43f8950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f5c9cb33-3909-4e03-9066-f97223a5fdf9",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4d1dad8f-2ce3-431b-9ec0-cfc565b93ab1",
|
|
|
|
|
"value": "33168"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d8dede18-094b-4b77-ac0b-f094c808cb75",
|
|
|
|
|
"value": "ARM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3ea8a77d-fe3c-4f20-a1a1-adcb0693c853",
|
|
|
|
|
"value": "ARM"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "cdf5430c-6f40-4d43-8163-dba1eb00cc63",
|
|
|
|
|
"value": "20"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550656613",
|
|
|
|
|
"uuid": "145938cf-4945-41a3-9bf2-5faacbf1f366",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "145938cf-4945-41a3-9bf2-5faacbf1f366",
|
|
|
|
|
"referenced_uuid": "571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d2465-7b24-4ffb-914e-428e950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "6b0c843e-2c3d-4084-8312-c2f3c30a35f9",
|
|
|
|
|
"value": "nut"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "58d06112-67af-40d8-bf4c-397c388dc6d7",
|
|
|
|
|
"value": "101978"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "d2864b4e-cf8c-4178-a091-aeddf0367165",
|
|
|
|
|
"value": "5.8927938176398"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "8ef9238f-d76b-4e6c-9f45-4d5dfa1b63f3",
|
|
|
|
|
"value": "1fb4305cbe1501aa2a8d1c500a0ab6d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "d7796b0c-813c-4411-9ab4-2d9927bb27d0",
|
|
|
|
|
"value": "6626d4541d58e81eb0aff4e5044a896d9c98130d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "15d3ec92-135b-473e-9604-9b9a1a2f835d",
|
|
|
|
|
"value": "1719b06c8160ae50e89a6939acab5906a7e1e0ef409d8976fcd88a040396860c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c3c31fa5-f61a-4273-bb3b-13ba92df14e2",
|
|
|
|
|
"value": "ec35e4435c11cca47760a7a4381f861f00b9ef6327bb5b66b0efe16d35b544d87d47d2a2694421284e46449ae66f5736c75e43263429d21b09964adf32fcd6be"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "b36a8075-9c3e-4416-8ca2-ab6c3a049394",
|
|
|
|
|
"value": "ELF 32-bit LSB executable, ARM, version 1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656611",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "1252d219-b7f7-4066-9fb8-b3ad0cc2aa44",
|
|
|
|
|
"value": "3072:E+PgenIVtf93klPuF0h4cmlfrQu0yMPsqS:9gBVtf93kYcmlfrQu0yMPsqS"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"uuid": "e35ab664-d370-4925-a464-f43cc09ca4ad",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2a55d6c7-70aa-495a-a773-b5edca5c0e43",
|
|
|
|
|
"value": "NULL"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "330304af-090f-4ed1-9792-c258f554f947",
|
|
|
|
|
"value": "0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"uuid": "140ed95e-052e-402d-abe2-4216654b44e0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2f0594c8-0d45-4627-862e-fb7ba52a341a",
|
|
|
|
|
"value": ".init"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "62d84791-cca4-4c3f-b2bb-7796efbf2833",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ea9aa717-3754-48fa-8ff4-fb26ed8c2686",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "698896da-2ddc-4e9c-be60-b3987d340ca5",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "6eed29d7-5b43-411f-b320-5faaf0bdca77",
|
|
|
|
|
"value": "28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3d36d3a6-e827-4b63-8b88-0940e92299e2",
|
|
|
|
|
"value": "3.2340067861644"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "407093ae-e62f-4cad-b2f3-3d85669d19b4",
|
|
|
|
|
"value": "193cc5332b8e91293d228735f364d1ce"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f33d2c86-529c-4aff-933f-d3e54f9e2693",
|
|
|
|
|
"value": "cf36e501c254068d780cfc7f8a567cbc38ed0aea"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "a4cd2420-4541-47b6-800e-53f8c99e1c1c",
|
|
|
|
|
"value": "0df99d413c94ea0ff0cd40d02d38debd07ed372f124532267a9a6f5cff0ee5fc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "2eb2f4d5-fba7-42fb-ac68-47ff272c2aa1",
|
|
|
|
|
"value": "482cd453ecf0d1b1279515924fa9bc233e64aaa6a93ce00ff8900e859ecfe59df4829b97e0884193ee050f75d9eda68507d82a485702af813e648e89ac07857a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "69227f1d-bded-45d2-8bf2-96d9d10aefe2",
|
|
|
|
|
"value": "3:uH/YItkNll:2/9tMl"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"uuid": "6cc47bbf-9bdd-4a5f-bf98-5cc516bbf0cb",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6a742ec5-c075-47a7-8fa0-ccbeeefa7326",
|
|
|
|
|
"value": ".text"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f4d62f49-d10f-4461-ac9c-563c3a388f35",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "45c74ac8-5170-40d4-9ad5-1a6bd2b3674d",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "07a80089-568e-4df6-8788-1e5ead94ff27",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ad198b3a-fdcf-42ef-a50e-c02900c91f1c",
|
|
|
|
|
"value": "65220"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "b682b242-f67d-4e35-b239-c7fcb73a4963",
|
|
|
|
|
"value": "5.7721838744485"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c8b17c7-5454-4d3c-addb-ba4534702730",
|
|
|
|
|
"value": "8d611795e6daee6c5030fc23c34e0381"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "7e02f434-dfd2-4256-a050-f8503c7b4e30",
|
|
|
|
|
"value": "f886a71eb41e74e3ec72ea5cdb96e6f1c42ef908"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "fe94b41c-1acf-4aa5-9296-8178bbf2bd85",
|
|
|
|
|
"value": "b2962da3a7b5d00371a7fa30f2fb2bc745e57418f5ebea815c0c134ebbb56ca4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "1d886cb4-d5c0-452c-839e-11bbee11c6d2",
|
|
|
|
|
"value": "e27d06138420921e0047f20e001273a2437aec9231d27673c0375cc415d154e79846adf938cc42f2986ab1f872402b9e02d332b8a06c39dcc2bcaec9a0b5c570"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ffab9652-e8e0-4807-93e4-a6a18ca3c6ed",
|
|
|
|
|
"value": "768:9EjFC1CYAsCx+Se+tq959+l66ePytaa1oN6O+N95VELJXtkSRNe1tB4rDYAJd:O4A3+Setwt99N95at8tBwJd"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656667",
|
|
|
|
|
"uuid": "69ed74d7-a7b4-4a25-8067-14b425cdfb18",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "144ef222-e28b-436d-b73b-f725a0d98ff2",
|
|
|
|
|
"value": ".fini"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f846928-4478-4b01-82a2-4cf7e2a1d74d",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9e41ec1a-e258-40c5-beb9-037a6a740dff",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ddf4d3bd-3ee4-400f-8b04-57b2dfd2cb05",
|
|
|
|
|
"value": "EXECINSTR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "efc40e43-1bdc-4020-bcfe-3536d3501a5f",
|
|
|
|
|
"value": "20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "3ecef2e4-d0ac-402a-b2bf-e988cc04b677",
|
|
|
|
|
"value": "3.6414460711655"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "6d10bb42-1a81-4699-b670-892b4f49ad42",
|
|
|
|
|
"value": "d7d1ff1d2c473eba73ee6176cd79bc58"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "bf4b0cd0-1bea-45f5-aefa-4fb6de75ba50",
|
|
|
|
|
"value": "3ef633e4fd04cd312144aa1ef752f5048cc5e3f5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "fb28c888-d25a-4fad-8d85-16b2adacf94c",
|
|
|
|
|
"value": "eaff49b6b867e473cdef591176cf3c27153a3dff0b6df9e467f8a980d2e44314"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c8adc2df-3e6f-4587-8a31-d8fc6e9a0c79",
|
|
|
|
|
"value": "126227154a2c8e10481c97ae861aba5e07574234f7673dbe6807eb45259ddb5fa0cd231163dd007d2724c10993bc498001d87809606b8e8ce3ec51c31ed5c56f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "16efe355-4d4d-47f0-87b9-009c33d0eda2",
|
|
|
|
|
"value": "3:u4ksllkmtkNll:nlkmtMl"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"uuid": "7bd7974f-8307-46b8-b3c4-e4eb88ccd02d",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6f4b7206-77cc-484a-8bff-8c66b414862c",
|
|
|
|
|
"value": ".rodata"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "25c7ceb3-571e-4f66-98fa-ed541caebcb5",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "187d9011-42a1-4f2e-92b0-5093a767dfe6",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a5b4f241-006b-495e-8c3d-b6b1a86905fa",
|
|
|
|
|
"value": "8152"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "594fc2e9-47e7-4e39-8103-2b0554dda885",
|
|
|
|
|
"value": "5.2443741656501"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "f30de439-3517-4a6a-b3ed-3e9a08575f15",
|
|
|
|
|
"value": "4256f7d8d727db036cb97a3ceae74f52"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "51ec8123-42af-4f67-b274-90d112274b9c",
|
|
|
|
|
"value": "f82fea318bb42513d82480656d64a6d4e08710c9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "077619e5-f00f-41c6-8f20-506a34ae0aa7",
|
|
|
|
|
"value": "9ea77618a4b19976d5e96617269ac0ba3f4f3a6d5e65b0772b15a41082b95315"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5c4ccbac-0c3d-4c09-a1f6-a8a8c810c1cf",
|
|
|
|
|
"value": "d2fedcb6567647b6eccba63b3ed62b5d4cd01bfdc2ad0bbea77c338dbef9d5092f51446b848540d88b4a8829831477c762acc9220aeadc2c484fc604cee671f9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "b6ed9198-4117-4e64-9ba3-dc7c9c26e2b1",
|
|
|
|
|
"value": "96:TPKYnWxgZHHxhKb1aQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fp+VVyNZn:TP3HLKhaEnlRum67bqlOVyQSWB3nP"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637660",
|
|
|
|
|
"uuid": "baa88f1e-d75e-4a25-83ad-70258c54cc5b",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d4f830ea-0755-44df-91ac-8b92fecdf597",
|
|
|
|
|
"value": ".eh_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "16269205-8d28-4693-a434-b183c6af6b79",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b8875945-0f16-40bd-9cc3-b9552bae20b6",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "23ef22e3-54f5-4ff4-b701-9d9ea2a98e4b",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656668",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ea75cb31-458b-4b45-bf10-d4263e9dc3e6",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637660",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "92212c85-b358-4edd-b381-9285478b710a",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637657",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "938189f7-23dd-4370-a8ad-b42681cf9eaa",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637655",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "dbed2308-3772-4657-ae8f-afeff5315b95",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637653",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "ca1be6fe-6b80-4519-8415-192a626a4ab5",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637649",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "d187a2c5-9980-4fab-87e1-ea24299ffe91",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"uuid": "77aa1ec5-ea18-40f8-823e-a7595a9fe702",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cbc66cf5-07a4-4caa-8eef-1a02ad8149a5",
|
|
|
|
|
"value": ".ctors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5a0d21ab-004a-4910-bb11-232344eab238",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b6abae48-224c-4137-b57f-7a763d5e7f66",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "1a7fb25e-a852-48a5-84e2-6d167de2b80f",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "20444453-8aee-4a5c-a938-32ae210392bc",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "8aa9a2db-d590-4dee-8863-15b58cd3b705",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b9a923a2-9468-45d1-8f09-d05e26480eb0",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "942d2f52-ef8f-4fd2-a107-2f7419d90dd1",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "b656afa8-82b8-4971-9574-aaafabde5fab",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "7fe24319-fcb1-4641-9ecf-723c2d8817ae",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "1c5e75dd-d6f1-48cb-b5c8-fe49e6487da9",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"uuid": "310046fc-01e4-41d2-86a5-f515ca712b2a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c6207888-c36b-4253-86a3-abb3aa005ade",
|
|
|
|
|
"value": ".dtors"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4e76e3bb-d7d1-4b1b-ba38-f5828d992a15",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "816eb03e-93f4-4850-997a-f04deb664174",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8ff71dc0-bb1d-4441-9035-13d819ed3383",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "ff761011-ef53-418d-89b5-709b90a72359",
|
|
|
|
|
"value": "8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "966ff7cf-96b9-495e-8c8e-9fb0a6e346c2",
|
|
|
|
|
"value": "1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "b6919418-d133-419e-a168-5efc8b43b7e8",
|
|
|
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "4fcfdc33-3c8e-4c66-8592-1263f587c513",
|
|
|
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "3e5f99a5-9ad8-45bb-8183-4934e00fc64e",
|
|
|
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d088ee61-18ba-4cdc-8e41-c73602332648",
|
|
|
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "5e6dc2b5-afd7-4766-959f-0d8c6a7fa3f8",
|
|
|
|
|
"value": "3:RRtl:LX"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637644",
|
|
|
|
|
"uuid": "37c15adf-ea19-4531-8ab2-7adb7442b7e3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656669",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bba06d3e-c21f-4382-8942-2eb4f61a1275",
|
|
|
|
|
"value": ".jcr"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c78e72cf-9af7-4493-ac57-db0d27aad7dd",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "70b15ce5-20d1-4317-9adc-ec0c00de4c5a",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0d79dd4b-6060-496f-beb4-90756f2a61e9",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "fa0aad84-cb39-45ce-b5fa-87bedc3b58df",
|
|
|
|
|
"value": "4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "709cb8fc-501d-4def-9b11-fa47abe6746a",
|
|
|
|
|
"value": "0.0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637632",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "dda24e0a-7fab-4a25-9713-fe8db41a106d",
|
|
|
|
|
"value": "f1d3ff8443297732862df21dc4e57262"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637635",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9a825c14-09b2-4d78-aff2-32c5ea53da78",
|
|
|
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637637",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f10a09a2-73bb-4b14-be56-e758f5e78761",
|
|
|
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637640",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f8f7eaad-5d40-4927-af96-dc02e7632e93",
|
|
|
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613637644",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "b7acb906-ba2f-42a4-8eac-57d90fbae1ac",
|
|
|
|
|
"value": "3::"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"uuid": "47a5cfb3-b3d8-4372-b682-a0192c36d11a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "91a57495-72ee-44cb-8fd4-5264772a16b7",
|
|
|
|
|
"value": ".data"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ba2e4f00-c5de-498c-9628-c76c3f91cec1",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "952bc5a1-3bf2-4a76-8ee3-0fc2f37c954e",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "89b58e0c-9e38-4407-92b4-217e55f9c7f8",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "9000d642-50f3-4d8e-9011-2d4ca94b2686",
|
|
|
|
|
"value": "900"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "1758161b-5dd1-48b1-9825-add3781a6eea",
|
|
|
|
|
"value": "2.6586127783524"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "09a5cbd8-58b9-4dec-837a-d3b03d48a716",
|
|
|
|
|
"value": "6a308869c392d2f412f5e23055dc9d90"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "7b13baf1-bb19-46ce-a7c2-10c29b38f541",
|
|
|
|
|
"value": "b4ac606de36ef4eca2087a5a2f234d4352da65ae"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "9fd02e81-a7e2-42ff-9203-dee8295a79fc",
|
|
|
|
|
"value": "94f1ceceb912ea6fcf3b28ee7605487f174d99d6638c9efe38f8c5517cb51c9b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "ab365e22-e10a-40c9-896f-e2a38848804e",
|
|
|
|
|
"value": "ef7e65d49d9b5f090a10541ded37ff5f39078877b9a90cc69bc6d0ddd1bd62a12e28e3ab0829fd5e85d849ae2366d69ce5fcff245b8ba0246db77db747443df9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "8d068d91-25c2-4d9b-ab0c-002a675f8ffe",
|
|
|
|
|
"value": "12:e/cG+/fdUEkJXJHryygySgjIIuL8Gh6PYxpGS6lU7t8E6I:e/cJ/fd0J1g6jDuLXh6/JO"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"uuid": "5a72317a-eb57-4df5-affc-4f4db6de49de",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "36ec14f3-bbab-4195-8e7c-29a4bd8d8d0b",
|
|
|
|
|
"value": ".bss"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "0756a668-1a58-426b-af17-3eb3e4a48e61",
|
|
|
|
|
"value": "NOBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f78a4800-c632-4c0a-b3ae-c3a645803c92",
|
|
|
|
|
"value": "WRITE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4b45c89c-e7ff-4c75-9222-29469f75e93c",
|
|
|
|
|
"value": "ALLOC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "572cd9ba-252e-41d5-94ad-cadca370789e",
|
|
|
|
|
"value": "25440"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "befe5189-8b0e-4210-a85c-5b74b9b32e70",
|
|
|
|
|
"value": "5.0662340166805"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "9c11c910-be0b-4f93-a2e3-ff613268434e",
|
|
|
|
|
"value": "f9a3fa5cdea20de7fbc2ec16ffd53bc8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "89e5b18f-5536-4707-845d-a90e7f59ca1a",
|
|
|
|
|
"value": "20523e664605624fc5bb695a221a4fdc8498ead9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656670",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "aff0d627-97f5-47d8-9f2b-87902038ed9e",
|
|
|
|
|
"value": "169bfced4039c8e6990a76fdebda0d03a97733aa176fa8023e2de25bff4b1855"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "409cf63c-c002-415a-aedd-3f97d7a60263",
|
|
|
|
|
"value": "971510400f04944f644afbc6d99c684191a033e3e675e79d9a73c6e73653c04e77a91e49f11d670d17c6d80a481a332bd2912ea3aa459d6c79f45ff0b2ea0bb4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "1d7c8ad2-453a-4b5f-b770-a2e9fb119746",
|
|
|
|
|
"value": "384:AgpV8Cg1mFqUJEVtYIfGMKKWHdc7I0MSEDIs7OmX8cx5HvtFYSUect3fze//umlu:fxOmJEYhKCSKKmX3xJFFYSP4fi/mmYv"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"uuid": "91040cf2-0fa6-47d0-9b25-3d469c7da8d1",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9be25a58-90ff-4ee1-b8a7-e88b4241cdde",
|
|
|
|
|
"value": ".comment"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3d9f7347-7b33-4543-8f8e-08ae5a25e3ef",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "305f3e9a-f45d-4a1d-94d8-0b2978a041d9",
|
|
|
|
|
"value": "2754"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "a5f0fd43-c35b-4ec3-979f-34b98761f1ba",
|
|
|
|
|
"value": "3.6143694458868"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "38179b5c-c978-4a05-9c95-8300750e8296",
|
|
|
|
|
"value": "78e58b49ff9bed85d5c7b23bfed7b3af"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "0d5009ca-7bbe-4cdb-b2d4-969d4fc83414",
|
|
|
|
|
"value": "057b5c4934885ba4cd0ad3eb5a7b0ba4be35853d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "ab7a6da5-2e0b-4a48-875d-f520b2e974b5",
|
|
|
|
|
"value": "83248a2fa585dab241b1b0d13b7e22eb17f0d115ba7c8b3caec2a1666637331d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "bc589539-a704-40fc-afad-38f459cdce3c",
|
|
|
|
|
"value": "d4533e3af29b0c28f6699c7b5c89219065ddc1596a52adcbf2c64f2f3916eb4327cfcc0aea68f73251d94649f0e61da51bfc639529132e1e7f8208d37ba7d450"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "6d646cba-d85f-433d-8fdf-648870de12a7",
|
|
|
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUo:G"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"uuid": "3fd5d40e-c67b-46b5-a180-910ff2014aa3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d9951311-6410-4b47-8a14-b93234d00252",
|
|
|
|
|
"value": ".debug_aranges"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9acb348c-cb44-4574-9a2e-a8c670c58fc2",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "8573cf6b-c4b4-4496-8416-b6609539e853",
|
|
|
|
|
"value": "32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "69efad8e-facc-4ec8-96c7-66d9437acd02",
|
|
|
|
|
"value": "1.3719873517385"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "52d08a0e-c09f-4963-9662-33c784a5cf76",
|
|
|
|
|
"value": "ad3975afa0a6920dbaff1109fd4bc6d9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "8a137c89-4c22-4996-ac9d-484f87cef242",
|
|
|
|
|
"value": "1e4725ff8c1b4cf56dc846eaa5125ddd286f883d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "d7687cc3-4e86-433b-adfe-f5fefdd38c75",
|
|
|
|
|
"value": "93873f63eae8c7312de3948b7c59a35673591831fadf3d0912f0d06c6a6ffafa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "99c79598-191a-42d9-b570-171ab9d16003",
|
|
|
|
|
"value": "595ec11a47d4fc7e3844d00b305e1dec31a60b0632c5b9142e27730a22e821f1d4461594c4c897cd3a39a526a99ddd51b515a8a768db21ce0456719ac4063f54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "9a321248-c6af-458f-83e1-9b43be907d55",
|
|
|
|
|
"value": "3:3llKlZ:y"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"uuid": "1b8bf0c9-da8e-4ebc-8fcf-12f148cb8aa7",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656671",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "077eff98-7cc6-486e-b9b5-6beede3ca381",
|
|
|
|
|
"value": ".debug_pubnames"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9e143943-9673-4700-b146-56d1e831ee31",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "52d2a625-3987-4a8e-907f-2116e2816a59",
|
|
|
|
|
"value": "31"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "cbacfbc0-e744-4206-973d-10710ec6a130",
|
|
|
|
|
"value": "2.4684334063236"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "a5fe62e8-1d2e-443b-96ad-7eaf5b33143c",
|
|
|
|
|
"value": "34b241e6a826ac984f0407bda7ad6b30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "f3c5443d-27b2-42dd-915d-abe34d1e2cd5",
|
|
|
|
|
"value": "04922d47a35daaf06cbde672c10ef60fa9320f2d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6ebb5c61-6a03-4cb4-b9be-ab147b780c6f",
|
|
|
|
|
"value": "89b7e50012ec2920bd0525bfc3ad0854c423c45b6ca7e03fb44a0b15378e0d44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "82b6dabc-237c-493e-93fa-b968640931fc",
|
|
|
|
|
"value": "1fc9e72eef8071d509a8694ea42a82ace138e7937da1aa63a67d562a3126655e02ad65956f6c590b7d5b24e0fa1a3794aa16225626812cf0b1f52aca1a435da0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "659797f7-e33a-4c51-a9c5-f68ebb8df504",
|
|
|
|
|
"value": "3:elMlllI6oB1Xn:6M/O3n"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"uuid": "3bcb4d1a-66ee-48db-962f-a49a365cca79",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d0cbc460-4b3e-463f-bf96-6a576dac8dd1",
|
|
|
|
|
"value": ".debug_info"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "70975905-8998-485e-a40c-2fe9baeec5f9",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "69775241-5706-408f-9538-2c4dc51f0795",
|
|
|
|
|
"value": "366"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4a9ee7ee-c104-40a1-8928-0be286f38dff",
|
|
|
|
|
"value": "3.9353456897612"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "90d50709-b6e0-4b90-b019-a71ccbe13d68",
|
|
|
|
|
"value": "48e10fbf640a36b91e2e2b5f02efc08b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "17a70e41-c7e1-4a02-a210-4ab8d16e05ae",
|
|
|
|
|
"value": "23018f6004ad9cfb6f2e8ad93a9e70b51d537b32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "28d1ad7b-b552-4fdf-b639-f54d10633e26",
|
|
|
|
|
"value": "c41a4fd791da4c6a736355030b6df23e5ce8e7856a5464d3f6ca211259e2b83f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "5cf3ba7c-2740-430d-865b-ff6d7f4f6865",
|
|
|
|
|
"value": "5c5227c724aa691d8200b3736f45e7ff3339b031d18c645c6edd05053d5dda6bc0d6fcd45750c99690123401cadd7bf7e15abca93f3ac24b19846e70734fca5e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e0aac1b5-7fc4-43c5-9e2c-ee11b8ac36e5",
|
|
|
|
|
"value": "6:uF5RLtVuf5tliWeFsSs/XFfe8EGS/vDCr8NnvzCSrEk0E9sJknysNTOU:85RLtVGz4jsSsNm8EGwVnjrv0RJeNL"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"uuid": "9c4329e8-ac6c-4b40-8b90-93c97d47ca19",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3611391e-f5c5-459d-a861-5d89d7fd56b3",
|
|
|
|
|
"value": ".debug_abbrev"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8939ca46-8c4e-4728-b21a-0020e95e22bc",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "72f6e20e-c745-4a73-943d-ffcbffb2a022",
|
|
|
|
|
"value": "251"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "1277f31e-08d1-4b85-9ce6-b898b59c8c8c",
|
|
|
|
|
"value": "4.2634000371371"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "81c8b4cf-0baa-45e0-a113-41c5e006e76f",
|
|
|
|
|
"value": "60aff1cb0670e4d9e7921d43320c4e59"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "25a8af4d-8321-4b53-89a8-023c12dbf653",
|
|
|
|
|
"value": "6712b53d0fd00ea0f9c1f035fad48f918b16f8dd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8f2489a9-1e3f-4976-9808-5093490d8858",
|
|
|
|
|
"value": "c50a9accf537acb60283ee680466267739279800e9c4d7a6842a918be389ec4a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656672",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d7bca4e8-a326-4870-9c95-513a17f57e3c",
|
|
|
|
|
"value": "c00cc278dbc90c49b2187fadfbebf36573a535765794e365500e7600b79aca8bc3cbc8702cc5de8b5f5d212f374f763aeed4b6a80163054e3c7171b3e15caa6f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "b83585b6-2be7-4868-9a61-7d592b742d7e",
|
|
|
|
|
"value": "6:AUQlYfaCfThdgKXXju/1hXl0grG/C+0lv3bP3iu1wGu3EHXG3bPll:+4JfHHjGz2grG/CH93bP3nyT3E3G3bn"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"uuid": "48c25567-9566-46ab-bd81-b76a29f55869",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b9b09324-2b2e-4089-9653-75b1360f03ef",
|
|
|
|
|
"value": ".debug_line"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8d65c0a8-c9e9-4723-acd0-a22dfbd5e0b7",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "adfd6912-5f69-4cf6-82e2-94a1a66a207c",
|
|
|
|
|
"value": "124"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "05bf514a-bb30-4621-91ba-99e1cd402217",
|
|
|
|
|
"value": "4.5861322227218"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "2b1f04c0-fb4c-425e-b79e-b98a2cd49911",
|
|
|
|
|
"value": "77f542cd9af05f3d21fe2230c1a51994"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "6e1fbdbf-6cce-41a0-98d2-cd48b1a3de82",
|
|
|
|
|
"value": "e5998c3e79ef2ce05c7820c4319ec93b8a7fe21f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "6c97d906-e76c-4c4e-9cea-7a43fab43f07",
|
|
|
|
|
"value": "1cdb6e63a3121507ff0a9cb2cccdc5337604da65339db1b22c0427d6317d91ea"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "3ea40802-2deb-4382-8fc8-414804e4d3b5",
|
|
|
|
|
"value": "31ad60a0ebf7adc1c5e80a3f25aae6243f47157c4a11ee9a131c575b52e1ce22a204356adf61f694b17af53d47a9a3a9ee553afe02a09b02205f6aaec0d83bfb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "029fa29d-4514-41a2-8c70-d69a8e7778fe",
|
|
|
|
|
"value": "3:NlKWMsqeMYAhI/BNDHCRX2k6iRX7sll6lJxrI:yB28xeix7s/K0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"uuid": "5e67bb4a-3c5b-4fd9-bda9-52e99ec1a9ec",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "323b5592-52b0-4cf5-bea0-3e37f13cc4f3",
|
|
|
|
|
"value": ".debug_frame"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "437ae7cd-250f-4267-b162-39e6e0c9a201",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "6b76d6d6-71e5-40f8-82c8-77aa3f151952",
|
|
|
|
|
"value": "40"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "ecd00c50-d1c5-4806-bcaf-c4ddc0611cf3",
|
|
|
|
|
"value": "3.1658841998019"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "e092e9e3-221a-47cf-9f0e-c58759c31443",
|
|
|
|
|
"value": "dda5f868b60ce64d4f6dba0f6c9edefa"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "e5d99e6c-d357-4e5e-b51f-98dfd4cfa98d",
|
|
|
|
|
"value": "1b12b6f9ec7fee59ab9382d20e0560e9d87ca62b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "f5bd7525-fe9c-4497-8458-6230e44820fd",
|
|
|
|
|
"value": "b901f34a607b1f48624cf1954ac378ea73c751dfabeac9fbf86d7fc4f9b20fa0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "1f6f0dd9-16fd-4e2e-a6ba-6aeb84c64266",
|
|
|
|
|
"value": "a89670114389ec24f4ac64d209ee71f5c2d2c5a3b23dfc8d05e1b6d8da24bb1c5cca2bbe3496755f025a9ceb831c72c193dbfa65dd50df5cfb838eef9195a5c1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "633e9e4d-7fd5-45b0-b3b5-b321994ed1cb",
|
|
|
|
|
"value": "3:+R/hlil2T:+AcT"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"uuid": "4c8a51c8-1527-4aee-a2f5-b1107db7deab",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656673",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d8a8ce07-4a0f-4127-8008-8d39c5c488a2",
|
|
|
|
|
"value": ".debug_str"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "43537fc2-ea6b-4e50-83cb-4ccb6d514726",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "02dc8724-c777-4fbe-aa17-4885c929c793",
|
|
|
|
|
"value": "MERGE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "flag",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "687ff085-7b47-4015-9495-848c6a42fac4",
|
|
|
|
|
"value": "STRINGS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "4cf4830e-927a-4f25-84fd-b2a3e8b6848e",
|
|
|
|
|
"value": "267"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "263058db-7534-4d7e-9930-60a72684ac7f",
|
|
|
|
|
"value": "4.7860462097603"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "88ec9e3a-9205-44e6-9616-77e81b26fc88",
|
|
|
|
|
"value": "74dc7ac35de14986cfaac5f2658227bb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "24b6f1d3-e076-471c-b90f-65cc5ce36d0e",
|
|
|
|
|
"value": "ec359cc06f8285f868630847da04050335335f99"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "4b71b1ed-dbf6-42d3-a4ca-9acc6d027a38",
|
|
|
|
|
"value": "145e72f8cadd280b176943b95b409e907062136de801895277626b28696dd3a3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "7185eb54-5b51-4529-bd60-d7b85070e831",
|
|
|
|
|
"value": "3299c04742755481fcafab87f2eeca3b85297a4d71ddf0f3f4bd29b37e18954d8248b98d9b59c781ccd58496a582c63fb98d852dcf918e4022ff9902a98e44fc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "97ba715d-8531-4bc9-a93b-ea43c629e118",
|
|
|
|
|
"value": "6:c2KsZRTB2RHf5xpqQGBo3aVJ2timE6YZRl:AsvTBKHf5qQGBoqVJ2tiLvl"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"uuid": "3cc45be1-3a29-4489-a74a-e3ac6595c32f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cab54d6a-a1a8-40b0-a684-986b4643a1e4",
|
|
|
|
|
"value": ".debug_loc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "ba9981cf-5081-476a-9e9e-fe1ab03669d5",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "d53684a6-8cea-4110-a64c-153e0b7f2771",
|
|
|
|
|
"value": "110"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "90e1bc16-6abb-466e-9df4-56c0b6a76d78",
|
|
|
|
|
"value": "2.2479367211772"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "10162283-5e4a-4016-8b93-3f583beae19e",
|
|
|
|
|
"value": "c2e4faa0f2e7dbb09198677c388f1019"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "0b95df4d-81ac-4a64-89db-81567c2f5509",
|
|
|
|
|
"value": "ae4c96c5d8c6ef1785984321dd99e8d72119e6b1"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "814b6083-78eb-4dba-81a9-805f38039ba8",
|
|
|
|
|
"value": "317e06f071e0e2f1bc79da11f58bcb6cd6fa1764375ff5729b045454850aaf7e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "608e9ffa-e3e0-4748-b451-3719b42a2547",
|
|
|
|
|
"value": "16a3dc9d23eecbd88c47d999e193676d3780e1ca6867160686f609ccda7b02fcae044ac0d893770dcffe05ebd3f17f1a2fa4b01585d569fbb8a27343cf70e235"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656674",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "670fc84a-aef1-48ac-b84d-1264de967818",
|
|
|
|
|
"value": "3:wzlrlS/lLRyll/Mhnl/ozll/l3lFytll:F/Pu+hn6Jllm"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1613637283",
|
|
|
|
|
"uuid": "86fa725a-e9cd-4388-9582-e6dfca955dc9",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3d1a3b68-ca4e-433c-bd08-7f17743d9864",
|
|
|
|
|
"value": ".debug_ranges"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5b2ef096-6a07-43ae-b88c-b0412376715b",
|
|
|
|
|
"value": "PROGBITS"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "71f4ef05-1507-4fa1-a506-4ac1a6197e09",
|
|
|
|
|
"value": "24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "798836fd-a3a6-497c-b47d-4f300213682e",
|
|
|
|
|
"value": "0.98335575498169"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1613637275",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "05d92429-aed4-481c-9eaa-6f91530b8e92",
|
|
|
|
|
"value": "b1e1a289aec1d3e98850094c4a421bda"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1613637278",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "1a917b2b-ace0-4094-956a-bdf996d46ca0",
|
|
|
|
|
"value": "c2ddcc7b693792afd222bfbff523c936da4e3325"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1613637280",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "bd38c401-4838-49ab-8e98-4207da4ec483",
|
|
|
|
|
"value": "978e04525d1f1b53516748c6c0d3918d30a2de45e9b15bb49aff737cae044937"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1613637283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "d1eddab8-b547-4a3b-ad8e-1cce1d7772ef",
|
|
|
|
|
"value": "88f095699295d45ba283b479d2c1f592cc0c12f539e8b6d66436b194c74392e45282854f1d26516898139f67d6f9816124b5e36b2c85dd26affa694480b0f794"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1613636077",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e66e7738-94ec-43da-9b21-98fb54b0d4ce",
|
|
|
|
|
"value": "3:tdt:"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"uuid": "307d5d46-5ba4-47af-89a5-baa05c4a9ef0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3ec7ea7b-114e-437f-9739-477ca5595bea",
|
|
|
|
|
"value": ".shstrtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7e4ca9cf-2afc-49ba-b68e-c4ef7744206f",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "a14e0b79-8f27-41c5-8aea-ff7960c5ae32",
|
|
|
|
|
"value": "220"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4ff949cc-4622-47fc-9f75-2719ee2e45e4",
|
|
|
|
|
"value": "4.1928239393367"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "54a82bb9-f971-450f-ba6c-dff99926d36c",
|
|
|
|
|
"value": "7d8271ce89242d27d4b223389d6b4868"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "9c830e8d-4ee8-449b-8c25-146e849c0299",
|
|
|
|
|
"value": "1d97635ed8a2ecf8231a4673b08f799d3a089701"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "8273b3bb-a52d-45a8-be4c-b276896337db",
|
|
|
|
|
"value": "a1d3736a83998135c55f9058ad8f11776d47cfd3da289731b5950b1aed814a77"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "a8414277-aa3f-4881-bc95-e6b18f06beba",
|
|
|
|
|
"value": "f002aa5b6494b8a781bbf752dee78c007c79ef23d6890e25ddea0e65747102f8e81761eca881742f51a07518418f095271fccd652b85cb79727a5eb27949bdb0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "ea1a6d76-1346-4468-9230-07635faf0038",
|
|
|
|
|
"value": "6:EXwWEgMF84MFTnfniLTptN9WztHKwVh48zFc+:IE/H8ivptN9mxhY8hc+"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"uuid": "a57e5e78-b889-4b58-b687-ccf0c7fffcfa",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7a0cc8d2-4da1-4668-b74a-777cff9dad72",
|
|
|
|
|
"value": ".symtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "4d0806bf-3b99-48d6-9f4c-48e855ea65b4",
|
|
|
|
|
"value": "SYMTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "6b0cc395-c211-4a20-a76a-4cd50b97a760",
|
|
|
|
|
"value": "11664"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "4a8daca9-dee5-441b-ba87-dd0e1d67fa60",
|
|
|
|
|
"value": "3.8422976439828"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "099c20b0-1e80-4751-9d3c-53c2c8fa346c",
|
|
|
|
|
"value": "07f620ecfd8b766727debf20d4fee114"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "fbd19079-59e9-4cfa-b053-c0f7890dd687",
|
|
|
|
|
"value": "2b85a2e2df728fa6f8557c680dfca5c336abf163"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656675",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "c436a624-3fac-4ff0-a0d5-d3f517cf2940",
|
|
|
|
|
"value": "09d561264b93a4cbf920d08da3c67925b1b6ff2dce4c0832adf0b04e048df2b0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f7d6f28a-379d-4dbe-a6a1-90416b6b45b9",
|
|
|
|
|
"value": "216b5cf56f93d4a214bd7b4a39aa0fa149b60cf54b55858306fe4406173e0881b3408a6de4574fac6691974bf4cf0a06bfc1112cc74d7248460af1c3a476e2b0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "023d1d10-b439-42ec-9569-7a584751c1e6",
|
|
|
|
|
"value": "192:tcexoPy8CyV1mDWUqUJIlj7dOzgYIfGMK/S/+UL:zV8Cg1mFqUJEVtYIfGMKKW0"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a section of an Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf-section",
|
|
|
|
|
"template_uuid": "ca271f32-1234-4e87-b240-6b6e882de5de",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"uuid": "f4ddf335-7cbb-4c16-9ccf-449c0398225e",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "name",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "efe7f1e1-3068-45bc-a335-cef1f98493d6",
|
|
|
|
|
"value": ".strtab"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "cd2d12d0-bcca-41d4-854f-85f0d79ad882",
|
|
|
|
|
"value": "STRTAB"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "324a90b9-3001-4564-9335-9d3f8352d847",
|
|
|
|
|
"value": "8880"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "a4f37855-6eaa-454c-84e4-828b1326f704",
|
|
|
|
|
"value": "4.6088190848301"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "fc31db96-20d3-4ff6-8522-a1d5a3c6f9ed",
|
|
|
|
|
"value": "04be42f32c035cc402ff6c52f94f53d4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "cc52a14b-f16b-43bc-be3d-c855c0da8e18",
|
|
|
|
|
"value": "e03b2d9b3ff4990b4b07be7ddbc2b346e142d461"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "297e6fe2-2884-44b5-9de9-12f1c5cc3a9d",
|
|
|
|
|
"value": "d961da9c5c1b16b8a045521c090a586a7bcfd861b3c21b775ba9b28cb1c1d3d7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "c208b539-419f-4068-afc0-c1bbff9a5c6f",
|
|
|
|
|
"value": "11bd534fafa8e7f603df08b5472d7d6e0d6598a8fc611afed7e47f29a89b357b92fe2c4e684babb11c4222ec8bcbc6d3de53286b1735ce3e69f97d9e2ec69720"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "db8d0f9f-c6b3-496e-90aa-18d5e36216d7",
|
|
|
|
|
"value": "192:s3dc7I0fXMSX07DIDY7xwmX8cx5s4vsMFfASNCexCtSglf4oe//umhDXqLNaIfJ:Adc7I0MSEDIs7OmX8cx5HvtFYSUect3r"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "Object describing a Executable and Linkable Format",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "elf",
|
|
|
|
|
"template_uuid": "fa6534ae-ad74-4ce0-8f23-15a66c82c7fa",
|
|
|
|
|
"template_version": "4",
|
|
|
|
|
"timestamp": "1550656679",
|
|
|
|
|
"uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 0 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "e35ab664-d370-4925-a464-f43cc09ca4ad",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-43d0-4494-84d8-4a3c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 1 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "140ed95e-052e-402d-abe2-4216654b44e0",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-9d10-4ae7-a42f-4002950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 2 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "6cc47bbf-9bdd-4a5f-bf98-5cc516bbf0cb",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-e44c-4185-863d-421b950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 3 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "69ed74d7-a7b4-4a25-8067-14b425cdfb18",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-33dc-46cb-8c2c-4c2e950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 4 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "7bd7974f-8307-46b8-b3c4-e4eb88ccd02d",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-f958-4898-87e9-4cf8950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 5 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "baa88f1e-d75e-4a25-83ad-70258c54cc5b",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-dad4-4c6a-a5a5-4a6f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 6 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "77aa1ec5-ea18-40f8-823e-a7595a9fe702",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-13dc-4f96-a2d7-4c38950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 7 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "310046fc-01e4-41d2-86a5-f515ca712b2a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-7c7c-419e-903e-4b6a950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 8 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "37c15adf-ea19-4531-8ab2-7adb7442b7e3",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a5-4f4c-4f35-8432-4dc4950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 9 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "47a5cfb3-b3d8-4372-b682-a0192c36d11a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-0278-4a47-b221-43aa950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 10 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "5a72317a-eb57-4df5-affc-4f4db6de49de",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-12d8-4690-bf8b-4f83950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 11 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "91040cf2-0fa6-47d0-9b25-3d469c7da8d1",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-990c-4c60-b2b1-4ef4950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 12 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "3fd5d40e-c67b-46b5-a180-910ff2014aa3",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-3dd8-4d16-a6db-4f74950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 13 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "1b8bf0c9-da8e-4ebc-8fcf-12f148cb8aa7",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-f7d4-4305-b083-4a19950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 14 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "3bcb4d1a-66ee-48db-962f-a49a365cca79",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-cfd4-4815-858d-4d40950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 15 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "9c4329e8-ac6c-4b40-8b90-93c97d47ca19",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-61c8-4e7c-a3b8-4df1950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 16 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "48c25567-9566-46ab-bd81-b76a29f55869",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-0224-4786-bfb5-4503950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 17 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "5e67bb4a-3c5b-4fd9-bda9-52e99ec1a9ec",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-5330-4873-b5e6-4cc3950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 18 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "4c8a51c8-1527-4aee-a2f5-b1107db7deab",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-8924-49ca-ae97-4c27950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 19 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "3cc45be1-3a29-4489-a74a-e3ac6595c32f",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a6-da60-414e-b20f-4843950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 20 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "86fa725a-e9cd-4388-9582-e6dfca955dc9",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a7-f234-4b0b-8c64-439c950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 21 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "307d5d46-5ba4-47af-89a5-baa05c4a9ef0",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a7-4410-43a4-ba1d-483f950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 22 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "a57e5e78-b889-4b58-b687-ccf0c7fffcfa",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a7-4fa8-4779-802c-47a4950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "Section 23 of ELF",
|
|
|
|
|
"object_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
|
|
|
|
"referenced_uuid": "f4ddf335-7cbb-4c16-9ccf-449c0398225e",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a7-e5a4-4ab1-b827-4447950d2111"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "type",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "bc887de3-e952-4d06-8ab0-481192f3bdf7",
|
|
|
|
|
"value": "EXECUTABLE"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entrypoint-address",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3526060c-375a-441a-a35c-85d9d079a8bc",
|
|
|
|
|
"value": "65956"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "arch",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8195a4ad-00a0-4e0e-90ca-c37ba7a40c08",
|
|
|
|
|
"value": "SPARC"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "os_abi",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "6035bad3-dfaa-46cf-ba73-fc5fb0a8b806",
|
|
|
|
|
"value": "SYSTEMV"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "number-sections",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "counter",
|
|
|
|
|
"uuid": "7c0e808b-c7cc-4ec8-8697-c4c3b86bf09f",
|
|
|
|
|
"value": "24"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "11",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "ELF indicators",
|
|
|
|
|
"object_uuid": "dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
|
|
|
|
"referenced_uuid": "a9353096-af17-4e62-b066-40c4b6b32588",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "included-in",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d24a7-facc-407a-b732-48ff950d2111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
|
|
|
|
"referenced_uuid": "01bb1781-57df-43f0-ae31-30611e59f11a",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c6d2841-1928-4afb-866e-4e9602de0b81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
|
|
|
|
"referenced_uuid": "d782cd47-8d2f-44cc-b5ff-5179f2f1f2ba",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-bc58-413e-bca3-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "9528f106-bc2f-44dc-ac51-d5481632eb7c",
|
|
|
|
|
"value": "sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "8fdfbff8-cd81-4bf8-adc3-30ab24ba11d7",
|
|
|
|
|
"value": "100380"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "entropy",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "float",
|
|
|
|
|
"uuid": "1a536f06-6193-4ae3-ac47-a2134c9594fe",
|
|
|
|
|
"value": "5.9292166759459"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "946e1206-c694-4228-8d46-32bb461936f5",
|
|
|
|
|
"value": "b46eff3bd43bef86f56ca1b93f82c21b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "d62b219b-295e-4a73-9941-3b20f3381e64",
|
|
|
|
|
"value": "f51dd81bdb16b87cd3bf335c1bf918e0f40b216a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "18cce78e-5845-4e1d-99a7-34e797d10637",
|
|
|
|
|
"value": "3b72288b292a5b18d870277a116713118e23b103fe58b8b1ad93f0296513b509"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha512",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha512",
|
|
|
|
|
"uuid": "f770b446-69d6-4799-8e85-e109c1ac2960",
|
|
|
|
|
"value": "ced15c07893d3eea189fede6b6ab446154f2f8695b1844ad900df8825bf454236ac2c5dac2e08cacb3c6fa65b7d36260d077b46b867386fa5a372af2777b747b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Artifacts dropped",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "mimetype",
|
|
|
|
|
"timestamp": "1550656677",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "mime-type",
|
|
|
|
|
"uuid": "9648f4b6-fb9d-4981-bb54-5b52716f5ada",
|
|
|
|
|
"value": "ELF 32-bit MSB executable, SPARC, version 1 (SYSV)"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "ssdeep",
|
|
|
|
|
"timestamp": "1550656677",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "ssdeep",
|
|
|
|
|
"uuid": "e17740fb-3f1e-4f04-9e50-02a145462518",
|
|
|
|
|
"value": "1536:s4A3+Setwt99N95at8tBwJD8vu3mn3FFYSPui/m3cS:hwT9NPat8OD73m3FFYSWi/KcS"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"uuid": "e3af71ca-c00f-4243-886e-3c4d279bd335",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "73a79019-8f5c-4c94-8674-027e456ec84b",
|
|
|
|
|
"value": "2019-02-20T03:14:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "c77bca68-9805-46e6-a4f1-e996db0e48b9",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7eefa483e23c0ae2e67ce3c3a399527b3244c6d23af4401842bab88276b26840/analysis/1550632454/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e4136dab-c9a5-4093-8eb3-41109acd1180",
|
|
|
|
|
"value": "18/57"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"uuid": "a2ea1f52-91be-4888-86e0-af75ed6a01b9",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "08149525-72ed-4ada-8bef-7f831d6498e7",
|
|
|
|
|
"value": "2019-02-20T10:09:28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "f189bbf0-dbd5-4e4a-8f7b-01f083c07a1b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/25eb40f52fbf71f729b4b7422e181e22ef19e38a461ce450446d47fa765cb153/analysis/1550657368/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "b5cf61b9-a3ac-4f64-aa46-7dd659be47f0",
|
|
|
|
|
"value": "13/52"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"uuid": "01bb1781-57df-43f0-ae31-30611e59f11a",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "f68b07d0-2691-41a7-b404-4a118737f7fc",
|
|
|
|
|
"value": "2019-02-20T09:36:20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "3d9cd137-75d2-429c-8956-010d535856e3",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3b72288b292a5b18d870277a116713118e23b103fe58b8b1ad93f0296513b509/analysis/1550655380/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "40d8a139-85f1-4a0a-84bb-9d6b844426e9",
|
|
|
|
|
"value": "15/55"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"uuid": "a43da60c-51a0-4616-a935-b8ccfecf6559",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "3c61dc7c-4c89-4adf-822f-afeab5437341",
|
|
|
|
|
"value": "2019-02-20T01:10:44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "d028cdd5-550a-4d69-82d9-ffac31af4e48",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9bfa55698985096343655c5c2bf7c33f6ec8460c636922437d5109480c60fc8f/analysis/1550625044/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c436dddc-f1f5-444e-a6d2-a321c07b6145",
|
|
|
|
|
"value": "14/51"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550657597",
|
|
|
|
|
"uuid": "d25ea6d9-0e80-49d5-98e9-489b46660622",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550657598",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "0160c74a-2d45-49d4-b0f1-58d2dd65b25e",
|
|
|
|
|
"value": "2019-02-20T03:14:27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550657598",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "9e989e5c-6b0e-4be8-9d10-a70f8aa087e4",
|
|
|
|
|
"value": "https://www.virustotal.com/file/85a118a21531fdfdc62ffd2f39376fa67644d8cd4041a288b770def0a4f5f5d7/analysis/1550632467/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550657598",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "03e9b807-2ce8-4155-8b80-5c6fafa0557f",
|
|
|
|
|
"value": "16/52"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550741122",
|
|
|
|
|
"uuid": "5c6e6e82-94e8-421b-9bfd-4be0950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIACtLVU56iMjHeZ4AAIBzAQAgABwAYTUxY2JmZjM0Njc3ZThiZTdiZWMyMzJlYjY2ZGI1NjRVVAkAA4JublyCbm5cdXgLAAEEIQAAAAQhAAAAnJIhLpazqvZ2C0U+AetVpplcQTL70Df9HrAmE0CSpY2Fk6pHlCrmVmlg5yCRuQVHe5PjVGCEmmAbu1Go40zpeJIDim/7hD5qaPX3l2GueoHQXTO4YVbutuDvzMlnO4eDnayBZVaKqpdZgEgsmWEKsFrRuBUxqUqgv8uwbYMUNJ6nJS1I7VRZp3XcGi44S5UJO0w3UqZx8nFdvf1QGPXcS4BGYS66O+P4I5A3HzJM11dblQrEqUZUWGU2MPXa/qGd7c9JK3+xNyOEbch6iiOpMsAFhkjLYzfi1IfsMP6TQibRw62PtaSSV4odTzgGbKIQev22PXIbfHI/XxUoEdGM6hWWr9b92VMil1sPO5pfLy157nVuFUaFYcZpESDiayB21Y2+B8KlrC5LjJPh3kMa8QQG3jr3Arqdud8NwWOJL2WHSVfI0uzpVo+3XqaDKjbiNSwY7WQOBjHEQklD3sUsybWFly3iPM+ybWTpowd80u8HBRRxyQietgFGcaOxbUMBlRf5evr0MrwEGVLaA4UYaD9tuPk7GpYNuz7z97U+U00xr0FIiD6NtfimpBSaiwasBTSC18ENAqe4DP0ADcMFY91WQuCfxkrzcu8BuR0z4bS4Ojy94guOag10aAXUmaKx16QR1v8pfqeJ3l/E1hyMEvUuBp1Dfca7d0kA2MSGgRpOjrDC4oes0jqlNlxMK6kGJp4ygQ2v7Qi2EZFiTabdE9YK2sG6s/T103cvbH4F9u+F7qbU+9eaqy1SxJv6Vdm5kjCKo0KHZRfmAj0NyOAe0HTRMCBkPxZlb3n1ITvDwQ98G24Q6udSWmx5soc2+sg3wtgQWZJPGoxKxjSDDfK4uToNl9vl3xErkMlU3FFrW4us1PPugqQUWWahP0aeu6yaUANr3XWen+A/od2NGT/GCnM2bEFlU9YnNLqA9mdhLvndZ0xARx3AlyR52ttCg2+KAWZmBBR+eC5ywdwC87SwpGA9PMv4De1KLnR5A+CmgZQuOa1LMkqEUUns5eYojP+Ap9QP9en8IiYYVCNd+2ciWy0HbWwiop5JbXfxtfp1cT3jj5qb/X3WqRMMtGhJvrYPYy9ZK9zHwKMwgsaJ6lbM46t+6Hon6zeKCPppGsfoNLE0nK0StzI0ILu7eFoJPVkmNNwNKGZusaBphZdaJ5XlI/77cOoj3V2rXATFLLdPNiW7CKtZUw49BADKYlN8s/gnGEVaqX7my+qzVNwDdRnSqDS5RIwwUEmbduhrQlaonHkr/xdIrYRsWKM9SSs8ul9e/noCHAV2IOG7+aW7poLhdV0DsQEPpmn13DGyy6LxLikEOHaxYK31alH+Nt7LDUkmH1wgSDsDhJ7LTaWyYMZaiFnVy2js7D5vLBeUwu76CrK02OwKkM97CHvho1Ygl3dFDZchz6QNCyKyVfHF3XeXmvPX5SuXE+VUHdvh+FkvJSf6ytNAzaNyjlxvFVN29G8mffyHGWpli+mBh4gI7hJJVX5Ql5Uq0TIDw4287DC9RtiRubuzEidP0MmwOp9Bi9oY1WY7rb7DS+prm+vki4t5Xy0rHEomTBqo81wvWWQZilNW7QFmuTMLWhtULmwJ6wciIu/y8Ay4SfX48RDpAJMqdiI4ZgFr4kvALwpBp46LMvT4tJBxG+BlTxT27HT1q4xWBzYMC3evN2gaQWV4ix8OJLTLOMqwTLO9cBmWS+HwqXQ32p01GA3tE5w9Ex7SdJhpAe0znO9FY3aEAnr2Ejlj52arLu1GXvzpcs+bVWT9CArrBYlKrmzBMlMD7sRwcBU3CwqRpvdk6+6YA5M4A45+WNxKdMgmUnIPlnvJQGnh0wSZoQ26PTGKIuXSPjEEE64cJoYObdKZkALqNmuOtxxV+tG6IXHwjo2V9QXklGVB370Y/gGeBwc8KnKNrh9Ok/5BaCPydnZyYVJumnEGRcJ8CujGIy9jayWMm7OmEgdoUtgPi4DTq54oUm1M301+Vff4hgYqGBpaHsvBsR6SFGh/szMiRk5X80Q5c8LHxEoU4WNSp6SPCO9ZzPewkvJo7eAmZCShrQxD27bKPz16HIK6BQtMNGIkmOnQKaw4e5LhFV3e7rLKQR+xRjbJGPHvuLGqbVfcBqQoV4dM8Ebt7k5XcUbhQPMuwZoO1wQdJwGK3iEVNGOYyRCnCk4HBOLxUcJgUjhda/l+o4NtVvbn/lHmx7XIQGJy+7GxqJqoBILM0MEL1TJ7juQwPEbdu/So4NyZCsad8a871GLu0KHERo4xvxrN76z50qahm9E/Xt6GSoalpU/afxgdFegzS30D5kRQK+fxXkBVsPPCe5QDggKg1d5klZdADtdfwtl0l0R3lG9oCRwH7hBR1dnV3bK1wwN8NA9UxWHs05my524yrzCp3208xrVaEUz3PfngbBM8XPEGqEJrSVcsI/sJ9WM9mWPiAxSa99bLbCot0I+4OUIPWCk8clt+uvkshtDfQAYMXBZae1OGzbfQsg2P1cQJTEF2GCIY7bGJdr+8PSppvVmspRe1N6GcfHeno9s7AaBunQcgZSHFx0Q2fwtVm3K1eFKwepl06i0WZoQFL9o6rzU73bpeCrPshnuEAwPqJ5+VxUTkwv1FWwHPvBllwcK9gQDnxwkd7gmnzrhDLmiv/eHb+lTV63mjFaSuBP5+p2tCKKtBN1XwxVwmrWUcdIq6esJE+oMHgPk4FJjD8p7A/3xjZJ4cFx5d6rO87FXMHyGZoTOb6bQmFTfGoBjFsGyeJDrz2NkrHTwNYtsPcFRkizSqB5qe5TwwMid5dgJEM/RXBNN7hBXdtqYTDbFlU7V8jMwKUURse0zm6jzm6tNQ00jDD+pbrOzWhqbVl+19ZDIrgPivGZKb4+9fGMfCu9G/O9OIk7Xn0N/eExGMhgRl6zAhazf7vO20UrxkdMOYaB71mkwkFLuYHKAvAP7FWQbhESZmPXDvjlBVRnl/WZRTXQoLYoC4uVyo7FDKrhZ0ZdoBP6YzDRGi5Sl72YFrjPWpoLGWogZ9zl8AsRAKt6T2y2AtsxU8N3DzfDHFPJ+c+JFPyankiIra5akDFnUWAHJoIF+Gf7x3GIfvdUfkNuuDnSA+ikZSO/kAgpu1jiL2oNMFCZgNNxa4uvlyGsRDKN7sPtDGWXs0erh2PllI2ZYIdyyazwuH5HXdursHoOuQQb3UVjAbOPsfG66TUlfL5abNSMfz4zRDjzqN4hczuafsinNirLPBPJMIX56L+L/k85ogpTlqmyMOYMGB42U6TYLvBSo2nyWrqFHGYAwv9PF3WCz+vRu17klVQU74zHct5wweMywXxUZ7apeAUmthnlhoNFV6Vp+Y7XMfv1DfNINnISa7R1d/LUdqsKSXckA07nwNrXomRBgZFZI6P69DrFcdhfHD6Deypz+Qdc9sN6VWCVllBQ/+/B5rDhQFdbk6oVTHvPPwb7uVGvKQiYV7lk3VlT/pu7b622B7x86Y0QV4cvy9YBxykTuSvppszIKjMiOAgb6wGnR+EZXis1eNuXRBuFdM3XJD/fxvMuFlc13qFhExyTGEuB7hiiBAFQ8W/xi2dEuGV86C7IIGT9eekMgX0l6Z884GdMrXxDZKeo5SYZjwlsMqYQY7+hGw2eyGnycBn7Clmg42RbPhRqqE2u3NGvNQENFtwPeWf4ReI4cjwmgUIg2p9U/4sPYTBo1I81OgTdiQDWcSYevmCup8Wn4M2SQBHEDVHp6iPW43DlQ07ZupFUo+9xAKR079mvT3lR5YffxGhW9BzP7izeQbuJ8GtV3JXrintymxfauvhl2WBmFFo/i7nWytgmcZsIeV+eFCstGOy5SuFAeWOZ7uDZnCZHLCAKn7itoY7/ccFsYpPr8G8kawGYNiDzMOIQGdmVbVkgbAFCKJHu77MUNhtbyBUGvqKhqZPXNVar9W3YchY9CFB23tGgzSz2ynSjipdrmir9kHTiNYDd
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550741123",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e6e83-bd10-417d-a84c-4163950d210f",
|
|
|
|
|
"value": "apache2|a51cbff34677e8be7bec232eb66db564"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550741124",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e6e84-8d08-4d4c-b293-4077950d210f",
|
|
|
|
|
"value": "apache2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550741125",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e6e85-c1a0-4547-ab5e-4fb4950d210f",
|
|
|
|
|
"value": "a51cbff34677e8be7bec232eb66db564"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550741125",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e6e85-e9ac-4b4e-9d20-45a8950d210f",
|
|
|
|
|
"value": "5c7f873320ab3b6fab74ed402b953e58c0f99502"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550741125",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e6e85-3974-40e1-a180-4f4e950d210f",
|
|
|
|
|
"value": "7eed6eecf1b5b167ee266b04ff3b146231fe47531a3f7ad122651db37a860257"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550741125",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e6e85-fdec-4d09-ad44-4504950d210f",
|
|
|
|
|
"value": "95104"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550741767",
|
|
|
|
|
"uuid": "5c6e7107-c568-4761-94a1-407c950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAIRMVU56iMjHeZ4AAIBzAQAgABwAYTUxY2JmZjM0Njc3ZThiZTdiZWMyMzJlYjY2ZGI1NjRVVAkAAwdxblwHcW5cdXgLAAEEIQAAAAQhAAAAOynS1eeVPuTfZohdsrFmVmcg7v2D02aU1KPmyboeJQV4jPF3HbxTUYSje9XGXVeLcnGQyZVtGcb9Y3BkApudtB6Usf1vItA15OluC+y2zWLuHcNnXAoQOH6ewMzlph9fg14xwBQ9H2ZLNGWqJ9RRSJ4UtkIrQ7Txeg26L5COVKP9XuVHBpG9Y8Q6HzPBdB1E7eNN4J/x3pBMwrbnJr6d7RUcrrC9WnLfCmPY0kuS3HiKZy5gVcDTtBixNKrrisDYu/3cVUptB3TgFpBC8UdnvZZe08JgcKzEs4fziE6xMCadwZItDsfInKXt2LF0t9XLoHVao59nO3eVhEfOY+SwCRYeKU5y7/dQVazDhN4qv1K92SdNWROMsy2TjxeZTZUa2xK1HtokSL+09f3LS5GeWSngNqS4ofoqOFcEKFYRFThqhOeKB1tIStthPpcxm+7YnmV3MeTlexZzge3HkTTbAclOpQsUuadWaUC4WrR9aSPiOPkEWEhRSpC67vf+2H1dJy44zKSbjVFwWgxoE0+QNNvK5IGR1k3ZrA5zFTeEOUybxJ3gdXrosA2Ve2SJhfbSGv16RsXcG1hc3Fn+koBxSOroL/BFlcnJ5AOD9ZYbgkmc804lokIKoZTDmk/2hlNiPJ3sdDoq5iWfSP+qcMOu+mhtxW/60r3/ShfJdowLCQWlpAPpX7L8kRSuRLa+W4Dh69cQKmeC/I9QhsXm0OQYGeS3NNaiUEaLeTolZUbLXyjN+Br7fYLzVXUJSgCyhsKW57BChFoRu0kHEOHjI1UvuqaR6dBxrYZKlSSUXhBtVLbNLoDR7X3U0/iOrPyo9tBZy1ME7ljvFx0QhilKfMPxqT46GHOdMdsUJwHg88NvCwYeQkmFOBYMUoEELkUdGJSx1gczNvXHEVxow6SWXSc/QuUEaBWDGKfhM1Gk0qVsrpnAraxwssBdFFf2CBa9kG4kLwoRzbPMe3Xcf/OeJbe9ohLgRy/ccYsx54H/233TVNN6s9t2tdhLv03IHCea9M8icYZSoXdOT1zhfGYUdRbCaHNpb7tlLa/WJ362A1JoGC9zj6WqIyzLD/RLc5ub4yCHRh+ycpv0PEiKrEvK+QyW4LwIJOVlO3xcQ7cxCHC+lB+jO+bJeSIuka8uXtv5TGMOmjSRwG94RWJzEA/9qhs9BUz6/jJq0Wsn1wlvKfkS5zhL5EKWCwTKzny78k7tkUXRTZzFvTfrNuX85xIj74O/mBBy8/bv7qYsHSNz4YXZ4z/X0fPnFNhG3EJvzCofDfwHX2u7+BUOKIe1AP6Wp4q9Yow9KMinVMYvzWXaZqO9uW1Iu50MhD8iBH2b2LIyN8rMF0B8d5eEoLUyAz25KFIdCh5Mpan+3PxlmhtY7fZh2JBSsnKISFVnyrkBcjqmlQCjJ5WMcQQ//KGzA1bZZQ8FkQGqmVpLHaW5oabO4wo2MUohpUvofojgXivwK83rMZzeE6d0eMCYWzrE7nwnrR8dVgFNDFggY7oZZlh3ggDIsVNZu5VIpxU3J/J3KY4Ifx+okb3V9WA+k2b0/yDhPj9i1RvSBA5QU4e4eO+3NIndom813YwcPx95A9yVI5qxLz/5JmYB4y6jTb62lx4Ojo87jDs5n4UWXx9liCM2o6U9e0k6Ja5WWfXgqPhOSxqlxWFRl54sq2XpvCzCfJY9XgoAMwLEz7ROo5zRwhP2oe66lRxUgH9Zs9i57ruRfAwwEphy/ZI7FfSEmleJa0up6SgNPkorxGNpm0dTg/FhppLI01qZjahT/miK/5q457jjEmQnr2Svfz2qE/Shg594BjNq0xaXJn8pyMbZr9wUpX6twFJyw47ZfwIwp/rs+vHrKyJ/MgqdNVxIMoGj7hA1scqGeFMK24+AIvZVcB98O++kY/NOU4M1Z4afGypjhII/wC9cob3bxPYDt7O0pjC7xhHgIFj4v17+mn3azR3TsmN9VTGly1rjkKOKdhOgmlJGftXv8q94dLW0G92k+br82lyDDDHUHJPRIbEX93AH55UarW1io3ccgZXJ9k5Z0EFC7EWqBv+vHl4CetxUX8hnQeipHB/EB2mLum13DPOvPz7mfl6FCcNh2i9u2ocndwArO72pSeZWElXdEbl+tbtvG2LOGUKz6+EPSS96mvEHt+j5xlV18Gf1gg9HXLrjwx75V3dj1N1+GK1a0naj1rQPa7AyMb1kOPCKAubl6nynndPp6i8Bhj1H71C+Tg22LKOXacah9z+yy2C5tg8xioEfKBS94eJSxM9JQW+tKWxFyUUVH7OY0tQXpQ9bMrDAizk3/pgG41b1Tk8y+2aZKNFEOlkg/sIgmfW93v+bTI8EKpJvX1SYU9DQybbgGYCfKjyrXhhiMoJSs/Qed91Rey4u1mxU4XIUnyuqppVYH+AiKWlZADIxCv0qcsQ2lqM0PZ4jjV8koVctLAZIrczvgaF7iL0UOFwg7cJFRtLIsbE4us7JAQ4wiaWBYGNZJkv3SH+SOND//lJg4pxwieAfpwtoa0Z+7h8Jff64ko3anncK4+h6Sn44IJryLK064/YraxbBAnujNIdGG2tLFWO8t6aV8KAyQkTF35lUk339K97+bdm1CIs14fyxLGbeP9U2QCEcBeLo0n/9Ym//CSexU0uTDhyr3vmneVincs+UMSESxBfDNO8fLM9mIuCC8tI9RpXUT20UiV17u54++scWG5yqSPf7RzUyaL/NwSHoQiIzhA+TdG/dVIRiaOWoRqjZA/nCwzIQN2j/Kt7m42BEuEuP7ZRpyqZ5MiGOT4fiBsBrlexsXZU/ZnGj7PQ8QwZ/GGX+GrXF7iqVmw8EzkEBagkLhYFlMH2Tm4hyKPy0oa3LuKJ+HNC0VAcOicgls/HREpI69AmARicHWiaKZsli0VKsUbKKe9vq7ewXJV/AvrrLksH1SaCmyCCCMQKFmoVaKg/hCKK8HOJjAUxjZ9j+IXGwvPSqNeoblSbKp8liqMl+KMz0QG2ZQDUqHlLm0uolOfrZ0V4mZeg0dxm+zz8bxjMIeqcaqsTr5japUApaUlDWX6Ub1C2qluPhYsmcrmffTyPOrw1s32Pj6zGdrvLLot3DSMITaqq2pXSoVj8pWFdu2sBLiV7gq31fU3gMOFHibQ2m6VIbMZz5tRq1dA0H1GnBQ8croX4USjM7CowfXLrwgreZSZTyqANicFACgFoaZ681iJdsGCk1kWFi8IlsfB1IMo7Rsg/oEuVeUtRnODcKBPAKZXj9QycdOukXimj+KW2kO5DwVJ52vaTaBYhlbG4yPdK90d3fHIz+DGKwRLgLiL/1n8Du3ZSjIgqgi/cuI5KLHsoAprQMp7cEQmhiMOMbGeEPZlxU4VARlKGnSh4sHmiRb+lg9wTeSC8Z7YurQJxSiY+J6fSyomz05/d5BV0HAEWJ0siCCEjNyXaFQ+34anSrUZzRdEG4+034h8i7IYisB34VNpL4GO/4N2GFOx1gF470sx5N8j6TMfg8E+mHaYSUn9XvQg0r3Avx22EXulBTVntLppuZc1++sFlNsxNusbVVz1KY7Hdrs6RoXWj0iZS7SY2NEiBYMzCrgBvJN8K5/MpuVeIcdKQ2HA12axhncSrWzJTqoNcsSvAESqYPCeaN8zKRy1XNlfK86mDsM/0RMm45uq228GrCleBOCLJR9zxL/WQo3Ft49k9hmBuSwFoMjWJ1yH/qCqwLNpprtcig/2B37NS9BjgUvLjStBkNzvmWcFY+UIxyrepN8HSOU3icsuGRgb5zEqbr5+g+4hvstsQ+6pMgWfOseezrgWkYFUaIjInBv9sjEX4NnTIoM3b3D76rMJbllNshuYGkTg//82sXKubjAlqNdog88mogaa3YDYpNSKW0rYVXhr55cbskGEHs3FSrRJt8Ph6oKruwJ8I553w4aX9SLFt0TeLvkcZN+Xum3lSSdUAKLQ5/Pe0OSKtKOkqWKf
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550741768",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e7108-8150-4a15-8f3e-428a950d210f",
|
|
|
|
|
"value": "apache2|a51cbff34677e8be7bec232eb66db564"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550741768",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e7108-659c-435d-9e76-4435950d210f",
|
|
|
|
|
"value": "apache2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550741768",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e7108-38c0-4f5e-bf6d-484e950d210f",
|
|
|
|
|
"value": "a51cbff34677e8be7bec232eb66db564"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550741768",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e7108-f434-4386-9c40-432e950d210f",
|
|
|
|
|
"value": "5c7f873320ab3b6fab74ed402b953e58c0f99502"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550741768",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e7108-83e8-4bb4-ad0b-4287950d210f",
|
|
|
|
|
"value": "7eed6eecf1b5b167ee266b04ff3b146231fe47531a3f7ad122651db37a860257"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550741768",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e7108-01a4-4db4-81ce-49a2950d210f",
|
|
|
|
|
"value": "95104"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742413",
|
|
|
|
|
"uuid": "5c6e738d-9e4c-41f9-ab6d-4e63950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIANtNVU4V2WuWc5AAAFowAQAgABwAMjJmODhkZDJmYWI5Y2EwOTE1ZTA5YWViNjc4NGRhMDhVVAkAA41zblyNc25cdXgLAAEEIQAAAAQhAAAADNbYFhedEkJtl9BIRJMbWVWk1Rkpebo3PkzdGTuTlJ3azZ0rjlUp+nJi/qNw1IHNsYJ9cOD+LkKweo1gBSlzRAXhwfW8a/N2E9U081WBSyF1kup/Ho0EiykR4QyifE0HFGLnMSA3OoH6WW1F550NQ6KgaewJaDwAI1FO6GYNyDOYuwOa4BQS44K4pv9lF3F550TiNBOLJXF+t9m4d+1UnFt2kYKWS8lIIrEjkjGhnySLKivA0scQRI90icmQI3TYGltaczwa/cGs/SIF5YRORrQE0cu6Bu/fnhFJtCEKfGvGuf2CajXeMkXIIGMsVw8wqhgJfCodqADxJvzND9RySVf/oOFzYXsaILMtq1OcZlFYZF3fEyE7v20eQrNWiaEuY5L9IbwWpoB933tTCV4DQpvCOizvEzZHY6Y+qD9NT9NZAhHlLW7lwhkhPBgMSsoT2BxnQmF7qeVLulTKMk5DeWpKBXlqnAR2J30FYQtIBIzdbzvho8i1X4pAruNjULBFaqfazk71M1a/b/3OKCkRjGwZyNzuHRZm2oUVy4ZLV5h+TbyJh1n93F6Z8shfo7dpbb+gnJpi9RZNfhuyyfq6zx24n5AAWnKTWARFlEmLIgdIbwXuYISspbu35N7Kh6dYmSoR0JNUMiP88bK5UxPsK8+iBdIx45GK/MEM8BsC1ANz0fNGrRWVLOMzl3E5w9o4Yumq5yYWmQaFv26USW/BGESVs2zMOlMTkP7fWEHwtupK3IKFWXEIpEVEOnMNLd/8/G8lCV0Jdz4NClTmkm0tcfXmZLwhClP89p6Fh8b4a+WNcnMYmMaxn/KecsuE826OqD7paC05TlpLoPcOV0Thk55bXW6zm1uyluJGHUP3Q7Jpdo6+EphteVLedwFlG8mVGuBuCaabVTv9wA7XlKZnWJrGTOCFZBO0coOdWs8k+HN+rG2SHsxoSdrfnonxzaJoYZdRl5z0ZEG77nChKWRJFz0yqYo/43L5h18Kx+Qa7ETIW9+31LgmfEvSsybQ3AtdRKpTzk1Mz4NGJsUm3feQ6pH41Cq+AulYgJrcfVk5hr7g1Pd6udsOHAuSoGAfAPoKxDLLIOZXPz5ZJpHcWbvGYykSKRogc0Q1JoFXh7NemPUDM7VxbFQHj8r6JDrRxEoNs1nsjmwllBxXy8Pa3FcS3Nib20ey6WdzW7implGTyGQa34xriQaTCKb9OB5uouTrQGFFPrnTLP845BxfayVM9UqjylqEunv4LUjurplSd2W8IaA+M0Yxet/QPMIqkMEjwuKeiFWQ2HO1+R0ZZeRqXo9bUS3HRljGi/j6kX1Fo5g9e/VUhHReN0jLiEla+zw9Hh2shaJgcF5BHZdpW1tTx93XC0FKl9skKP0BrF4CFWAYjtyh6YaC69iqXoRwe8XBjvtLpXXkHEBUHAxQiBZ4n0HWNgfUezxl1knOSaCZHePrnikRAoYv06O6PobHbXDKX7ql0QU2HAoh5D5ac4g129o9SVd2WvS9n5XTAJBT/LM/rDCUiVMZUOJ8mcokL+xXfGuyiFh7fPXppurLl1WeHCSGr2wXkuKB2TEeL5XGxoDuNfVLXhoZvAqc9+iOhCF6WhrATNjUlMcZSDdun3WYaltLfeSISP0nYVTHLa3hTFOPxaIeeztquJD4EDuL2ro32N/kyPS3u4B4jZoGl+TQ8ahXMwO2hQ0dfzS0/6jo2LyAMJErj2swWd+jUc1zzGsEDbKDsniLUuk8zGyVCjtoKp0QzB6r8sFBws6KHR54lvYfijRf7ZZMdkKcujMb27pUNg73fX/WzCKnmAmlrODnXvvliQFAzdCq88VD4m3lPC9BadAY6kr0TyhYGkq+Gh09rfOrUtHqt1AIclMmWAbPfVPCSyrThPpS8BlVPO3JJ20GLE7Gci2QBVVBPK/SYHbCuIWDz6ddJSsVhjXbgLQZhCBHVEfCAg7bkB2Om3NuQ1bW5QmeCD0/R4BGCMBy0l4ITH9fHG4lAjsvaJfEc2XmUAQ9YZ+vQHY4sL10yOn03YxqoaMqjGjKxqzojuBUT/hWJcJs2w6YOSip+CQp2VNmNMEfoSeL7iICdJaOAxEi7EJwzyEdGeIlM9EIn5rs0F2Ke8ZdFNTZOrhUSIUUik//KRinlpFEqPlgn03mJLRKjU8NswVouOnmN4y7k8JqonoUM35oshhqnEO4HiWDFPjk0dVBBdjn3QhVXzR1NKuu6Svl68yyUFWY3WAlzs85HczanSUVGueHf7T8f9JCcEeCkGRG3G1pFLT4QY31m/l3G1BGOw09qHEj7hkdLaYIHrHLqpCKcPP6SjjP3EFRPTyq8DLFhARBi4x+hxykzKefcfoFB7sgozsYjOOuDNhn/sL2QQrt+w9ImsjoRNmwct8qX7KkC7erb3M/Bu+uHu8QW3RqjkSfe1BtmmBMwh03eupcGiDTKFdC/HuucjFmobiSJpd1O2vP424YsD542JDA0hJaer4wSRqHxqvUrNiguBxXimjHYNmns5ntffrAssf7r2k/tFzkURxG0LZe2/zLSysSrA6JQZL6ZD3xk7XwfE9qpKeVk66+E8O8Hup9SGmwLCTGq2uqTX4i9DwBN/rlFrTzU9eXJ2YJ889k9N3RJqvNzUs/rIW9K7wq9SMIFzve6fdKtOJwxfUb6ugJ22meHpJMC34qQfqrJzCGrqWwHlQlDa7WqCfye8fmBYKW1F89HAGCc3ZcbX/SlPyv0PKTyC341ARKH+8XcPP2NqBs0iMPwgba5D4w/X1Hc6H2RRoiWNDtfWApHpxTdGFWD+0OGrst1h+3kvNv/mDnW7zpbcmQtgsTBnzoZWN2vMzVeJf2mmrRYDjhxirbCjyjtXy1Mbfuwc1ejvFfAFkQ6vBv7sdil4whTT9hS0dATKt3xCBjYwzBWV3wck7WAu1xGGTBnemTG/I3vpOZKT+xcTX+ZoC45Qu85+NYx3+uBe374MtZr6uuIlp8/zSqFYlrNBvdAJkdNYBHAywbwX/6671LzFYMKMcMiW+dm7a3tsl+UfUivcPO+wPGNC9Z/91ZpriTeyjfauXupOI+r/HUVvmBVVKt/Twmz4Rt06+7WqUbnhAf39fgC0REzX9/hYypTeGyEOuubxPOo+gcfQycR/GcPBC7hUMzpbYy7qXdStNWgUsgurtU1XZ9oh8Rcf/lQkuT4utXFY5+gzITFIjVPdpUg/5RVHaV3xNzAUOkRMz4kKBMSt5pz+yomZAyxJ+4JH7ZYHEwpJzqkqeTbjkQIFtbBpaQtEI4PF9mr/bHyERwuoNOW1ZeL5WB3N/RCTroig5k69cFWjLmFkaQFBenStI47TyvrGN5yraEU1F07SCjbbl6AbafMmuQWIlDyJQ2N+wIWxUb1U/s6VJYFMP8BV26KJikmrOYTtBVW2ZCazG4Y9cNrohv8cN4/BdyTTDuGILJpwq0MQOjpmXv7ueRXPnGH+rHzVTtGUlP5kxw4amXBbhsctS1ARvbGs77WOe1T1vjf78A0EemqFSgTNJ7Xq1uqTajoVTbC1g9x9sM0dY3iRnzMDW2Mzx9F7/r1K/Xd50N7RBIfyEDB7SUo0htHc4zxQQN+MwRv+njYmD5SoTyZ+ZxEtM2Tf5iu80YyNCiCaw6q/DFgYi2M6wpP1hd2ukyV2qpdmQz9S7+MO0/OF7SGfL5kdmrsx/1bHL3n00KQMvGq4SvQPYmL9d5n/EZ2ygs5l980jrQ0HuYLSBhqr0k0OAiMBB4G4Qd7qlNA7MjWhuk5KnAOsxQhf9P4i1sTu/6615iWuOEM/YfXIIz0yxx0M8g6TLn9Htsdqq1FXefWY6UqhlRZNaZXmNLp9kV4xnVKOXKpO8LOhmVpvz0xmhV6kASJimjTx5KxId5ToM3wumlp+v8OzZSrsOV6VuSPoXPO42lS0OsGll2ZNXTSdIOf116I2lUwISjGpGwPcC9kp75odUKw4hFYn
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742413",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e738d-b70c-4239-903d-4e4a950d210f",
|
|
|
|
|
"value": "ftp|22f88dd2fab9ca0915e09aeb6784da08"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742413",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e738d-1028-44a7-9aa8-42fa950d210f",
|
|
|
|
|
"value": "ftp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742413",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e738d-40d4-414e-a862-4caf950d210f",
|
|
|
|
|
"value": "22f88dd2fab9ca0915e09aeb6784da08"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742413",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e738d-6454-4804-b75d-45d2950d210f",
|
|
|
|
|
"value": "709c7b60e3ebb921592be87015b153b482ff68a7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742413",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e738d-cb28-4952-a4fc-4bf5950d210f",
|
|
|
|
|
"value": "623a6f3f3192fe3b6a0e2d731a20b4e8eb5041fa4af3baaa68fde1720d296e5e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742413",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e738d-2d70-46f0-9a07-45bb950d210f",
|
|
|
|
|
"value": "77914"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742414",
|
|
|
|
|
"uuid": "5c6e738e-acec-4ded-8db4-4c2e950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIANtNVU4UY/RCTwEAAMkIAAAgABwAZmE5N2VhODc5Y2EwMTUzNDg2YzUzN2I2YWFmNzcyZTNVVAkAA45zblyOc25cdXgLAAEEIQAAAAQhAAAAQTnP1v0fs7NgCrOXR8ceVs5eYRHpTrL6UipzxHoX9S6GsQHBelSm0olDQU/DypWvDhKV2M8UAISGBPluBiyCBAqbxCCQNByPvECSNdoDFwRIHfOJXCjing879LchknU+VPLNstvzeO2Ww+rsYRRnLMnJgWcdvxHBe1pluvNGY0q1fqDURf4Q+yayHajA8Ka/FLI12z2KpRDAw9hBI0VwDd9/uqKtGkgakqEiRLnu/5BNerSbJ3WnwJ1R8D848ZKuHpKVxmRJzUjsUzXsT7vZ1rY8nBgJgeqd5ZWWUtgiwhzwMVymFgTK7JzqOemPRssZy2SA9tZomRN/pVzMLvUMIgYMUzb+vclK7YxGiUOTSGExaOlZ4nPAzDSia9cwcv5IdIkIaSQZ6bmhc7CCK3OcWyujOxHywors3uwK+inItz1875nVfZH1fm+k5tO0nrRQSwcIFGP0Qk8BAADJCAAAUEsDBAoACQAAANtNVU7IPlQhEwAAAAcAAAAtABwAZmE5N2VhODc5Y2EwMTUzNDg2YzUzN2I2YWFmNzcyZTMuZmlsZW5hbWUudHh0VVQJAAOOc25cjnNuXHV4CwABBCEAAAAEIQAAAAyv5bTe28bqT8OCsrDf8SWR7R9QSwcIyD5UIRMAAAAHAAAAUEsBAh4DFAAJAAgA201VThRj9EJPAQAAyQgAACAAGAAAAAAAAQAAAKSBAAAAAGZhOTdlYTg3OWNhMDE1MzQ4NmM1MzdiNmFhZjc3MmUzVVQFAAOOc25cdXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAA201VTsg+VCETAAAABwAAAC0AGAAAAAAAAQAAAKSBuQEAAGZhOTdlYTg3OWNhMDE1MzQ4NmM1MzdiNmFhZjc3MmUzLmZpbGVuYW1lLnR4dFVUBQADjnNuXHV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAABDAgAAAAA=",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742414",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e738e-6aa8-43fc-a68e-45a4950d210f",
|
|
|
|
|
"value": "ftp1.sh|fa97ea879ca0153486c537b6aaf772e3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742414",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e738e-e774-4632-a769-4c77950d210f",
|
|
|
|
|
"value": "ftp1.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742414",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e738e-da8c-42de-99ac-4f03950d210f",
|
|
|
|
|
"value": "fa97ea879ca0153486c537b6aaf772e3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742414",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e738e-c484-4937-aa82-4eaa950d210f",
|
|
|
|
|
"value": "0896f82f6078a51fcf2e3d8aad5c5ec304ef4b99"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742414",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e738e-4374-4c33-a1f3-4c96950d210f",
|
|
|
|
|
"value": "475035fda5081f1a2e7e7974f93532849b8631e458dc43e0049b661a593a03c5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742414",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e738e-a900-43f5-9c09-4e12950d210f",
|
|
|
|
|
"value": "2249"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"uuid": "5c6e738f-57fc-48bd-bd19-4c78950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIANxNVU4LUH7QN8oAAJ7IAQAgABwAY2RkMjI4ZjQ1MWZjNDQxNWQxZDgwYTU4YmNhZTdlMjhVVAkAA49zblyPc25cdXgLAAEEIQAAAAQhAAAAURdDyGuu22Be+adk+U61dRxpZWGJJYIyA/+J6UkUFtEpHIoBxTdKOtvWfdULZm6Jkg1SvOdkZD7gGV2r2WomEcgHILFoBnHCw5Uylq1lPPbuKulJJP+FhPSo/bEW0mv5onkUwvOv40gBfpHalK/u1LZraKVpAsQD4Yt+9Obz44jnW49ocITJxh/Fvp/OubgzQenK89x8FsufwDrtGXX7keTAA/6q5UugXlJtlHrludvxTNHAqdHAWIGp5PB6PQUwEbl0EMJSTwKAc+he7CpuyXpE9G/FbchcbFEXottoL8VzU1hpzkh6voJLl8kLAOAKdb8rXlDQS0B8BmyCF7J4udlERxfHkFJNsrXR4yseC8LRsTdHHZ4mz/FEeWAsRBvxixdWcuELSzTCaaeOgDdImkmHcoVP78iAFq0Qwz/JtOr1G7omSXXq5g8n8/Y0G+hgzS0wfYtKTkhnh5bzazK8owKIoV9aAL9/6VXV/YoyDRgU+mq8JtBPHmWbph0YJ2mPD7X1bIiySondZ4Ngovn+dYLM3/Hu+oNp/O7X1H4kVT+3x70eGkLCgJ5SgyakH9fe0G81CvWtHBKbPge6VM91jQpssY8GqlDFXJggndhU8t9/x7ph1tl5TLshmbsjsZJ8jWs0Fp6B5spAXE3t5y9kaFf1m+ncU9rMoLRRbfZXEC2ALpMQh3kwjrhM1nppaEJNM6KFog+/IrilTY5SPhrzJLssEt4DrSdu1Y6qaNdi4LNSxB34bdQQP3ppswElCuZKCAkIuIZLPeA0EWJdGxiW/mMuUTKXEBFr3OSgP83gQ3P52t6U72elfXe5HZAj1P3MFsudB+UZyaBn4qIl2CnXb2q53WN1A/lx2l+ttZJr4dvW7BSW6DAJdwoJNsJFTgiuocBuLH8mfnnKRAEUuhtz1WjNdpyTTgHLFL07lKDHQS4KchxUGbrrbUYnJ2XnDb0aV3YN5N+ZNX7wccXwQhkt49p7rRApNRHHaAXxVjHMI6Haln1Uhi9dvkcdQLkTB4Vg+XOrJ3/F25ow6imchaCM3zQLKJqth+jqlxHi7IrP7DkbZ5c4C7KmOaxdpcCDmW9Mjup2fXG5C5ozYMeJQ9O0IGrf/h+8y8EVG5z12VCxgs95UtfC3bQEnpJm+ceAM4u4fpkjrgIolWU8XRk5nbRCeIlRgJcIb5gctUkq4CTNGwvuRs0rvMnKqui8fyWQHzD6UOIk7btclu7GpPWj2wK7V0VrLxQ9v4uzz7OZcbATY37FlwRS0rXK7MUZvICiJ1nyo2oFU/+yr9eiOQUm/IWTX4ZGNlM9/KEumiGGpLT0Q2nEMu4RdlDNlnzyoaN13CDYOYEorR2ZE0XuSLSRkq6SGhdYD9PNmyTB6kdF6nQDxxC++7zv/i+ezwqJBBtJMGw4Y+Vx7tOnW5qanUl4Hvgnp++GtXpSIw8zjAY0NtcpUgyPL53kmX9HButuw2WHou8qy0UKO6+ZBVwPjjtLNAjCQSiNpmNS7wDlUO5nRb1I4YUXh8cQer414UKTpj2yALAZ8ZNYpV4nRrGHmceeM7Xye78xFF/Uu8RncmAoZyIqt93p0IA49qIu0fyAFQqxHVVoEQbmLVXVrIRGkSJHHaXB3WeO7aWPfWfnVNc99iSGTdZK24asb1rcjZDN6VslBHey69cEm41BWqkdjOZeuOiBSnrx9BleV0nKN0duEetIU22w5A3GnEO6XbZMAIKlM0qqhZj/IvHjIdXlI4nl46W8cDqzKzmnWkooRBfAOuFvp10BMPZkdRF47MZ1S//9mtEUYXKjxuGa0rgte7BYZEHZdlsFYX1b2aMDgm4dJyf6tvyXMic141XWTBKdkXk5TJtNT+k9EjrZP2qsOBf1i+3irXNShFhxa4vsrsfzA6rjgGqK9i0b5Vj19Err6VWyENU1/9ipKEOppJRTEHUoqEQFpMgt0RRU/4+H5SqOHnXSg8f9UYwDKcMRc4ZmQFM2QiGFD1I4KlnvkhOSi6iZyl5QvFizs/QqiHNbXiqeSYWCK0uzyh+G31WXJ07LgaC0Ypp85DDQbEbg1+qs/AmDNpTR0wPlWgC5+2YohLD15Zd1drZZL/aSvAIZ5hHJQij9A1noNERsFFY7JgekHG72Zj9resMfssv5wkfwa9SV+OBSeALHk3CF7d+oIRI2A4vzv2uraew2e0XG/7vTsN48SuFuPZDWtd258jDvgVOc6Xj7KAz/89b603WFUYMMLh83hgJfvz68m6kXFt6nwDa5TGNYMQ1s/nNdOSDXPbs6ymv5GDwzK9i2Ljqrku56fVvCH5EDKuPNSk3WeiYfeUFKIV1VovgD20Lk6TnPcrNzxEKN+rC5qoORT6yE1R3YbGEbVcs4+utDT3e2M3ALB2CIY8cAIc2l6VDtVdtjbveI4YR7F4SvycjZvGGI0/2uyZvcMf7nPk3FIZm5PvTcbJE6bP5/LKg8a+/aR0zETn57RM3JwF1uqbYycikmKRYa4fVBJuAyH1ZSIVTmQjY0r/LEiBu0zeEUeYsgy8pATyPzNpYCD8cOKFxews5gOMalQrHp32lMH53OhWxsUljJqC9Pnc8ABRNNDMUZYLsmNUikDovOlFHthKizPmvKsafu6CzH9efblJxPD04VjzRxyfmB+hisT1orhyNpd0VWanyjE0Hs+xewuuzV+/3e4/NonMs7ZZjMXK89gzguPebHRgYKJCCK0aeCkE/Si1ruJXWz8ACvmhmYaG5Orrf9zECGoFZ07WjlvJvIHPu1sC8fCX9jIZFsfHZNdVRrsntB77hsqMx/D9lEQlh7r1dFbIsQG4T8rXK25LyMIf34DT9Qn5BfqzLkavtymqqY0DKGC+trNVPFDRYXMwqHrdKmxspTV7TFMI6D+pgTSwd8+1MfPvcjuUcIl1eAgBlVLR8W4xOno+Emp/WCpKvWobx+/mODg/HdLR8dqMWnkA2AYLeJzDU+m/tWfdBEU9VDz2tOLeS5Jt5YFGk0oz6TKJO1rX6LsdoUZEftguCGvaBxGmlvELstgkBfxehJgTPwsR/D64IrAJCdhvJy+5gq0g0GH4Gbgi2qQUp6MOMLGIhk/o7U2qyiwCrvesQIsImz3cf/ag5tph7GIXPo6wq5IkLTh5jTOe8V/1zztPF40j9A0y1Op985EnaGtl1jeQV56dcB0/MGfzVN531BeE/OiyT8s4mKlhKVqqbckVgoIRp0I4QneS0ItXWk4r7WWyssGN0RvYjwtzoRr8zGJNzu98+PO9GMNOLqDM1UZ/3wUNA5N/SmEgxkY4DC2CF5UTFh3nbAVu8m3wRDl1BszMpV1a9YUu3+ZRr7dKTs2QxQ64wFnKWYD0zsotMUohxVgF+iRL52qiWVFLdG1KecsGxQHSXVfCK5tzaEyFWKS6JlB9ElEfLiC0SfnDuWY8M5KrcwmmxeMV4hRgP5Ne3wtuxGGdHpytLHqBPaJNMf023vhoNGNG0DQGmgLnudu6JPLm4WZL5XAnpmYor6REDQ+8vCQsxKV1Ftz1Yvo83yRx+S1j0HAV6NkraK6JTH1O+HWkhehkrdRRBKpDyo92B8wLgNq0hRrrRoE3ZYLEEHiQKkfGDeu5u3nnVwhzfVhv/MHquAgRN6i9XpCjHI07tp5E8d04BmWCseAn80e5vPEa48Zr7ucCsFEJ2ONGjR22NOVKNI3AxOwvjOoxo6msXMi/qw8Oq+rggJbDUMvHiogXv1zHQep+OZbA4E0FMBc4izGpryhfJsjmfsgScIHZBLARkdJ8L+ifD0ZAexPTIHt1vhfASx/fPes4JvZ29Feu7TRIwab0eWBDqlLMjq74JxrhJnUQqe8c6igCz2vgjC+9yI7ko/Vk8cuClHq+DHHnB44G8RSTZtFTTTuJnMQASvTfQON8Zvgh7ZqpkGRLEApf+UL7hBAMZreme4/xvvVoFXjV5Pp/KGLvleHsps3WApnY2WM7
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e738f-5864-4ee6-9685-4711950d210f",
|
|
|
|
|
"value": "kittyphones|cdd228f451fc4415d1d80a58bcae7e28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e738f-34c4-442a-b6e2-441b950d210f",
|
|
|
|
|
"value": "kittyphones"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e738f-3d54-4c89-84a1-48ff950d210f",
|
|
|
|
|
"value": "cdd228f451fc4415d1d80a58bcae7e28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e738f-14a8-464c-a6d6-4ca0950d210f",
|
|
|
|
|
"value": "e975b3691ac96227163f3dde59183d2b7effaf3a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e738f-ebd8-4d37-ac22-44b0950d210f",
|
|
|
|
|
"value": "e1c050a5425f935557f947028ccddc0af7674b144baf959b5221ba8fa4e04f38"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e738f-c7f8-4214-b708-4fd3950d210f",
|
|
|
|
|
"value": "116894"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"uuid": "5c6e738f-c234-4da3-a0da-44d4950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIANxNVU4niATIxJcAAKFzAQAgABwAOTU2ZDQ0Nzc0NWZhZmUxMjk1MjM2M2NmZDFhNmFlY2ZVVAkAA49zblyPc25cdXgLAAEEIQAAAAQhAAAAEmKjsQYqpqnySiR1TCFl4of+rX179rp+/mzl9Ks3hYW9SYeaf9uzrmwpqkfbJs0fk+Nl9YheoBDNyJpiY9uSKxQmcRwZEi0AW2pNMmZ6hOxanUYvQpLqNkypgFgJhQdVlInjnQOpToyCLfPBlS+WL+If5xfwn5x/mG2lhZsJC5pHOOi89JdvgpCFjEgiNlCB8a809/f+rHdPnE7Uaa9VI72cZXQPXHOpHOY/oACrZye2sHmba1HPFGKhOSfhIaYQryZqmY1dcL4bA/T5w0EhTnQfJ0ylCLcjg+Z+FrgDk0fkqhyN7Du0/P3WSOBA2EYLxWQWkSSP8xkUQ6E3V2TU/WJG9skXCS6NA4rWq9x8HqQv8GvFTivqTTQLUu9TCdqOIYN9OiEkx2WJoArdBg6z62Lnwt/4r+FzE5FmnVsEfpSM9mIPKBjIMoeWovUAqW6UhxZRH2ASeOzb4+PWYAVqkHhw1fIrI+K/VH3HrQaTtYj0hUyZgOopR/lqqNnpE/rlyk+z+ULnH6LSa8J3RelyAHrkZej8vr3M+yW545dLgJqdP4McFFopN980NJ6V7aSUYVs29sgMEcK24H/LKr3G+BpIS48YXtboKXHUST4Jkz1wqaHfZvcO7mGmUBkzWDMZKR8/fgFID0463Nc73QUR8yJDpUfadBlL8Tn5e+7mskhpD62w8DkjYpI7Ugxqve9uNj5fCso846qFLh/6i1M58ZacLl52A2bPVdNiJeD3c8xmIRvOeozKL0C4IccmxdHwILbbwswA4e3yXH7ZlZMyWwSFBeTtQOb+fXviwa11FqCYNFoH11JJuSGR0oel8pCRXDMF+vhQO/mKwVT5yjdednUVYN6JWugg7NWScCQZG66dpDL/ToHL67VRcCPhQJkcTNqZOhPYEHF6uZEWgVZ1GYwC/kRG+lxSYFLwKyIS6hUADDKm+JlOAbgBpo/j51TIJBWRBBKBo39cHgL8+cYAsYpjWU4xG15NFvY8T9ppt80BjqNltu2W3r9fQVu8FpLKY7uBhrOTOc6CzPdOIhektGPR+VH73JlRlYkLFGkVodNnI0vvvJz47mDrspLyGFr+sgDtjWTzvqXff9+6dYAjaiOjl113QQS0K689huJaRzTkGm6xk463MhV5+1bK9qidYDv2zwfBHDoG4OJmwlj5OBMbH/j/dZ62AWDrAfEOKXAMxOJpVCpddtyYAgz42JmGDuJWlhlF+nwvc4NUft7fIPBTrlnyahNPAMxkeaLoWN12HrCHkPBfW0V58/bKdJgva6B60/kYVR9YtemJXN4i2VUyULUIDvca1+oh12VJ+dxlPTDG/cNULdhXgAjYLyGGjX+cCxm7stFKI05UEcSzMX2aL5XcMV5iedGU4q9eKjQbV9ZHfx4cnSm5M2SosIyAw//p0qo8U9GNTIcXEWuFdkAX2QIXmt7clpKJAIs7Mz6572OZxCNEAA0CGPll9cLc8xCQT+z/BWqLSabKabwPAf/Z8uFL5Swgj+OgHz9amqAzJyLGXn4qWcGTWvEoeRYo3DI5uUh7xdEeSR8JSi7xKWBxpm1IOWfkjHoviqw5XSvivM2RDSfxHVMedVQlVv6HtECkh2ppjSd9XsAGsSQicf0LNfrYvPT2qr9hjbiPbZZqBt2PRxoRBQ4XHJBGTyG3CmLd01wS9dB+C15jBq+WrwgCzjMzvDZHiwXZ1PpmDWGMiKK4wPhmh5dkNDfmEviaCtisUcz2A04mEa1yufpaTt+GBUOg8WRWX0meNOoeuCFzrfxt5t+2pr5GKlLuqmqtO9RrjNj0J9YWtcd+2e5rdQy/vXYUuHXZCqJwqaRydr7VPc6glPQa6KDoLI7dGHvmosniQgcdZ7mN+jkjpOYLsyKQSgFuiK4I2GDUQF16G7TwMvT5o/Kw2qsKg32YoYeUH9aZ25N+JYSwQBKQxPs4Zu7Dxxl1DyQUb9jYE5r9mzbZwFXWD1KIUnZo8U0DbkFPHBPrYm9gQH8zVqWU93W6aPSN4YPUeuXy6wfJyAA32rIFtYCQO9n7zqSjY6xZkWn3XnvNXcyfDmat9Xv4jasSwMI/GkoSOGqMDNl00W0YaKiovwD/1BcTnLz0u4b7vTY9yht8SG9n4GpymSMa/bgMEOWKgW5L1wdr99vh+01jiC/EIlhbqJmc9KKLsh5yKUpYjcT7t04U/q01WXG/xYPUp5oL7Raq3wBNIbs6kx36IC7M4TYhOKJLPktyylIzLoWv593IB7CIlakoi0jsqGYYu4pJM4X62+PGGCIFO2an4of7nbcAct/kVp8RHTLTQV9+Su2JtLs6VqiYp5RjWyHTYXy14xXeGlRP1J9RblIFYy4DMq5oi/nwpHFDSQkskpWI223vSHDLT3KWK2tIYbkUcCCLedJU3hge9YdXpKvqavR9ozMdnvOfv/YrM+3rAUXifw3LzCLKCTHupaMtQOCZUp31SpO7fwcizVmmvdhLi7VVTKPZV33ZLSSlBX0kYOWttQ8/4OA+SDHXbJLyvb1OAdgnjH2HzG/lbyLUIZGkbWwOIqFcsLzD9gFQNimVKylnmPaCYxHU9hJ9rLfEF9LIntFbv74hfltf6MTK+W2WpZusPbPOaiw6IwDuPlh/IsLYIM7Ls+xMaRtDbiBsMzQpuQa0/pcAqyD+eI/TcYzEiREIe6PGuAcLB5TSPhcbnHqOrMC3gUipW8ayfit0luWmOZIooQH/47HCliBtp9sVTf9M+IUZKIQ8yZw4GoHd6GgNM3sNhJaAuf2vWkxQl5PUGVWyYegs/pMuPIv09BjGHHpmati3l+sSXZMsT0l7aDqSn8vW+ZKIVTYbW4HDxK36Nw9cjcg27nitNG5hPFVXAqwYBK7a3sxgRavDYTwbYypsGLfFyLumURa1dLSzs11CNKYr+UIHqtuNZoFOXvb4Iz6beCSsKoTntheNQePz0eeJCFE1MoMLhi8D8Ac6F4cT04EK5kxhepUC/29EuNjnfdECGj6GbLrr9UWFmAFa+wC5xwJP+l1v/jdl6es9/Jv6eyoWznYGsfb37kmj15nbfeA8laRmH8eSMb3Jw858CMwRblsDfVqDkJH03aD7PhluUsgAy/+2sqanEsgyIMCvLA0I1Cm5ZGKxeGTm3rvjDQAX2t4fiyIkVlGQHMtTErJyVKZqbBMlRVNud5/E4EP6UtKqHi9kFnHnvWNfoaZTQpSP4gDMaMaIv8VFrU/Fj0mYpFjc5b9ljdqjsv5+wIAcm1DDQiJt66nB5lSyaOvSEhBdOtWfoOf/sG7itdsyxHhco938v6vQwLHUaf46iuxukrIvgfyOo2aVdlH1wmELnhxWjf4SU5cMVUe5rbei56JKO+qobkjbeuLU8iga+Cl8J8ZncfmMZRPYCNw/18TAFkd7YJ4bF8EE4T9g+rCzbHk9nSkM+aAWOENjtEyYdSWpJ0IbhyAC9AtjKQaPhwi30thTvBnFftULOORzyzY5kuEpp4SzS1psRtWn44KpXcwlGZEwugJfbE/ROd29y+oG4UixAPbooTUWfVmR1GdYHv5qTZJ/8udA6AGN8ZClHxGQlWKof3pNQKvUQd1EACob0XjtsqjrcW13mBENUdcIYZxUOVrthOsisfDPGjWaJ3IRct6AiTTO4cgXJFBgBINEY+Kv6m2UZ3kUJYKXzHbYrhRIl1WeWVkG9f0zLBAgqszXzPV1ZYvlvNlAUW5bbXLSxZZba1YORoE5xMck8QfhK3Gbg/oBjjB3tqot1uuzbIieAn9027K33mtea0FqVan/xITpoDaL03XVOZ0J1xUZwJgWx+JTFTWyi7gFTFTUh8r78Jl3cyle6xuRZZzXdU0lzw4ocdjnhDexrDxT9os9v3bF0zdK4dGtNhA+TeCunA6IDCZBo0dqT4ZmIuRH6nA2S4obkPUY6wEA+FeJYMat5hUt+R+MzjX4fSO4PEN4dcUpihwKqiMaZr
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e738f-b78c-4ab7-934f-48df950d210f",
|
|
|
|
|
"value": "pftp|956d447745fafe12952363cfd1a6aecf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e738f-4e98-4b4b-a81f-4edf950d210f",
|
|
|
|
|
"value": "pftp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e738f-c308-43a1-ae97-4cfa950d210f",
|
|
|
|
|
"value": "956d447745fafe12952363cfd1a6aecf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e738f-8a18-4431-a7b7-4586950d210f",
|
|
|
|
|
"value": "57447545237c0c4e214bd16795c1ad3dc587128a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e738f-2a50-4ac7-b610-4c6c950d210f",
|
|
|
|
|
"value": "8a0abbf321c2368b162c15cd322e465a02e696d2b0fbcf2f748cb49e98d3543c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742415",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e738f-f970-476a-815f-45a0950d210f",
|
|
|
|
|
"value": "95137"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742416",
|
|
|
|
|
"uuid": "5c6e7390-482c-409a-89f7-43c9950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIANxNVU6y5YN7wZEAAFowAQAgABwANzRmMjc1ZDJjNjYyMGQ4ZmQyZjU4MTlhZTkzNDExNThVVAkAA5BzblyQc25cdXgLAAEEIQAAAAQhAAAAMjhNL1ioYdEZin3nYz6ZRUbK5++dYZedbr75w1xsTbL0A9tizbnUx7Ext2vlXLKG6IYKHK4tH1FFzVr29VZ7owfzo7Starmp5m6X0Mf29zGmIeY6hj/mDZejNo0oPZ06jZNGo83gD4V/6TKtC0WOHo/NUsx9ObBQr/8T78j8XpBN1ytUgm8bhp4KtV4Mrxe27ysM7ZQE+ozE+iHhZsqbmZfA9zTI9EnzFcFGHEnE1MG9i2Lo65nsPDRNB/k62StHLza5ruOPK0hefO8PObZARaI1eF4gBt0RdzG5/qBywJTIw+/G0DwOJrBH0tfXtm73mbmj0MCcGMX7D+Sww9ECva16UJ7972upQe8ZquX6KwYNrSWYaFIayZJzVGyKnALJ7qZsa7Hdl2H0OIjeHi5FyMzY3AOA4usp0EfGpPInyLoSmdcOluH+UFit5Sh9mpxMXdgkulZTEttSWv6EOggRK1fj/y3H5HhF2t2RDpmx1eyadLP+U9z79SgJsjdiQCmGlPUelUfMfv0lh/IakymHtI2LaRWOiVhc+vtbTlJeJWVe02PNYnSOqcOcE4y2HR4BZW17HZriHQjcDZfDxC4tbZsQ2ztDfLgRRg1U7JEypCm9ted96X4KzqbQQChtZ5eEUJJzUvao0jV8RjhaBrd2dFWpDYRdIGbpwtBn+roCY20Wfnn+ZkSkL0rW6saF5sIRWr9bSc6tyO2XQdHTMHbVF+8wwirsfZWWelJxIgzFwAGBfNEJatWKQ72TpGaBl4REh3JaCW0tTH11oXkmpDs5QWX0wLnzogDU2/JxvqIkjShYhhM4ZawstCACbbk0Z7lG0prPoJVqhjHvdeaB6rO4QAJItGyLOJI6RVvBE0nYGaHm8tRNdQ+6BKKjA4NjHluKMCvUVnwu1GaMa0B1hFvAE1/lZyXC9x2enXPgnDxOiZ0VEpUz7VY37795RUzM3JSty1+f1nGIqEX4AerNeODdd6S8QxhAHMfR90GOhLJ+GKTqm64EF0Fq/LeOBWZ08neZL8NF4W2c/scD74P5LM5deUG613096tGN00rFhxm54p10JeWhN9Z6WcXmZWZiGr7scxGwDuW30vS0nSxvlyrOaDtRSD4c7yslE3pQL6cki2bVTYSm9HNUtGDj4AVqYssIksv6CcAXmUSAeq3ffJTaQdJMSukmg1Y+/u/9Yym+RG9I9w25YsT9dic/y0akULmg2P4buVEGoDwAG17PozbZsU5Qrnet0EJGsWmARMVVRvK7XKggcdWfNiyBPKm2O0t+nY4q1x1XFsBnSMvEVAWUCzrqh/i/6uIPGtySe+uGZY/oKH+xB0oRI6IpFDHhPhbS43pjrM7htAKXbe0WubEaBsZhrpS6SKO9F0nyMd0iSvBvMWIGY3bd0rn+V7Ti9Qw32QxetxibJNWwCG68Vs/c0XCmNtGQqRBrxO0GJ/G5G+9IoS7gsrP5z+rlD4HKI3Poy/EHm1nlzN7bDikRHPlPfEYfcsjGgbfm4GexsYJNroPxPPFyPcXsn43y7ADxFjMf0HDkVAqtlk56rQ5p9z59Rq0xne3JtIKBPPw01y/Hsv9SXmojHUzkwuz9d78Kz8JetY7yEJx4crd6yHRWjaPtsdtp9a4mm5iFz2Su3H4Rl+nR5i05cB2WDPuP9kLbZU1BJZASnecq2mp0oA0DcOvfC3S9SbzZ8mHGKbGQETj6gRKTaKFo7BjATYq9/aBEv9FARnDyXJS4H/EnfzxYLNTgY+7xRU4VpJ1gtJYJWuZtPIfq6fK5f7Q0AjN8bSUNPSsZleHRmWCfr0iolt8EDuZaKY/cdbDZlTUzsK+ylE243Q54kvIE9R7rzVUPWQwtNTMfIfDlTE9aURu9rwKG/wk8k0FlazQBXQQ1sRFLI6PzVtiOJHZ7Y/6Zcyx3DZWI4Iye849RtisQ/W0lclBf0QasK0aQ4RQNs9N77qjYvjRr6aKemEyd0SmExB+u71+g/aYAxb2aEwru5+b1w5QNh/1wjCDYaFo7+PuqLx/jmwCl7h/yChYhbPlUUVQEeu1l1njE6vF0mH1x4D1yTGz5o+PEu2Qg2xEz1D701RyYQLnCFYHAEIjrcSHwNSnfar3v56OqXU56V9ewgVCknGCX22dszOLUkcwKgO6RBuh7MoFhrnYtAm4qxL26Gi00dWYrvpsfX54wU02heuAs9LuYDUFZDIf4ham6hawsliglmuE6c+ekW5h5zkZrz3p+zdJGHKzWTYRdSEo93ojf0BewwST/ZcKPhBYb4Ij/6h3AQq41XrF97yR/mnrcYx59xiRb7w/1sEU98B+Ws7zJKKZd9u0t3gVZh5dUwbDo/yy4NGgVzpTobs8EVx37FXFxzPiMCu5pCUCSE67zF0Sz061m77803qc0glG6HrDv3w7gVMULR78n0SQMp5TBViE2Kv9KPPpoS6+QJAJM6Omdntex+TRN2+KmTRTwCUQOII18e2fOsnUL1FOiUIC8UP6+YEj0sg8am9VF7KPlcBDQX6DJehWse5cTg5yHjAuiBFdNkHoQoCrcV7qU1dJ8nqM4DUIKy2JW/CgH2PdhkGpXEYXhEHOEMhSIncHbal9ze0iHCzetuyJvyxRlfaWGfvl5RCKh82uyDbyjG6Iz2RordnD1QIdwZvXp5YUu9hX9naql5/IaAj2ZdV6pdJhR6v8OfsO2mGqYJl9FpmPIXBl9TReEwkKMqj2w2Dd9iy2bsxpicsQPFOX/KmBHSLpzdpqFDDMVgOro4kzwyhfydnWweavGwXkAg91J4dhor5TJoip+NikXDCom2xZl/N0zLJPidtoBw1q2z6nKsH/R0y0eLcis0P6Ytj98XXkA9cIrhRqZPyw5N++kn4J58lyV8xwKpID1+S8fqmEU10gHg9SEt8ibZXFNt6qlvOHBq0jvK0Hr/ZFd9oMn3fj95MXK6yYdfcAugg6bimHU2vJ/dVU+igSbH2dufUwzXUnS38b9rrqfvXbUg5vFU0n+WVV++ema/vA9qi6nkQ5DXZ6+6Gir7HqWvT2H/MeY8KPk9H6CNkwxBTcN5kYfpwMpHQmi5GfR8hBUciyNos0iykKfjWGIQYgqgW6nQXrpFLMQ8oZ8liVOpnObBkIKUGdMqFx80+b890rBIUMIhygp6w3pshLvKKaQK0ApzS7sCcUHOkr6tgYL2a3z3LO1KZRZAwymlPta/ipHA625oVkYUNEyPxq10ykSz4RcZmpYNzaiFDOCqBAmt1fEMTndPDId9gpX9Be4qXxUauXurPFSLtxH8N4a07mGgIlhVtch9T7yqFoiyY1M7S+JXv6/vyUp7jTygnEHQJVfpJzSyfHPdl7vZmyLtCtTFupnfReg3Jqa481ugsn24lBH6+KtSJKGV/B8aB5AvBabcsBjIJ30UOksCYjoNt4RTKlS6aSaVH1pAp9GlNzAg0DgcoB2gT/qnMvBH8rmeMgIJ8F8MyLRPkmkRUceUbp8qNzOHrt39tqroj+ypyQe0DRzGPumIuZfYyE1Lx8dVIx8foh5sgsHQZCMFcLYyJX7gbkZjXK6MDgG6J0R9gns4eI+PgN/+KdoyxY8qeSr5rAPv3wX/4miXcoS8tdKpfKlsGH2sPduH2W7I36Lx0P1EZ7HdUmnvUMWVJmsW0LwVZm1Ij/gttgUvLeqKSbP95BNXamqNQhW6HLjgmq0u+VToSNTFUnt92ZqXn2xBmHHOLamuZg0FKbZadFPovkGzRMtwyHwQ8FaFG31AcFkZ048bLNueAxQ5ljxIzoF71TlhaMafi69yabhiDnjaRtSF3knzAn+9BCw0KyeC+ajrso2cqlllhLXwHUlNpakDVzm/NOewAhdC8mZRM8IoP1KrdYhk7DFt2WvtiYeEH8n8Ft/O/yoM7pPH+LvQzcdmOgkdKAyxzMHwcR6PoR7I5/TOWHx35q/Y7RbZ6w1XOPUmKjXxPMKrKU2LVx8xy
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742416",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e7390-4868-457e-a743-427f950d210f",
|
|
|
|
|
"value": "pl0xi686|74f275d2c6620d8fd2f5819ae9341158"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742416",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e7390-f028-480e-b3a3-4f4b950d210f",
|
|
|
|
|
"value": "pl0xi686"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742416",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e7390-d1a4-412e-8b09-4d2d950d210f",
|
|
|
|
|
"value": "74f275d2c6620d8fd2f5819ae9341158"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742416",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e7390-7d5c-4972-b120-4fd3950d210f",
|
|
|
|
|
"value": "8547ea228be2bd2563d87742fb25ab5be5126b9c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742416",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e7390-045c-4cc7-9543-4f81950d210f",
|
|
|
|
|
"value": "05394ab6eebdc4ceef62efebb2a4e760f3339ac27af22b490057b92b56eeaf5d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742416",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e7390-6960-4b50-929f-4f86950d210f",
|
|
|
|
|
"value": "77914"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742417",
|
|
|
|
|
"uuid": "5c6e7391-4144-4296-8305-41be950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAN1NVU4S8RP1RKgAAPTTAQAgABwAODdjOGMwZTk1YzMzZWU1MWY4M2E2YWVlNjU5ZDlkZjJVVAkAA5FzblyRc25cdXgLAAEEIQAAAAQhAAAANJlwKHEJaQ1Cm7+v6J5Y64Ki/2U4m8ImE8YYaiL2n1XSXssuk87hLrQWK1kjme5V1J0LEtqD4TsHCPi6i/0QuTBCblClxaRBIail/OwbTF1JxKLkP4NoDFWenycH0Ynh+D8yOs/s+G9W9kwEodf3EeVgqzz5V+EUnb5qlHqfwRJVz+Oj/Pc3M4+EwaZzx6islc9J2NhVBoOHOZOk8+uLXLPhixxcp/PXVcAqrdc/7nJ8YNMabrWK3YmYftL+rUpWdSApiNzZWmzy6R/rdmw3xpn2k9m09vzQZG6Y8CZ8jr14D6wp5DWuIWCtt3bdHjd5718ATwgOsJ/IDbQY0+fyKD3JimhL40O9OD8Rtd3yO2N0X9J+dksCypGb5jokQpOKgs0ljjhQHYLzb+9w1d0JYz4NVq9iyXtcPutorRbULfP4WoWulV+Qgo3MPiR2WTvmFdNDRqic34mxh3NyTp1V52kYHI7sgtUHDbrtDY9HTtJ+KRSENwZkvNRrC2QDVRkmwD+1h4zPmb0Msoj91UuHSFNxKjbeIkYW6o2QA04TILFhdLzXMHU/D/tQfVdR9eeothuf8/ollRiV7qx0O4ymSV3knyB2/cwWdggILrmWwT4kiVX75ux7kCDoZ2t6IsbM2h/GaPisirq6rvR8sJJhTaCJIiA0k6hQrizxD4evxSRQn90Lu0rRFCJZoaiHHXMfNDqHFkrIuUiPOzoppgWRpiIWbe/+cmeq4V6nyYC8QNaqo86Mab57rACno4LMWFmCPl0KiCky79IL0QXYhB/afzaC/pc6ffwfWWMejJ5mj7QB6oJxhTG3b5iSMcpZRKl3JDXCEbm6dxgVznY1cfVe6sHit5w0JWfikCBgsHvEBi9QQmJPZ6VwgyQrZ+ksAdekYslIpKJr42jd9iSzESiXhnxgulL35IoE1jnRVztbO3urChIgVyEuNMw9DwGehjA9zAbb2pGWtTvI/aK3MiS0QkvmvuV87cati3y1UKohCySENylqUK3UIZu6LifciyiNTRqZen5eyde2uPWnmrg6YJPxzMw4DV1rxv9Y/FFSx5BYNwDEwavOkm/Px+5R40tC0bRiqOf3/kxITEVcdpotta+pG8FPT6GMtg3dLpjvc9cLBUlMSwe6CFGT3kR2+PBMWp3zi3JisIjsR8kgsfE6jTaPg5kcgJutwbGqCb9aH90bHSMkPuxVBum42CipE9HV9itFV9njlnYkhu8zFgyeNStnyo2EKfNjsmAoje2ToG8hmOilJqvTxjYuWyMOP+w6RG+XfUIg61UthJXehfdasdmW9vK8Ljd/U0jf40z1smwiw8EEfhxom2OkivSEe5wDf7HlbUvpENuq1hsEX5Ucv5W9miQChQP06Xa7NpdfdK/avKzeUyWHxc88kLBa/N6nGvGC5xWJlCPTAT2TItmZIa42parhcPoQK8P7s3nofd/90tZNy95PeVSLAu04Re+sToIUC+VGQIHbisLqZ/91OUTLacvCeK1QoAyjJetlXM6N9QAGNdxhUfw80+v6jiPyzkoYj0xUdg7MZeuHkN+axfk9m0dzb/howg3Pa1TD7xPgO6Gz7RfHeuWl5bdeZLn6mnbhLuABKJHnZaEyXQtTrXA3qYsh7UVbq/BeBwaGvPl2dLn1uly6ipA8gCBPi+Rry4kNNp2L3GXff0opATY2dqQP/BJzDFwccZsGUm1QdW5te6mHRGCvXHIxq3rgo2YdOxljm+0pA4vwe9PdcOi55GkBq46iMIrfOsln+5zzKKNG5TK7luWGiWzADZT3cdapfFw0GWobTlRWNhfyWpP6xe7tim+S66l++l2nG4TzqUAY8ykN33U5fS7Ro9TKKIR2XhEbd8emkvoJ0scNLbtaCb/OXkkhgepPlT4I3IT5C9gdRYR6KOzKg+1PdEukBswPK4xrr1xEdYc/wdtrkzCDabyrL51saeg2qeCfNmrHiBqc1sc4DfIGGDJwfvkuAX8XvRG6zkD4135pjvLSnFDaiA5f7o9Q/3HhGvpZ69OtiKXBzw8DpXM0ahSPeQhKyHCheN+SpGaQ0+XRQLAylkMMb2pkwxgfMtf9DHWj2TF2tWs89bGCarMJ7sUin24/WRqfxOmTH3CO8kQf4sILLx3a1kCOxWddwtrUfIxVo4meTo6cTLnttflI7YscUxg+HI/e6eGXtxN72tjmxdubazENOT78LaXDcobj8gJf+lrA1nbo1hRvWjE1woQZoZ0dzkNZouurGskhZRQzbMntjS8WupdPxGIUnE6JuKLnbFfS7cs42n+FsufwnTI/R/PZh/U8n5gXAYmaSLr8locCx02KU6gjL7BTSCi/CbPFUsGE4HoE6h6ewfl7gkK2R9/aV5SAVCdY1y/4HFDy2diz+Z8/HDGCYVE05EWRSGHAYTO5VfnNIoelZ2J+AYZRkIflzv5TgovQMPcMYqDShPqJ6MO7MJ2Cn0Sf9orBjcIkdrtgrz0mE2Z9O/1nP0B7OB4T88qlj3CB9DVbziafUr6VM2ubtagS5vOQ+eN9n59DXeJpt/hLB8LgfvMIApkxq+yomAxG9BiHgB9VR46o9r0284JYv8drL1HPSyYIwVGOANmHQIVPXpeIL1PsQWqPvE09zX1d8tuoTM7bERGx+LgMd8p1FBxJ9mD+fTDAQeO/fDNSMo8gXOvOt/hkQQ8Q4EhqJnz5/E5dvSBhCJ+PY7dvLU6TkI4MpJPRG+BO9+3iTND4LUmQ+cCM4qWpvurxlleXXU3UqYxwGKwCUZTXyxjICkrxIo2DvDV3GSp7e08l7R+R2Sw3LK1Nlany+HMhojrNa+WmOo4nb8a0FdnCXwFxWMFLa3bTetumhlY0/ypwh3IMQm0cbM3aywMge40On3wlhnu+JB5Ko/N+D+oDp71yxXzau9cFb+XzTHE3J5cJTg+/nOXPhw4ARvOAmAYX77eOSyjEiKVMwaRfjNcT6b+QTBpX76W0VXkC/gXJT9THTGGwKVP2B/8qDjDndNyNWN6MTcC76CcYc1Ai/HdVDkOWBDa2ZMhh08XsZItfaYBpEOquOnsMscfQY4K2RPVUS95/VNr5IDwx3KFwEBh4DASAANLnD9IwVcfU59uFZpV7XKWayQ86vuSdH5GArHIqOQNmp34RnOyZ3UU5qcprpZif3kb2CmnjOSe+kvzVTV+bK2RGAbYUdOIwtaM9kWLCC7DNk/tsvbQ1wlB9N48zIrplNLgpgKviOuFIypo+dBIdJa9kke26QQ4ei/CgwEMp0l1pb1fVCnT+mM8wp+UeOXOpg95+WOW8CcZDF/9u4RVu8Q+1UQLIzl6+8qM6MDLKRMx7MiBTK54sSExe+A97pLtGhgJAMEcvUmrVqWQbRDO4VX/FLHx8pC1aBcY91op0G337tEQjXqWE3mh8O76Kn6ggAKCwYn5d1uKwthOd52NslqC6dLnF0e5BNptbaEEFgJtftk7z6I9qJa4Xjoi4rPnmx2oL1CHKOepZ4qNcRFTdvHa56Ixxgar+KbpQmE8B5Z3IxdDfUge+sktuIWOs3fWm4g0YmNylT6uFiF2Qs6YHScrm5l+uOisH2vALhYDao2o+eHSckzxXQb0aN0OJAyql9IP7JERp7O4rjxGnmgow5HG5fSa8Z/tOlLarS3RFqC/SJBE+2a7f42UlZonAmD5PJJThaIISriTWvgRgBsLbRPITL+/Y2AdAjFZJr5sIa0u5MaDbm1uiOIh7K0WLiNU1OFgJQyMym4VQrDp6XtpVLJ+O1FyS1EjirUs6BKsfXqUK7v5hvXWIy+i47U/rQV5/b7LpoQsp+/13QsYS/+gcWiIQVTZH6oUWe9v6t2MiCCIW2k7dTu2+Grq7WhHy+Agud3T7siiNC02nGwUOBFdX9sihTuTTASgRtJVe0CdStzs4reDeArvfJSAmitNnXjTUZoFNk6UkEP1P9730tXdYEFW570Brf/7Tlk
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742417",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e7391-f438-4b0b-8fb0-401e950d210f",
|
|
|
|
|
"value": "pl0xmips|87c8c0e95c33ee51f83a6aee659d9df2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742417",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e7391-f8f0-4963-abeb-4b61950d210f",
|
|
|
|
|
"value": "pl0xmips"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742417",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e7391-eefc-4c59-8d6f-4140950d210f",
|
|
|
|
|
"value": "87c8c0e95c33ee51f83a6aee659d9df2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742417",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e7391-a344-4f31-b153-4389950d210f",
|
|
|
|
|
"value": "4fc8179d56acb490e841ee884b0fe27be22ebce3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742417",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e7391-0c70-49d4-8ffc-400d950d210f",
|
|
|
|
|
"value": "b97e9993702e0e7c214b72c5869a8d9e4fd59cec7fb42c9873e548f52a6a072e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742417",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e7391-ec80-424d-84d3-4912950d210f",
|
|
|
|
|
"value": "119796"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742417",
|
|
|
|
|
"uuid": "5c6e7391-2b34-4fcc-808f-4796950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAN1NVU7wNBJkY6cAAPTTAQAgABwAZDVhYmU0NGE4MTUxY2E3NjRiY2NlYTdiZjgyZWJiNDdVVAkAA5FzblyRc25cdXgLAAEEIQAAAAQhAAAAcuqkMHlY9Sz1e8XSvFVjz3bvyVKthC09oLhbSb0G02hn36Pl7Qay6itrwd/6WKLalZgen88hIjUYYEjSGLXl02cqjaIl2Vx9y1motNnVU1M1Qyil20b7f5xPK5r9R6sgclTXuy29s/oIgCltHhsgGo54/QMFZRupTRKb1/8vKx6CdR1ZCjHp0fHxSsR7CUQRFT+cKZXspg45KoV+0QvqWQtofKNCoqnmuXq+ZYCKmN3BcunjmDAxreOQI/ThLLWH/lLh9quiBLbb8RKPoTyJnbjCG3tOFZg9lhnAjZYF3Oft22mA6DeFFPtjdMwWGoS0qfScj+mhBdJhqGrshK69lqKzF0XCmULeENJ9c6yCKYHyWuEOa7+iDQCMEW4I/Ml/h3lGZe6LJ7p1UcVpvGFWG7Rtra/A/jvoxcDNeQPUIik//AMqIalHxBFyfyLpENWrfLgvYvkq/bmQPck7XrwiAI/amnjTvna4Z1j/9xLjU+JtSI5HGzi9sKwi3gwiSngbWBI7VHfnIcoosZwX4+D290YktrSvBWSln0KJYTLIApOEg0MXQI3jqMh72WZKkSXZinK42tAXbcsrLma6yj8t1oabTOpYOrcDuq1hExLHJB7ZrH50orGaQ0jHan4ByEt5xYAYkqgD1dFv98w6767ypBx0ejI1HxOeVJgbwhUF9LVz5yADONaOW/lmsZGpNL3NGXqTvqDBpxcL+IwR7uZrrxNoZVKhcvbb0iCtVyVM+w/InB8Exi2LyewP0a0WnBDepag0eCvL4o/BSOUWoO9u+d8pdJeqXsq5QTQDhXMUAjshJm9rFp3MyrjuM0s0mKA2Xv1LdaODlNZywlTKzJC2RsHKWUqQ/9yfQIoIVncfDd8d3k4GuGrQ4mNn3o8QKgqV3sOJU5+ufHaChvMlIy1whVe22s03xYCkGhAYqFRzuJ0teL5124WHJe2v4QrNSeKMEo/lCjVSQIjooamRoKbZLF6Q0aG3glpZCdW5SGych0H89RhGsOHi6eAbQ5F7V6BAki/uYz6XQQBbLpVaAPsSsKNS2W76e4O42iAJQaVQIge97I1sUq0Y4dtThOuIUntI7rYeI/6Mrt62zOh5WC3JKmep+ST6ECgLlVhU6R+UOZgpUurD6PWVFKv88mecsCEXs2ij3AKL1u9mCWUOWcn6MUt6zuKHM/S9jSbQsL9fbDXF9yhCU8jGM2Z6VrGIttmC9W37PTYjV7+9iRQ7kLLj1ZGceM6DzEXrs15oT+ti0ncntv8lJvweISypNYLIxP6iUaY/SiSesMAR6cUkUs/+5u+zBhp1a/2eqlquGHK4vkwdIcoyJS6B97Bcsh4xYCRDjsdDMdXlKaUKoIEAyX+hFfx9s0Y0+bzD5xpY10UY8g5lSSgDarWs8MWd3sok8rojUDyZlpNEoEIotuA82oZNuWAEgV6+dWktmhlFi+tJgzmj4B1/UnD89CUmVGMyi436L6Hn9TG8gq9Q+iddXQ/I3wCFlTQHTz2WDBz63ydaYjVY73UpWqvHXgAz2aY/hf3CtlYuck2raf4GQ/pQqxRYztfIlMdjaT2u8zFw/StiPaktrUO1M0BSD0AmQ9Mgonw4kxajAJSz0t1aLpwJqZPmsl7SbpRaGBO7FRy+YkUNR+Y62UR82jbd0i2CUc/g/TxbWRYpoPPChOYhVUIBwFh665htES+O9MSHyEIpZuVGXTdww37xDB90ZM4r3V1HgbwADeDzYoYqK0g9baTqb2nHtvXHKZiSXDHcu6Y9d43a7P42PKimL0nBhU8NqEGcgM/YPL82vQsmA64oJcMi6KXlLpggo56U6VX4JdouDHUc/RsCN+tcnzPtBB8mfr9g25EC7kd3s18TIpG6LVBwX4pRSreIIwa4CePyXHqRQL0c8KXL/8ysYi5HXPS6BN8rrADkyTHAeBN2gE0RaqcGNLMJrd2GdldVTF9ycBWiTMrhFfq8Ui3dt1+RpcEDVWhlp5Yyf0dQyvaf21M9xIY++BdpVGCdaKO0DP7of4KXfSOslxvmi6b7Fq1olz4fU+rSFFSsM33XpNE0WSv5EPJhr38f9ZlZwvANuqeaDIwbribrQZ4pH9uD/B4NoVRJq+hwA+H/lJJL/2eyGK5XeBGMjyztur83b/y5G/580yA2Vkbh2O01LDVjLi0Rzo9thdHaTostyAPTMVdZUcbx6OzoCe9hKmwGB1juMPyz2/Np0gQRPP+7AR4TzlZFvuCTwIdd/t/ZpK1BetkNA6+aRvC2djaXFkb3kJdWX+rf+amYQJ6/O2T5FLqX9g3GJyLU2kzuuXZ7GGCMwX0pSafjNqwOlmLaHjM5UNYGuXANRVhSX6Lw5yMSn7aVE5PCoDHgjrejbKuFa7pHsoz02SIcxPxkipyIh6D6EmvwN9TLrcCX7mvJWsA1Ync3wHq7Vz1PEiiMNvqRNKqAVi0uwor2kPbdYOzLnTQ2i9z1SJMwZwGtX1Gn4i/lFySnJS69QUs7qWhEqkNsg4vApyI2xD6airA7yDouknbwzv6foD/S3Sy19i6n9Bmm8jMK5VSHG5AiVR0KebeG1ULvHZQwwuRJz2sAw3koZzc4b2SOkpX+/PIKJ+wrpu2061gFKwydOX3skNaVLQHGXArMgcvqelxLvLIYlnc9gFTbEZYFSlFdCxP+exF56XknsjWuYD+QhEiuZuvYMlfLPi0fWTFaIBQ2uk2vpBXwQupwrGQu2VefJHWbuMzDYszAw0FxI28Y4d7zKI0hKjnN2Dd4rU8Z46JE6EKWIV7iZRZmHjaMm92YckKb8/qDYsczN1QkSci9WN6TifERTLnoT2qmR5JWHemktCFysJvhGgQeTK4Fb+dhIfYze84iP165xQsMAfpFKnnheGY0t9UzNW4fBap2uxIiHkIc9e0RdYbFfBvvtfcKYma7qV8RRUzOkA6uNmFsH8SbnhyXU9u+wPppPsP5QRBOuNF+ifXxlEvPHV1sXsSf2fG5sIg9Pce1kDbBf5Tf2wF0njoQkqv8Wi2FwV8/mRLcHIHGPV+u4sCH0wo075Itni6QWsXJIucIGYDkKcY8fo1Q/1YKHWw16tBeu1ZX+r1J0yaRx8Vf2wD8HviCl78v6QBcljoxpEri1shbXsBHLGm9dovZvLbBApk85lQNyLN99PFksB+rgGDLC+WjTL0b4/wHTM6fKLdMJYnjY4FTSWVV7XYnvkH6f40PISnZ/DOpUnj5SOKGlYmwHq1HQj8ii/Cdy/iLb7pxvIh5cECgmQ8IFC490jZctBEDyygbozYlstAnguA2EdhhhVlXzxyF1MreJ4GyTHDSeTLFfjaDRMJV51+QDbb07ERbKoprA0Kz3O93zuyrht3xi38E4fk4lC8h9v7q6KZFOHqcV9Few8BweEC2u2HJxqc6NijsQnVke0ONHNEgRvXg9PSThmEdEEWIWPBJ32bugs+cuaFEfuQqe2uZVjK869eSkwtljysKJ1HTjGyx6DmM7CYHRn45f9cSo+i09zGrf5JgGdDiVN7L0H+TIz7YyWYsQrhBdZ2fMTQCxMbAulJy4XaZTWn68Amv/C7QQ2uXmLtH05cz7pXiKf+4z28u0GU0ei9rrzmrocyEMTMueNZ5QaaMZXg6WLurWdxBdRWlc+cuS2KCR6vT9oAAuJG/oN7Zuonl4aQg1tUukw2lKyKLVP0efnOwtPGSM9+9ue15cod9N5CBp/kgoYAMZNe8wovR7zE8Ya9Y39/vtW+jHtTBp/3mVped24kzzIjRtaeY4y9BsLA2Dho5e2jwVJJ6SVJaeSnGEVwS9nOnkR7GKRNk/yh6IvdW1BFiK5VaQSe8X9aah21ql1YKJ4lfj+WagnVYqGLvUufH/0rJarjjt0W9QjPKuBQyq/eI6tqA+nE4ADvDkM33R9UNRAIx7QthoCgZueSXqZ/0N/iMAGEa8mYcfEBhx8VilAWu3Znk7Z7agXji+y
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e7392-653c-4844-84d6-4a8a950d210f",
|
|
|
|
|
"value": "pl0xmipsel|d5abe44a8151ca764bccea7bf82ebb47"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e7392-3000-4325-a013-48ab950d210f",
|
|
|
|
|
"value": "pl0xmipsel"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e7392-6748-4a7c-9f24-435e950d210f",
|
|
|
|
|
"value": "d5abe44a8151ca764bccea7bf82ebb47"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e7392-9468-46d0-a8d7-4164950d210f",
|
|
|
|
|
"value": "7dc2a20e6ae81fcc09d96e9fb58f4ed4ec06d9d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e7392-aba8-41f5-b6c7-433d950d210f",
|
|
|
|
|
"value": "7698bc8a71875a8937488facf779d023834f92f6ecf1e926fce7e5857f8b1306"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e7392-f3a0-4ea9-a20c-46d4950d210f",
|
|
|
|
|
"value": "119796"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"uuid": "5c6e7392-0974-4001-b08b-4ff9950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAN1NVU6Xz/FGdZgAAMZgAQAgABwAMDQxZmVhOTNiNTQ2NjU2NTg1MWRmZDhmZmUwOGZjNDlVVAkAA5JzblySc25cdXgLAAEEIQAAAAQhAAAA2YIHwY+cSo9WPqORAouBUvixSOkBk9XlcR20jWfColT7F4nfr3AOu3Bs9XKEyXgQYH6nZ7K2uCyPwpUYRrV13LZ6PEvW79sOxj9iKG5zU87cbKMkVE+zxAPzXi+5vqFwGZ9Gwa8U3RFt4nsXLEGv+y5mcIby1KsNOiEYvyPaXswoay8lhTXc9TJIAZNrBtHz0VN84zmaFBIt9T0dgBG8qDdRGS8IbtAMShtBngrBjTlskSikPkiAAGQWXqrM94vi2iYjtkpRlWtUIdAVc+uSflX+p9ZhCm1PmnzoAQ5VCzbNIa4KXU7tTJC6UoGp0f/XkYYwdKpt//6RmlW8ST1CUEOAe+8hT5BvAtTm+KAQTXlORZPPf/DXEjLy+ppYd4PDgO/xxcwigCsKnNUzXaeUgfejO8PmBJJrADBearbuNJpBPYfxclHWUMn+Btwn5ZfYDX8h4tPTaLm2c/8ro2tmNjO3AzV12d0kB7ahJt6Z/AzgDEKGUavufF6zK5BHE8Gn3HxBRyAF1QoXPzGoI2weRn+HSawtXyb/+I9dzeteY7gWXe0X45AFn/GX0eXkJBGvzVOqxCWhOLCnwQqj4HrfGSHW/p8NXVWFqPXIxa8N+pAFJjh2gxoWK0ZFPQFGiQI0VC/vAXCFJKocFIkTi8qrIAs67DYu5zhsfJ2r1xQDTncLrwxBryOUXz/CEfhX/GYSDvU1wQWSEpIbLhxrbEnf5IBvRmf8/ViF1Ax6/e7iEuP6ZssEBYCKjZ25A/T0lBI8xbsqprCc7R6rHeHcbNe1mWsb1sAMn3srR0gQhgouFfQYv9L/jZQ7COr9XOZWKRwVNEXW1nC1fhjDa8VZyNo8JURBVXbOIgALFVzQbS+I8ngfO56VzQL8OEd63GqAIAtKxD1FQJlZvyQRiV3HvWYTcy8Js3OhKYPpJY8Ik2Yj0OiXlEne3LeVAXNmkopEf0yuhqsenkOS5S+CSpIB0k1i1eX0JTMk+9luVlHl7TpWHhiHn8B/rLZYXkKf9cf+gIgrh8vqxGPggNjpSqWUXozefx0Z4kEYqYiabrAPHNhGVrOAkEjTsBnRRiUQSIVr7fb9hCAJ8UV5ifr93pobkKkxfKNum+zW0IiE6HkQVIUuBbW71qhf6zJvtg+WW/YtXDvw1HqWs2WF22zUSn1qbNyuxRacHDYVpb5y7pPR0W/CZuTSDiPuLfL+YvsYKVfdssD2+fMKAc1df+Br3gAyE3kCnDocL0IYwD62DihTOD1E817kM14Rinqbj+FZXtcP0ALGLecjTnMp16FneFjrYo/x+0l7SBzMzQyqvU6bHQZJRS1k1N4MmO99gkAXgTHD9MCPUJaQZNZ7vrGlVpx/o6zo2FmbCXzdGXquqzSYbrrGhpJ+q8JG3RrkdAa/pRRlxjgMrblzjoRq4OF24k4QsWHcKL7D9F9jfwF6LYl6312R9SE9gogE+yWbcY3/0+pLD4VDgWhJH3StUq6ixyH+Vj1dKKbv5ore9VPQ0nKVM/kH5mzvDeEXCCuR4jXQPi+tLwONZRQJlQpN7QIg5J7Vbj34AUggm0xCYI8lv2MFiRBr9O+PKnszSKAMcRJq4hAxQbOI8xYR0JsxwjkZSTqCeWv46heqTnlGCSdZeygrJrtktaSfulDDwQY76Kiq2QNU4BIqbVrNIA/a/h0xsa1s8/I8cUMamOGKvLoYm1f9MBWGe4aVPEdP6JypwkdcGneiAFqH8IkIPIwADAO7c2W5Tuten9KgphfFoHKYZ4T3ubq9tikMhEUHfpcox2LFjBZ7RUlQLNuDoRLztrjgnJ7MOOvry08+FNTPiQdNtlKQ/5Q4UhyKAy3NxOaG45f8T9lCT3knNmZuL+xH3gd5fF4u6+rY5t62SHv6zF4/92L9DtF/zNbVWEm5tBEXZXE6FAw3Hh2e2kigTNM77Xh6+FUphZ6U30cuebN/wDfdySgXZuxN4xrfdrkFawwrRLLKETK7s9TMQGpFbNFifN59EAPi2LhfScXqgli0CHLGl2Dk3OBmZQhdDlPdlDxgXPOXJH5gUBRbNVKPz6WdmMLojJ4puIZ1ERXPLIXRMdmKC5lJK21wWft3YAlwQNcpBvWycyzLrCbcOm+nONyKLYLg2paoMtdsbKTa1u360423UsGYcAMHaY9Rjs202/Sj3y4qgAa0citDq7ESfTY4MDU883FjGseKherUKjeCHUkniuU+K09DFd6Fqh+U5LXkD0kWSDw4MiGoCrYoB10WNr0sd2KSg46QWXvECBDh7ZeRSnQy9fofg75bX0Rd4vnYTnpnbpMpXkd7s3g22nc9pVofT97csE9x1atX1Ar9plojrz3vD+HqpNwsIYMC6H7S2yrn3tepRTD8jsSLzjTjM4eyNmui9bxUU2Ee0G2wZKJ8wIUG1C2Nf02K2XbdHwyqSaJ/8IJnctFPBSMcJ7qzoRN4FzKPW9f4bPe2oXJZZDodfSevkOD05/cukWbZfQA0dm4esUPH51mkzDypwkISbEkOfxGTmN08rCn0VO1cPrd87ZCyh2hNTUtT0TFLJdTosMt8Vv5sFGOM9VR0X9QwZzR71UnLb6YVfYmQmGQ1IxHdJOhBtMmo1C6AJ9h1mPLDvsP4CwMcv2YvU7WZ8nOnKfCTmcAUdUiV43xlwhU4iTAbCBvtWFmFYrQQUyNfTUezndD1j2/ley1hl8i/206ofd8mIam6TOLJPr18qk+tcXXyaR/4LmBasD/fx2RaoGbrqxpfpyqMemQOJeb1tVDzIn6nNGfDK6/HpomoXG064sY1pN5c0OR0jlu7iV5JefpTzsj/0OljCA6zGhEOpzVzaQ/bGqOHKCHevrAYA8/9PX8WToOCPl+6p/kgcCnggGqKPMlAMugS4zGzGxpTJa5rQ6qkQwrg9bVlcU8C/ErN8CdI5NZnc/jUQDTcaLbwowOrRL8esGmRK6hwE/aBMSQkI+mfZU9mFXQ3xp/YsK4rlQOMrX+MdyvyihwU/K3pO/RejZIYz2H4Q4AIKmu9QoJojSt+bpc5PQUnIINgQJbXTgq9AXM/DDQMEHHvNntP/bPvlbTVgOHDFbUAb4zxO+jHHY/yIerFAT5JI6V63Abjngri0uAShbobkU7dYCziIcGyrlMU03T8oXk/zoRog+dsrz+V23Hk6UxCIUi41zd57RbEDqeAcLMxun9k573ScfoUDToL7qaK4EEmZPi8Wg9U8K/BOMX7aidy8JYfZROANWzNDC2hBqExJ8el+plWp0To8NXCGLuFXnk+CPVHhNFfxbEss1HkL1PtBUaFGCkDVTk0BoaOTj/qQg6M6hwS6IP3uRNvW8rzIFfDwpZkjA3FfodczgYgl4D1bFwUq4QRTfy2Arak29PZ6CToBj304uXbqAWn7a3x/zUMVKs4dL7rpZ/l+jzovBc8SQk8ss8loNqFEnsbVNcDVwpn7xUpTjCe1XGcbZv/vQitGsTrm9PX/9gFAYeaKDOfcbQZiSKx+6PF3ROMU5u7EQZuglNfpaCnwaqMpduqGVg/XBkTxvzrlnf4EiXOQfnAlKY3fvoBsx5wJZiO90nsBrIz/XfAkKsjnKXY1JDMUXxQBxQ6T61ObroS6rv1AJxNQfmKpAqu1FIPVOTPxOvS56iE4NBe57OuAlQNuJsxWFFQGnTHEvafpdqo0fZYurp/wVpvt1PsSUl23p5CBCEtN2jsHGD/r4FawdL7/hZXTfHCXFpIQ4eQs7pumXKcvvklZfoZwyQFKTx1beq+tvoWD+UQ/kwplSQ6TV15UgJEeYrzUWxWmuBZYPn1nJIhFgVtKXOhcET80QLrWUYIDyPoybiWntq/+GmiuGGosNqSlrJKKVMXlmY/qlJMxy5yDmtb4tm1ia60JB9lWK4rRwiGFOpcfrxw4gHQiMmVguwjT4qVZisldZQ9OrhE1VoAvHtyeO8MWR3SyOVBT5rJab3Jt4IxuysR7D
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e7392-6db4-4162-a111-450a950d210f",
|
|
|
|
|
"value": "pl0xppc|041fea93b5466565851dfd8ffe08fc49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e7392-a4b8-4773-bb20-4cd9950d210f",
|
|
|
|
|
"value": "pl0xppc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e7392-4d94-44bb-bf62-41fe950d210f",
|
|
|
|
|
"value": "041fea93b5466565851dfd8ffe08fc49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e7392-d7ac-4fdc-b545-4ee9950d210f",
|
|
|
|
|
"value": "2dd0609e289ad8c172ff2534010a8b9b56a54bd4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e7392-29a8-4800-ab51-4a06950d210f",
|
|
|
|
|
"value": "ceaace7eb68ce0faab1ce80a019d603c3f11bfc8e1384cfcbde13da4a08467e9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742418",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e7392-b0c4-49b0-a22a-4ef7950d210f",
|
|
|
|
|
"value": "90310"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742419",
|
|
|
|
|
"uuid": "5c6e7393-bc88-49b7-9f9f-4f99950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAOBNVU5CQcqA7aIAAJFAAQAgABwAYjJlYWE0Nzc2YjljNjI1YzAxMmQ4NTMxOWNiZGMyZmJVVAkAA5NzblyTc25cdXgLAAEEIQAAAAQhAAAAogG7K+usQ5B3i4wSolbaaC0J6hcHJiYgieoyIBaaqE3SjNBlFh1916TMhx53cDsqZ8m89F//jLNVWsqhW3a9ItRxO0B0iVBYXTj8TbAxIjQBEusMvA4dWetnqzVTMU+iau5l+8yGVtgbBkGnRq3B95fkes89B7aKqxmUe9gJ2MxBLkWrjcI/XyUa/wrQrqZlspSO5plIwGDYaKSqUppTGKTmbs/ARBTsD2dLcgo9493IQso9tZ19LlyfS+nIsy68Bia+f0R3CtUOv01vzwdkscTfHlL0TEJW0D78Rd83rXZ17zRZfg+A1VZvjTMiPhstwwWkB5s2vU8D1oSwpH0cU/t8cxV+WsMJBkbNmdmotHuoDEOcyMAv2731If8UEf58ZX9ml2lSVsEEoVkwin19ug3CPm/vzbKv0Wim91h/OdFKr8Gjw1E627e5gqQOCeezWhKIWU3Dbblpt4s/cvPa9Aelt1m5ez2CikB2QWxFeHV+7pTxfZLzbBCv6qDzRyiX8yHkmDXSBZQ4WJq6+z1IeYE9mX//eTexu5s2NU6/l4e19PtzFGv1AcjeuVROGdce1vwThzv3akR40Syd7+yNEB8hiMZTo+E3FTL+BM/5P7sEXpv2bYB2pBzGiOxW5xurfw7H9I/H07GEFNw6bfNn2IaveHd0By20sahJ6P6xWOCgP/PRSd/tMyLaXWRlr5pysjSie5YjRVhKOYTKGcYEU1ES+eIerZQCVQGaC2hG65rGC+5Rae5c2kxEXeGDYfd+o3z7Rsrr4vWmZWChmizZdauR22h0O93dgqEKwGzamx91KB79zyjU3HXcO6qhTieT7N5ZnsJpheLYbh+JXVQ7kwC7gaSrs9RZ5g5lVaC1YFE+zkdbapqbK32W2voCOmniTHDc8v/zNUGtuSAKHSQVsTXRDyeuPli45A3WQYGm0Q+lbqhCaFfNXoM8sXQs2HssDiIHXdzFUqB8iq49MPoetslX8vEP7Wt0GtKagEj6zzip3veA7GlBKQro5lidwvqT0gh43r6DDIli6sr/tMwMIyzM0Qc6dCz5MrBykgoplWzxKR1Ik4+qddUtiM3rIfyCcsy2gKQwQ7SNYnyJrHhUXu+qdc8Go+q03EsvZ9HN01FIOkP/N/tEAZCNrnRxAzPmHrWPuAww4ncs+8n+lo/20lQ5oJOcNqy7OOcUtTXqr8G1/SKVRa1jTNR+W82XdGgaSAoLbN7uuLHJjkHUO+KNxVjwcPzNEUl5Z6ZC2/qmeANHsOJmfU4Q8flm9q0o9po/oEBYsUadMRJvkwrdimX2wJa9yD3L/GTI21KD/VZmW4ezMZyIbNkS/i1kqjkbZRxuZOdPzSR1QMl5ZnOAFJfbiv7S7XiJrh828WBXpi4gUAnnmy590owEJFNbktnTKnq5nxS5LFc+uiprnv5cf8CU5nnfwWDtALDYmlx4yRBScw5WxMFFuoh2NTg5t6gCN6VijczDdob1m6pPwrG4mYjepBkAs6u2P5IUGIBdZR7HlDy1ZLWlFcKZiikEdZclvwFKffcmC8j7caCn9EqsCuXx3zklWpPNIjeZSl6fJ1i0z0c/2KDmSncL0xciDelkPYA7gzWX42cGYC2ye4kp6qmSmg7sd9lv2U/4mupd2s3L/GOKPSUmiNoBhCJT4wW1Hn5l/UP/Wll6gJC3r3fJlZ+ehhx8WJOwdrh1nJPaitwhd0my15yQShSjcC6yR8xqYyDNJociFHOtW8j3DyOnPAsEtwRqmH2lLUh5rZ0cL9I7PtGnAw/GMm/En+BqA2pW/lSGkDUWnRbLHvydogcKDSdp12mt02x+LVvvgkn30A3o1x2Ku9W6+IHoEEpFxHtEFmDXvNifAYpEIBavVINVZ7n6LvVcR6Rl5HyVgoBEjnkf5V+SYc31Jlltx3a9fIaEMEc8Dgk7goqLn8BFdHmO1uhoHdj9tpXBQ7e8B5xsqgD0eWSPaUTPe2uEhe94Id8CGvnCUrx1Y+NckYox4ZbwMAnC55S8NPreBKeMxi86r/UtFPOWThZy1BKtqMFhjX8kLEyfCmsoeqCE433JewbUAQQ/gNSb6qRJBjaw4783g7d4cQo6V3IBzzGebLEVlLm/2HHrQWHeMAYfMdmzo2R6C7/ef0Lo2Sb3LhpxlmdO9fCcUna/zvO4gyvnfpUI8MjXrhnDhFhUoe2uhUo9RhaNflGUHbZWOsz6ETfdBzetKupAevX/NROXmr5T48G0qXhwLiOApUD8DORFAcSZYqPJTqymhIwByRLl691cY6AMfolzFfew6WUvMy7ImX4X6QNqqyZNEx/KUTkwnKSbMxFqk4/AWCy2H562KBxzxxGAzjJbjGV3YLZpQc4JL85Pmv98zYLj/wpqONmpmXEKxF0DjPZ3EXXUHbUZV7rRTlJKVpXhQhCZgRdl++bXZ9K0U4r002EFSnqoLyGzFTNSsbjmOfL473WPxb/995tTuCC4FMpuDaIAMx6sY4G+q7CpVnDn+98vw5UJ2iPGeAu6G0oqXLX2j5n33VbeTxE1lghEh0K63X9s2RJorPqI8T4LanxvZi6avqVAmlLj+jk0SMV50vfI9GvH+qvoFqB3SCfQM+AxvdC3KzclmumkPeSSBDaNhpbCm+RJnrzXd8s4+63sMzm7o37zlxJvm7Fr9kwiw1FWkofzNFQSOEsUEdseNETCIHniQiOwXaHJ7GLVwl5ztNqW25R3DMN6kVD/85itHHYXubF50AWolzK1PHunBGQ1BDIpg8SCP5/shPBygDKePZnYU3iEq1WplnGpvuzcF9qOrl4lfMUHLlaIT6BquKETLTmqEa+94gH8z5TbGZSMYSFfz92+QmKX9meWiob8R30SDw9wB7s3ONyJ+P+rQYY3wNFd0dR9JHpSfXraxC1ZxnXnO/z1nyVdvfE6KNrb6roe0V9sFbCYtxoscPUdV446Gjg7mAC7Eou8SwupwMeln+oyycFglIYbQyfmjmQz+gLD8bfLBvqW3c0aEMZg036y+631a+zsTtnTQm5PVPTCCn1JSXXaF1b5GyrsWPc7VYaXgBfb/MuuWKiWX6/7LUyhrGlniVe3fBytmwOS8JQ3AyW9x8rdrrrJtEjOza6mPh5qAJJ3hOi2OWLJqnNrlh/Figt3ozMGL1lFQsTxFyslW8JFLlxtPTpr8qUwTvKctWXcbhFYnP+dm83Q/0jwAthuXtoiaeEOa2P7wvw4S4BMuIn3Q2S7/4olLbRHaNYbboexL8t9OQCbInnSPBX766Tiu5sNplGEcqe8LLothZcaY193mz5XQ5Rz37NKaY0yLy8AQQTb+MLLq8PBlBLi4n0RXWeGBess/UhjYSeMltl9axJatza9Z+Hji3vRGGTTQMWPvJX7mx9/HV6D73egzSydUT1RhpqsG4ySD6hgKlwi7QTPIkxhAKt3h/jeZISR4RsJV2uxLUkbP/4PCisG2yW1yTSDrOH7GWCxOWN5EoexOmQMgxcHZsoRPR3wvku7kJZZVaybBDLJ2TO6u3mIqBzY0iBvb1XuxZL3EojG/8/P0xPAjguDY5MXjcLjzgNB5kmMiS+L5W3/ou5kSoqjOlDr2479tk+heEhgfbkZHdDCo82vS9ml7yta3oyw1D7vogpEJkVVAIUs8abTYOV7gGNCj3wd/xMpqJZiINOTLZqfEcEMI0Df9Ol66g8Ww8XIksrjStcxU64HUdmlBYfqCWMg7yOkCx8RqRSYUF3xl94lk0H5WiI0pIsmxWPfrZ6Al/T8HwVUUxMPgkuKu+xURgWkLiZoxWOGPbI5cDtEQEBpTM6x2fyHFezQDEzMnhsvjSL6aWgTcgbXEYIzPIX6jSb2Pz7vGavAPcnyujuODNmqwsMC/odqyHr0niBw4A3B2znyz3aI/DQigXuID2phrrxvrL83iXGF+q5n1qaRsLE+qzIA81dm9shOSMkSFSSRIgqANgmJjnYUVf
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742419",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e7393-1e04-440b-9698-41f7950d210f",
|
|
|
|
|
"value": "pl0xsh4|b2eaa4776b9c625c012d85319cbdc2fb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742419",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e7393-43fc-4731-8ff5-42f8950d210f",
|
|
|
|
|
"value": "pl0xsh4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e7394-21bc-4326-822d-4741950d210f",
|
|
|
|
|
"value": "b2eaa4776b9c625c012d85319cbdc2fb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e7394-8fbc-4c4f-887b-48a6950d210f",
|
|
|
|
|
"value": "4bd652c7ec439021e6ba559eb5b96a671aa71386"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e7394-c160-410d-b19b-4679950d210f",
|
|
|
|
|
"value": "e3e7ef4f1b56b1a6a208df5f993989b2df33ec3c9e27a5bcd8add0bb40b63fe3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e7394-216c-446a-ab9f-4bde950d210f",
|
|
|
|
|
"value": "82065"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"uuid": "5c6e7394-dd0c-49b2-9a62-44f3950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAOBNVU40PlpZgaEAAByIAQAgABwAMzg2NTU4ZmNlYTg1Mjg2NDA3MGYxYzMyOWM1MDFiZWZVVAkAA5RzblyUc25cdXgLAAEEIQAAAAQhAAAAWFhGQ7ja/Uo4VmCrmsCrSJ3J7KjZbrMUIPE6HXjB1VGHEpPge/PE6y6Z1qYrPKUAmlbWEghZkXVaul6QuViLHMhgW8Minkps8vT8sar6jrmdq08CdAxqtKwW01kW7S11HKR9CM84xB+WbcHKZoeEAIPFG0328MUjyHp7N6mXSdrVNt7bYjB5GpK0lS5JV4ozdk3ioBvU0fZ6VWo9pLRYmPC4YnnpwnMXVGLCoM/0msHd66JemNBPwYLvgnsEJg4pEe2WvISaYSxc9Ea34PR9/WC/uI8SBDJoLk3jKmCk0H23VduhtIgrIn4YLzenELF3qw0p8vMzmAoHfIMqAZDUXjLMkkZP+AKFfgISUV2QECp950yF1yeAZDVFWOzR7Q69Jg7r8hBlaB4d1CwjEJ0Ysp0N7i1LJ1xbXwEtbKjH5yEQI6/oYGhlL5OXTTpbVFnAby8NU2SC/U7ZLKlAyp4v6oEX8JccDb6N++JCtNpw99IETFCe1N1o3gPNnV94c7hooBe5rl9gv1A0gZY/ecPFqQmHTAMOxqVoX3WwodXhhZ1b9RQGa7raadrsLTnIdfceMg+GnkQFMjweLgivpIBXIDfwMVV0MlJg4SDromG/TU+HVy1VfV4aP2IdV70WLGqO7tvmtVj84SXjOgtjm8sFtbJYdB0hmvjXJYMg4x7625XkrjJRiLK4bWZRupUSgNlmiVTJiBFTj1uf/Z/eilCpzIGp4MmRM41O59K7ep/eBxGInD+C2BC/UaOngvAPe6S3AMYkwY5dw1Fsyrg3hu3ujiL9i/8+wQUhrFoRqKdIpJln+qjO5nhHZ1uynbQmZQK674TzqjsIFBXEoHVpr0InuMZ634NSAlCPR1CmselhihxKLE4E8KTvwztbjUhLlBrJ5xIMpD19kQiqImZQwpwDOWgYQJ2gNfGiWm99oIlrISrpnx5M8dNU4l7ildU5wYLkXYnKLwsQe9rRpY5fizH30mHPT1l9O8s0r1d8PyYW1UEBEpr9e9v8Y9KNcFh/J2T/In/xyOaEAWWuN4v5+LhA7PEviXm0QJFH8DDcn7UEdgGTBZwRSBAN4ej70g4e5ZUXUWPwOz6c3uNVhu/mQxSBMPj/FM5Cp5de/E+/9svAQ3BvBC6hipdWrFZ0ciTErW6LemKbku1OxSX0RJcKn2oyQhDn4wlBFwM+PhEKlaztiwaA84f7qELxBaWyfoTa1hCEKaSkSuaXOPukaRma6yRIJRIGVWPaluWXfQJXxVCXzEoNMpSD37usGvqLN8vvzGQZ0D12m3KHja7zJ5Uql3+FvJ8WeaZGZzmpieHOw1Wmz9z1UOwj7SjqB7vlgBrOnuazoQK5LTh+3MdiXur5Nc9GiKVfoyrU4TEb3zClXvX1nxbh1cy0m8T7yif/7xf/JqgSx+hpl+GdXlgClSUah2KJ9/bryf0QXElWMblk/a7aKKUynbZpTLQmJNRSQ4vQVpvq050KoEPm3B5XdM4Hyhzc4wjEmHzkG4KZXvggfTHg6oS8tj89k17/2BzBSHvQk7Is9eBkKhHD5lTTwGEk/Nw/y4u2hk+9tIoaiFmPcnDwq6kaSOVtmZ46ACdIn/5fDCCZ+3QJRbUawEUgcd4OHp7/Ys5lRBL9P3yjJOSyotAz/b6Fh4s9GRT1Py6DP8CKwTdw80LkM7vBtbG+IMY2GWBukdJvmo8SmW21XQIboTpDSqs614WdU2sx/5adKK5zbiSNeVgQk+CxLvUaZEUxubRvzQI9YzXtoUkHC/gtTk0sXUE5cilBiiAff+vnGZxrQgcVju/DQUkfNW1VzKD8LH/llL954w9QOwzXABXCRnhpa72BrISAZx8njz8GdTobTTMKOpfvoXT3mxgsYDK8y0Q++TBrnel7OSHo0MyTKCN6mdnvYRS5Ym6cc+vskhITnTnb97piC/pX21zELshcligFAOW1GtAcC1Ogh+q8IDRUwDiqfb6g4TBQNK1R+Szh3l9aJqr8BoufSq0LzURAFa8N/8BGsuK2h4H5o+yX77lQ+mb2LE/OMTSJCBSQwCGeLV9WDVRG9qs9hY2pz+Rm66eRCIt7tDIfRLL0nUgMoAtW/ZfXPZHt4kBNjkPK+JWkrfeHDsglOGRzZMUt0lOmOn69MAziumnS5BAh0ax8xu246jLABP2zuzeirTNRTP06Xy493/wFQlc8ZkCPkNHtk8Qj6Fs3OdehRyoaxW6HmdQ/VXA6cFCJmqyC8b92iOKg2MCNOjdksorGCR1afKhJH2IpnJ2Yoi4be+J79TCn6E/ZCY7v5p8d04BdGqliCq4itj9Fi/zslXpYp5Yx9dAEj18FRnqtbtm+labcCObukKdaoUS9z3AgPAAibGvkexnplVuyWxwsOwdEwYujBppYOywk2qV93HhP7AkNKqVJsvRiLLLyrG6ikeNPQfqgnb1g/KXyoFW6fr0LWoPzXOnfVKRvtbDfCDDAGF1f2mlln9ifHLfjJ3elUBVl1n+8/2iT5KqA3ajyP+j5ib1e/psagta1krpHTJaEf3/tRGvBLPDN0DZ66kaMmkueRqz2xauIUJa7TonLH4a9tEvLYRi5Rwn1/Kgi+LKpXlOgPyNJTVV0EGAf8LuPZPH8ZyFVhhDDf7rsXRSZHpikHT1u5cgf02FfR3RG+AVTzoLlfZ6ndRGHjgjqPLdDOQdKleAmwnVv61osZ9KBsFLAs9rm8VI1gzgVLzgvIS9TX2QQ5UuJhzQPVgjavjvcCni3TqQcu+PL2aDk3xYFZdpdvywcEk0XtehXGa/n2HWqaH5C727+/kR8gOOg6Gu8+FpMhZ7VHUiZhjHrqNRuSdvQ7QDvbgvY5WSQIPC+V4a1peRCH945w7Og2F2XPCYbUCGdOPit57lY+gVyd2cGG2IYUb1D74z5fqXMFe+Ud9epffBZ3HOJg7tHNiaklxop38fXKOQldTfa2QhOJHy/LcVN/Xxh0o7NkcmBv23T7U+Jmkeh01dbkhnx55C9zU2+E9gNamKqIzz4mX4j4VlNv4E2tDk/ohOdEPqTgDI+QW/zBWYHXXZKgVDrXZuHQ+qaF7gmpP620LchN9kEQcND2mFdibEFeY9/rVjdGVrsqjSd/P5ImsDgI+tKO8jdDaefQFWR75QRU1CLTW+L3Ha11ObgaRICmY6stLeAm6xdl3ZjY/t/z3OjrIgyl+ltmzKt9rMpJJmNMSR/jccfnlgxzWrHImLluD/OvWqWXf/agfuW0QgkobrAc19LKT+9wdvHhtIcBUTXnhHxatK5/WE/ryLBHk0SE6flf2DrXnC0b1WtIibWGHZ13gJh25halQ6xsiA/iREOnpF4+gZ28pBNB2EOAHaCnMPP0yrcGDarC6kXo7ImPK3bpFBrjibLUICNFMF+o427tdMCqs3HkUqcgB//DCZJmThB951EW31z+/nnvpIJHbyVHqqIeMFhGmc5GoNTeiqXzxVTcXQXrdGBhclsZ1pm6KsBEF6uHBUI+jDna1+vxoqDlBQXJ9NDJDQyJmd7XwLAp+gOedfU59uPYkZxBUku40m/his92Up0W+1IeTDeSME1Az8iQuKJFb8o6zjdSxQjw9ZOxMfD9x2N16TRjlOH7qpKJ8PkiXsf1CzOcTizuUb4QKN0uhULpVGXDvzsP0GGr3SDb1eSU3RaNpjPQoJg23wJnYhzwNd5Pwf2nGfxgCtatEWFFYUgD0eslI0F2dBjYcfyVyetlNE42E/k3yQ6lM6IyJwCa6+5kMxqmqe5P9rOXbdIac70cQXBu2yEThUf8/5DRsTPDzhvu/4+BvwUGINQrlT/zARC5HO8R6LIQuare8TQ2aL/YIr2VaulzauZS8YJKNj25jbLExyddPPVsw6gMXm4A1RQghY5F9h/gXe4wMeHI58l8BY8Ac8SeUAKdt4hkRsJW2w9R2si7s8vd9r7BHrbqcumsrgrnomHFFfld0TptfIyb6/PN8
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e7394-7d68-4c22-b53b-44d2950d210f",
|
|
|
|
|
"value": "pl0xsparc|386558fcea852864070f1c329c501bef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e7394-562c-44fb-bc27-4601950d210f",
|
|
|
|
|
"value": "pl0xsparc"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e7394-c500-470d-ab12-4b45950d210f",
|
|
|
|
|
"value": "386558fcea852864070f1c329c501bef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e7394-9f80-4910-96fc-4370950d210f",
|
|
|
|
|
"value": "190700ca3942b310ae483f46edf8e4e7e3b741a9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e7394-1904-4f61-9e62-4c10950d210f",
|
|
|
|
|
"value": "f8bb5631336876a708796184833c78a8feee167ac4d65da0625c28ab9f32cc00"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742420",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e7394-ba84-4f68-a29b-4e7e950d210f",
|
|
|
|
|
"value": "100380"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550742421",
|
|
|
|
|
"uuid": "5c6e7395-aed8-4781-aad2-42d7950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAOFNVU6HQGHugJ4AAHVjAQAgABwAZDUxOTQwYjFjZWRlNmVjZGEyYjczZWU5MWQ3YWE2OGVVVAkAA5VzblyVc25cdXgLAAEEIQAAAAQhAAAAJ5jdr4MPCoEToeQdyuAF7Qa55BiJ+NWibKqyO9/q7NIc1opctkSOU0EM+80Yx6cbwwwL2UbUVqFckWhDSLGggy6XomIeD59BnX0/KjfGFkPUTUtylYFSWxXBRhip365AtWDTv91k4OWaKhuQ82qrLbSYONYQZTpDTd65Ga4SxkIjEnY4QVW3nReZQPVOSLuoTnA/2kiVlqRDZ1zNGVJxvntvqrEQT1MROCPyWkiIoNm20UrXMyZ+4+aQFbauY/23iI2JANjhmBN8C/wXgF62MBoPyz0X8UplHGd4sYmficvFqam/Fq4tD8F/iXFojX30Nc1m3AE6BkXhElrHRjrOpA+diyVk1TP3O5Rt6neYZdVW+cHDlRX876+cdvEVwBClcDDndeWqSnjnMFjbWOf2+nIS87ZNK+k7KLa41noMmE6EjwEXocIclxfbARruABT7+M8pvVMgsk+1YDBqNhjDjlam0Z14yAlhrDowci7GVT+A1jqFjUfXiqV7nZDKdeE8u46vqqOI4oRoMxNS5wiOm5aMNuwX7EThlMsY1OQu/FVs5SXVqGvH5jyn+yuJvdrGj/aZhLuaOcGotFkQFKbt3lyXuNLQgeqkrq4cL7h+zNOh0jahSYsCQ81ZnsD7k5zi8IXneTOqewtLTuezO4ZkcdogbPGIc2asFPTQFSAKSaP/5hX0zWGuegik0PujsDYZPKAmTuOtHOc8AIfp8ddlqKPbapWWBbMfXzJOazaHFcvnQl7x0rwxlsjrXRFjzvixXIbwz3XIja/yzJ/axVsb6zw/Qc3Cefqc3jue8Yz+NqFsJnoCIiPKHEamrFl+YsD+W9L/Vg+Yt8wle1/bgc6hDugfKc2Zf3p1H4HBJqdYVG5JDRENYZt3PgtZB45TjrG1RqEROdryMUsC7EM8i3j87NbvU13mgE51k/NkFJ8LWEqNFBKfylc4AZq7p02DS5TGHhpMoyHRdV7ahKHdqc0ngo0/OckYpa7y/fdbNizCs7iw7lHf6Y/hJYbaxFx7pl/wmuqc4u0uCzcsrI5IwWlhIOoBvmMm83Yr3nMQrEqv0E1XQ7ov6GhSRqyCOP5UScCnbWg/4NIooX1bJdSFkMy5DqfPXqkNlqV2H/sspi+SIbae+U/4kJgvelvszleznHjdOtL3UmSdnMacjk0RUM0qgsFZ4e/dHi1J0wG2cmDU0cNupMrQkXR9CYtChOX5fiD37/AV7tfnmv+cmRFMcC3We0HtSmHEPVvTQVgyUjyPLIJ5pFhicqD1pGxwI7eF8umV92co+RRtHvtBJczv4z5dhQA4sH393TdadVIAV3xTzSauv95t4iFUKPMSHH0tLSw2eHMHHcpopfJ1/aDbxlicrsfK39C/WNpIwZJZG4nbFLex0CcmcDxqYoqdO6wm8rxd3K4oynPSHR6yJ3TY1ItTPUjKDrhPy7mjr4VSy+v4QQzI8qVyOSfIkM3NEP/UZ4tuHvad9q4lEH9h2nLAY5HJqtOzn89IgdOhzerPJTLs9wXS63tQ6C3tLpCt8dKxj3ZSnvEE2ZXHdvvaxLdUJtuDegrs7Fdmf109ZzM0eEUPbBVYM6GAnTImfjIo0dM6YJW+rRSsY5XT2hD3g6ZmjK25i4tHaota6qeg/15qvSsKk5PlH6MJpVfCOSAelQ4yZwKjvfMcu7TTXnjgBk4T+IOqyG8obWlblYFNQ5pjbrM58JaI6hLs/1MmjnKxDmTkcEZOdOoQO/m1kITD7M+cGBXvwoYUpQv5yhfz3j7TCAl+TdqyuqablDIc6cfPxbiSgLELuDBdiKT7E/nClDrhCMHcRU4BraFycMrBkz35SsQyp2V3NQqT3AYhYQDnQCdmq9hUbvR/+RsUf+xpTo5pU+NckXuMon60xvgzoaduNP7RnycmfG7EburpceD2iXOH9/Zsz9MXRT+WNTVCLKCpLJkYpikf0UDnRXWpjeExn8wT3hCilxiAfLEdvkf8ijyw4uu0u/hIg3NqBKgk1J73UP3Gt1N/2+9s3qOm4gXET5FcwlWUBB4/oaI604z1AJ+EHpNLpbDtvAgk53RkHQour1mpckfIQlmlboBhJ41ieZU5ETr3OyNakljQaBi2UCRiqB521v6hNhJN0CPR+qaSpABu33gEpHgxTNPhc3wx3p7V2QmN5O7vPjcyPDZ1XLQkrJe92tu65Q162M7QtxQww1vdHkwk09nho29GDuhmBJPMmEqRik7DkNT3z4uQA3Eb9vRkulMPlysvcAiimi+DH+OAbMams4EhQNv2BiG94iYix0CPL+qK0WqeU0xjBhsM8w11MA4m2nqBqHRMzAnH17pYi6+oKLiasDFC6e+zgo+BqE4ef3SylM7IgRHjojAsKzRRMwaD1ZFepoSoL6J7+Yf3OkGKYQ7pWISQsG/uH6bOvcfQbg0kRisAbSqPLAA0MQRHajm9D7C7pP0W2NxXR0o18cN2hZWev5OyDI6O+OVAPP70ELBmuhGoQCvzbEzlgjfTXCfXd4Q2IWaO4mz4solucqq90BEE0lPyjQRI0xnSxGOZDX+90qo9EXiriWJJTiF2cScSYfVFs9zC89K6zGSOvlgwUQJ3IUoy1TkMhmN4YPNSN2W6ryDZytbq2PbcNBd/LYwiWNxEEJ6jGkeSd/S/NhCRc7z9RoxsQLyDdvArkkDOuDqPKqGnXzv4mlgGajwAM6HZP6po6x8g0c8gEH48lz2G/+BHQnyPqxZrWjpxtt9Y1byb9ljmjJnWmzHBLSP7qVeRbDfz7CbvchpX/GMNIcrao95KmOK54AeeuCN4I40aPlfYGtLP4PBoN1VmAsY10J66Su5XbzyxvwZWpUs8/cwcPVhOMQrHNTb3HRoa4cE6tKk2Pwhf3VlDaAeHKfmuNkYV3HT2nCjIhTn3WjLdtW01CJ0I4G3XjfTTLIRf26ySEAw9qU5m3gbkM2swk4nRNp8pnb5C3LN53R4TmAB8Ac2eGyHpq0BDsnh7HzfrCIm0fE1ktI3Ubmx4pnvmW/U+S2ZGLEHL42abGfWEotjITqWyXatohHGQc6XkYQH6GM2cfTuREAb7e4UW2kfQMwxolF5XWnLLDwDQ7K94RVDMCIqZ6bai3y8ke9tKaev0T9Jtle2Bg7s+SPwwPQk4v/NdHzJ7Qfhy3Jhrd8g2QqA4yll+8zdiKUX9WdLfgpAI1s9teME6zahSpYLCg9CopHY5JLG/dSh0yZb7lAb853ICH8sjRLob0CV2tIBxcWvnb8Hdtrj4wVdqVbJMm/PA+S44B7oB+G92a/TgrV98lgGyZLmlRQGkYRsXsAPeAJuGw4YvUlrm/LOtrUvbN+k/Ho8yJ281XQoTi0dfhDSQTDTfu/e5ImZKcsAyygD403IVCuWnwoisINgCQL6XD/QyCtKVy3Sm8woN8c6YfdshvNZgF3qQaVCAjw0oMmJxTJluAMkinhKNxd+qjRQYIbROuCl/5ppLzLlfiUmENGcYNg5esgT6LfC6KpCZEkL+XYlSuOg9JwSq017LZUprP927OY0fg5IRJDeMweIoz/52QR1+yc7yd+n6K+P5v0fEBRYeaC/7g14WWcApS+fe7dcHLesnSXMbjN5q0ohlzOGg0jb2T3oBz9bRQg6m6U9AwfOJWnJHOnhJLbYNCNy/zrtlEg8oVkGebiSxvraQnuIIMnVLFtqBul62+GSgR+e9M08as9oPR0+IypDTK8lss2RALC+EVu+r1drqwTJXg65c8ASunL9jmGctSI/E+k63sk551Bepoi7HIYeChZQY1gA/WzpbEXAeqgjyhYGKMtrQRU1hLCgsr7X+tbygFMHWPym+DIpHUTKncriM6C92skfmNlSJ2bZTDnPjKzdxQexhnpmo6VhO6mXtVmMWeRHz6M/IGNewJxPtDpA7KLa9QX/vQto/Im5IPHlvgEyYxR4DNwnZqncm+mcxuuBdqwgXJ4i0J1jidzKqPk
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550742421",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6e7395-de18-40d1-882d-4ed2950d210f",
|
|
|
|
|
"value": "pl0xx64|d51940b1cede6ecda2b73ee91d7aa68e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550742421",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6e7395-9a44-4bb1-bd53-48b3950d210f",
|
|
|
|
|
"value": "pl0xx64"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550742421",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6e7395-5eb4-43c7-9f5d-4d76950d210f",
|
|
|
|
|
"value": "d51940b1cede6ecda2b73ee91d7aa68e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550742421",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6e7395-adb4-46e9-8ce9-429d950d210f",
|
|
|
|
|
"value": "694e9658f66e7a490bdfd98e19c7e627b83a23bd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550742421",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6e7395-bb14-4e53-8535-4577950d210f",
|
|
|
|
|
"value": "8b5f33b88b4abea7848d5dbb097b545385b6bca9faff0610c78dec45d7577a6f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550742421",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6e7395-3958-4850-b6f7-4247950d210f",
|
|
|
|
|
"value": "90997"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "5c6fbdde-e650-4d41-89b0-4376950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbdde-e650-4d41-89b0-4376950d210f",
|
|
|
|
|
"referenced_uuid": "c445863d-249f-4f4f-8a2b-f334a57cd879",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-3f38-46bb-98ed-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAdKVk56iMjHeZ4AAIBzAQAgABwAYTUxY2JmZjM0Njc3ZThiZTdiZWMyMzJlYjY2ZGI1NjRVVAkAA969b1zevW9cdXgLAAEEIQAAAAQhAAAANXTo7hEx35WkFHG/0XIxAFEChx0rwYUaF5hyli3z1yRu2n7pxR9AnhkSP7KCboLI7i0tJkQTu2i13ATnpbkExR2efIC7CHb1YdLs3Iv+AgDB5K2424GbCis/257a/TzrFq1rhEmjFqSLyGB7cF128mCAzsDw1livvoen7zJFWksFAhgGszenW6c3H3nLwO+ml/rNc7QkhSFtIys7Xc9n8BXvpORxnlVVjY6gqERvsg5mvMKSotGbY/CDJECxJZwmQQeXeA7zsD7V/HheWgpNYRTU3WS/+x60WIy3UTEVC53N2J2pvgsVb9WIj2uJsjFiNJ7vCjMf9Hj/Ovr3M1tAATWOyVDemaaBbV05IqhSMHRs28NALvoJqfhSU8MHqHMzmPFNgSfOKAniiwuG3lR0vijNRcUbQLHVNkaKWRGjQMy1z5aGcxb0/3QbpDMOEwfA8kWD6ZZ8/8EJpIaZ1qRRcyc4ZDZWHsRflYQwzuT/WSWmZZ3cEmoGE2soWk3XHSAZ5B2srgBhuJoLHvaUur0S+QBuy3kmAEtae0zidNn51B4TV5KEB5UGegeU9hauJBI+mJn7u1xmY8XqLQKTbQA4drS7DlYDcbYYFtnKth4BZRXlqfOk9mPJvZTEvXfu/l+a6wgBPZ9Qjst3ZOFn7YwYLtReO7ONJb8q+Gg6U8M8ZM7YacO08pI5420pJInE5BLpQYxVchdBy+vssjMV5aRarQ6ubtLs9P23egHn94WbH46cE7GBrhX9BZhdZLUS/Vbh+vBL4Sw5M5PYHCTeLEZnCMr3v7tuK7OJ7K3r/X8aU7qRJ82G8ozYVcHTixSjVr+DXlHHKNhcLFS2H8ToNi0F0HqIa8nHFL4yRHcB59Ij42O8+9uRpXdU6/S8SEwxpT7gJTVdaqZB54q6sPSGh2n8rnl9hHkMo5TXr02e3PcVna6J+qsniC+VQt1exdjITMI5fHD962R1f9b9i3YlGAFS2pBz+WMUspwZWqSZLkffXSUT7Pms9eYcyBUsyvkqmBSHy0jN0Pc4eSI7/1Y/ZDF9W3hpprj28a1aOqniTTyxhssIhnamKFe4Mu8sHYdEiQ6VCdKmS2XRn0J842HcKfTf/ivKzokDz9n1CZ7xNMx+6BjIO2RDCuEVjRWP+SprUVc8vmNrXjAV6MlsPH18C+X4AA5I+QQdMRoUeD8cPFeKNv5QJYueWTHClZ68uubSzM435TkwxXqj5G7vVvwcbfxakorIg3RYc76g+MuWflcSGHSw7YdIZqnv8wluimx+QjI1tWwHo2wHDvUY2bIv3Ry3Rp52iY/qIUnYftIpkotkvJd6y3O/l77SKaKQOaNc8AeRHiqRbjYpqrOwV6HQBVYJSJ0k7TOVh99Y3sarmP/T2RprdzKtaN0+pImiWdHbuTiOeJbqo8fvRqShwCg7Fo3ACqPV5NwsxXfEjd5Hly32MXsjmWPG+WpHiwfVEWQLmiIpU/V1wdneiFRCHWXi9LljyHyOlaUXiVkUC40lePeurcQAUHpprVQJWGKkVMNf9sNpVv632aeJib+gLL/25cFyXlVVC7g+1qsScv68edIQ4CE/w8FPSEF/y0jKIacz3Yr8wXgbZAps0a3MXSWXvuvjg50d+L13+rBAz/MyfQ13VveS/WAL4Lq0Sc63EVsIBKwv4BoNNK5koJvMeSfac+pOL6c7VJ2rSdb+X/dLsVR5Wx5GT6Qgma+6GEVbGR9DRguemUNqcUq1e8djkubfdUknu9jNVfzSUQwbS4uTZBiF+XCshmRJ3A9Taq/I1sbv6nP08LUbzzNpxc2BrJKpJ85S+HHM09DLgY8so2mXD4X73o40qTsAF+Ix/wWIFCq97ct5Ffa39nDCp5Uu6Kms+p6kGNZ4ZXwKH+i5/xVEPkP4wrNa3O9J89SmLKorZmSHN/NyQm4sYrSQ3DWd6TVnQtO0V+AkaAcS8VDfJRdB4KZFZbzx4DBF4+aVi0NVf9tOxciTpn1e0TgJxQq7pE2ukv2p9A4TsLqlbPH5u8CqhdNcoRCKH9H81oaejT2Y+NcwaYJnOvF3k7zDxOTTq61R6Zx5njy0z3xJ6NgD0VBfNjai9GdYZgnUAuBmZ8mIGFmKtDwnJYrCI63tyxxbjg/1sQ7NgID39VLAvcfkFcxj9kwc4Wj9+1NlcRIlWMvq3JKON13CVtqL4wgZE+0bbTmSo0WKiUMRNf2SPoVkG6PeuHen5TbCQ0BGG+bMUYXyRoS3vQ02NCHF3aLFvF0UrkkLSHJZwJx+uLFKDpuD54Idn8Z/4askFA70U8v0eVEK2DJoeqvqND0Qb7QEfXFJzPUGDtc5H9FD+k+IwImuyTs1YLvVNjWae4h8YPYWQUHeXU5gk78loArkoajGw7Bq8rGXvaRG98IOlK/Rq+WE0MNpGTgiTY5DVY0Jwm4gIwjQtmo9w30/3ns4w4ZtH+QTpWjsIF4tp2jRI6ucQyaRwISzMt5K+yIIQe1n5ub5Hods9GzRXfJmsg116WXERN5UAIjBFbHNXhVwi18KM4srDo7cMlCGzJijtfxKFLAr+TqQCyzmS9PnryyK5qtiaGOvevGeh8OXE6ipnd98/pv8R0i4u/3S2d0+uwcO/ZoxVazaLAEBoRyJ9wP8sV1t9TO1vxE4sLMMZ6diGiaKeFCwESz/hbqI4G1CfKhf5cWuzJ0iu9iXRdyZSYHBx983eA/0LqyZbEblXKhyGD6orKgPYqklGNe5HW7luTWruTHIlk9zO1zRDMH7yWgqvbi/sEYJpBeIbYhpYXEP5iLwIiTfHTCG2TXiujLaqjpSRKCrNGT8lwBnw4kVay9okXl3gW97MZcEEmT+GnCbAVREwfn4wyRx3Q7gMw3kauUKRHc0u6JVFT/ZcTNvuYOJT/J30FS2e2W/Tlk+Gti0x0v/Soj6JLEohuVxn5RGH1fH+B59V1MhuHmpZ504+cHcBUVi3C6GA9Zp8B44413Ss47HnxYKB9lsFNpdaj5pAtlrHhAa9ZXIixB6xL88D64RZFD+KkB45EUWi6HfpHqzEbNQgCiHuK6s/GEO8kvfW7iJzn3gnYeHwzNdu8mIVjNPFO1YtLpkUjeEBm5UHt9V0sZd2RnMMTRo6XpLHFr9IxKxp+CNJU7s2XZbT4+eqqZ1ADI/gtQGwY5t2xiAXkfAvQV+BwhEKZyLc1mogE85kUYBKGmfPAW6e/GiJKJSves4mep9Ld/rjRUffBFchwaUo8sKLLrytXFooCNNfRiYQSsk52jsVhbSXj0GNCqp5ZLEs3A8lYz+bwJ4PxKcLEh9YwceI9qOpzKl7BBSxXmWxBBhuP2zncZxYKhwZr2GDwCJM8XBSke6GOw4Pq/B8oEmWZKuMxJW2BhN7bNqXWpO90iLGa9qLK1P/kiFMV12N0Bi85rhfCkkXytCl97x7WA+3bDj4wR11tJHzfRIPLxxK/0qCKlMZ8PxJQtlcocj2sVirVV+omX72ocp0qF5t3FmgR+x2L5kYmVMAcQTOg+kvLXaqQpkQVzgrFCmtzXQyHCFyIl+VNmDRSn9ssDXbVcFK3QH+n5Nx+YVRnBoK3LXy9F9/0SfT85uO/KCIGv7RylBvz1gjS7IylLK+morZP2VcvmcB4b8QtpEeqKdo3TA8ZC9p0zjnZDQ4IWPfkIo40YNUmgAkTB+xEIHIHEoSEhrvR4u7Qltr+wJhK+wf6JuEkD18NvkHXw+tf8soIZ3rcYmCIkIay5fxQwEu3GvIbq1NE8H/DbFkOVLJYlG5h8BTaJH18uO3MGZKhOnw9fhA4+n5WvOAbAoRnU+OZo0+Xhh/awyYNUp/U1278ZOtqUwzA0iYfI/3Oa4GgYOnlf+ZJhr1XnXze58pOxiHhiCQDZl9sVtuqgj6su2kPeeqsQnsOsj+iOHQ/AVBaAtgusYq9kKguhupRtV9MiQbn6fdoJBISXOf4scbpVKTUxKvfWQJrTX9T
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbddf-7290-400d-96d5-4347950d210f",
|
|
|
|
|
"value": "apache2|a51cbff34677e8be7bec232eb66db564"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbddf-38b4-4897-85b1-44ed950d210f",
|
|
|
|
|
"value": "apache2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbddf-94d8-4ac6-81dc-493b950d210f",
|
|
|
|
|
"value": "a51cbff34677e8be7bec232eb66db564"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbddf-b368-4a39-8fa8-41ec950d210f",
|
|
|
|
|
"value": "5c7f873320ab3b6fab74ed402b953e58c0f99502"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbddf-03f8-4a0c-a892-4300950d210f",
|
|
|
|
|
"value": "7eed6eecf1b5b167ee266b04ff3b146231fe47531a3f7ad122651db37a860257"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbddf-3354-43b0-9127-4c2d950d210f",
|
|
|
|
|
"value": "95104"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "5c6fbddf-482c-423f-8d8e-4a05950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbddf-482c-423f-8d8e-4a05950d210f",
|
|
|
|
|
"referenced_uuid": "8560e314-a454-4bcd-a2d6-3f2f948f85f0",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-2940-4a9c-9443-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAhKVk6HQGHugJ4AAHVjAQAgABwAZDUxOTQwYjFjZWRlNmVjZGEyYjczZWU5MWQ3YWE2OGVVVAkAA9+9b1zfvW9cdXgLAAEEIQAAAAQhAAAAw/DszwiO22n205qMUnv/UQMLceCn6eHEvxKFKT7gB34jgfIz5GC6QgcCD318phD06GCFBJo2xKVrmazSCOQ+ScnDEMC0JkFYlGFx4HbS7xGTuSP9RDZkTNas0JRerE/ksurVkhAw5cJxywpRS1n5+hRziiT0OsphZP80Lk/2L80AEI+IBSoTBJS0yQCq29z301WNtNydROErV5xJ/kX4Tc+Nck/VetWlyy7Qk3dj2P/lXaDHhJnRIYqZTEvlW0y3h5PnxW1LFMgO3k5pHFu99IbuhvE3HMJLBHeHDhYShUh3G8Ic4bvLuT0EofJ2SKWq8ujyCstxXxjdiIWywhPx0AV+QEM8IAvpkNCVATLH3uUaI4lxgRI2fyXMHoz28vbNDc6KQ3WZd179v2rBwhYVS/jzCZydA21lbIgBzX5XosgtvbhnvtXNMccm8y1x5QcQpgBcLgbkoPDUMmAaIkmzM2xxF8ifm3Rebk1uWtmnSBRvOKYsKHcSaVIZZjKzKq3CCPeXSm7k972Et4m5Eqj7z8DVgTb9NbjaIcRVFTHEuEDjHtQAldShqJqZjcMuHCITh26JFGDmtfXlCLGuqYNamB43cP2hy3kM8fPhAqPpGvL3IabLoa4BnYRyZUBW4NTAW93zv79/Nat0mvWf+v6blK2NU4NORMjrU/GiZhGYvO7ooVZ+Fyp62Nzid7A4/wAErTEHsbcRaZsHMr1/4RX74e94Km2TvDFWkfU7S2TJ9jcYuaLa+E4omgwDReWm3RlIVKjkGrw4v2lP6uJ0rLQZd6QsxVrfylHjlT17L/A8HxeoFtx8BKMMaMbtcDsncr3Oh5C0SiJMb0zqLeIQsd4WOFRUQ84mPQRBRgUiw2i2gs1TIDCpZ+HD253aIRbXnjFyP4jRmsXFv9j/2l8Pz7uGEyrMa6bavp3c7hX9y+wUa++rYt2LH5mMWdfmGKOxsg6NjTa9TYuT16tJT/fdrJ74aSZRUXI9pOA4xrTtit4sDt4ZmJM72rw6kQU1T/b0973PnNNPL443zmxA0Vfpb4rVIRGE17aBsDcYIr6pQHcaR5J/hzI9KpEkSC4HpHQrdcdw8lXzQqIKZz6IQ7XMVr9kU5jGjHBe2H43oltw0tbjsJCHMez6/g/BTy+NZDXdm9RpRAP3m2pivnTLCtjdfrGZ9YEy195zw5BJUP/YFqgjdZBYqpMDyAi4a5/yAy9yhF1qo153DKBdDruHRDO+ye2tXUh2Bx5Az6Ei5HmdnYnny3VP+KzaEw0pSeqV3fsvLFEQ5oLS5TsNOr/cKl3Tqv9jvb0LVLmdrN4SWpelS4vO6yMsNmfY+n89s9ryiFdn6yXa2ab1WzIX7X7lDq+taTf+f2o5rrdDD41JoV9Z8jmyEWs12B3yayne3ebLIU+iwi58gXHcLZqEaoYc7CArN2liDNAxwVJEMevTptr4I/EaOWWVnthKyl2f+Rca6tLKk28j4YwK9jHNzHLIY8/XqP8Y0C07BH0xakG6z6rET/tIMJpKDQEgj9xWE+jVm/NRzRUCrXekjF9LQ/TnPx5gWus0AQVzVpNyWrnxe09DbTG2NIgCOkEU1D3i6Bjz9N5Z0ieuYewVsA7vMmtECsmbyzeKoHPTBckVsQ84Ej7MzkFmX4GDJ4kb2TCj35dEfo7rXdBHUDwaaIrds3QDNNn//TgVcjg4H5XTGvHF9bSn4UC8WxurfdUjk5WxiNH9Tqfg1k4xb641tGcT0gD/zkCeUfd4aG9+feMmgppZMbyXtdxXRytWUATHFScuCixKSoWJ248H3yrdpDour3kS1pED9MP7eY6rPl6JLutr//cv149rVEKb1NiSQzrVwa6mQr5bAOgVaSO5A5+vVjOEBWndDwGtHZJ5fdKTr+6wCTYrZZffPjD0auVhHeWVZ1oYtrTh3MS5mO1pYQssTNXylaffJXcPfyhzJRGgH3/bc/Xy/3Y0KwJde/xfb71Iu8JLeHbfSgH+daz41Nst9j5j5ewW7f+FHtP0MdE/3WfwoFvFBSGAnuAw+4HnLEBSMoyXBt6fr0alEJWt+bbG559sqQa4fLzYr2Sz3un55aToIEwRrFPS9Gvmlm8vbbOhnqBAaPTcV0V+qNJS2q9LULtQr6vITBpbrqcc4qCvvMNqWYLfPdkYJF5anzhwlAd4tKMtMbVG3fL/q71HNGgfJSLP7o+pUE1O3dwwDPn0o9dH0ufNHznXRCAc4Vv5E6Yxf04zLDP3wiv5rHzGNfhu32OZxLMu5SVWTETHphGE8jADUEapWINErGe5J7iw1gQsOP+Luq2V8Wdj6wHdRq38PeL6a8qzNXut+qiCkFyUz20eSHlyeDL2qU3Mq2WO/7AE7I6TMYUmUj66KC0y+uCnPuRfz1qh+XCc22HbwAuAEijEGny/6p2M4QCgab/BpTt9l5ezvAh9Cg3+hY6fPhPA7crccRfhQBIHr2cCvpgBBzbq8c3Zr0sazSrgNXy3QqJceb51saDxRon/XOLpYZOxjj+OBMQ+z6lE7HqfKPkO/6aEjiwLK+uDIhil7WwsOF3hAUpe0Nceh6h/FOD+89JXDOrIcLh/z3mJpfaNWwezDblIzvVoSgjjpFlkaJG16Y68j7oqbdRS+v4Klz2AnF9dhP6a+aiyUtR+wEzILo7sCJJdC3phqiikEEWqFWHzx6iuXmLQdQcsGAxMU0wXv3HprLhp6RlxaOupCtDchjLqdH0yqXHoFcD3fCoLE6ulWoa667PoPskfkbWjHzQp5RgnNGt1a+oR9Y2/Nrn8P1woS036mX17xWe6qcderwWa+ejrOI1WR4/sMgFc5lkk7CNUrhLfv9xtnMrSj8sa+5DBjXkxZSi8Ov7X/bzueigX68M4w6Sxb3V/T5qiC6Zsb3yZJ043j+so3xymqppTLOVeSuYR8uoZl42lVt15+ETN1evf6+sCk4sv1X/KPJap7KwDbX/vGHHBnsbtfYNcxtY/1oocP3+eVo/IIy3MPrbazegpdWtI+ab9y1CVT2GC+E/i9iIq/N8qXq8X7BbM5V1dLifQfuvfrBzxN+trqtozHwJKleMMlyjphK3+kTvTxXDy0FwLfCA3Gk4KbE+EHTh2Dwdwpj75s8tvtVWLxzU1z3nbHz6prndPufn8jEYa8BMh/+T3DGvXGsuijXTuO0g4jZqL68N6rxadfWoz6+x02MqGKmcXa3Mbb6piYdU06pyqwtjSS+2dsvtGxNtQpOMy4eCNOcx623KGFHuqKaGdp1HkfcABrgYoCiVo5yJs7N6LwpJhaVvipUQ6WY+U2NSw2M+jDC9jNAzMjXojmnTRXQx9d8WfboolKq5HlhZ2/m/SdfIzghR3zPxXDuYqtMo8p/Ap1yDrgWtewhjtU/+VGCt5O6okJJ6FUdZq8B42DB/2C+z0HCM7SNV2pWMe7/F1mgtSb/wT10xlYjhJPEeBFkPWSTSiy61h+koGA0yE0Dc5a0rs71bFQs+DhYzvZ+M/W7rEzmFbzO71Y5JLcCpdbzvmt4XJz5pQDmhA4H118cheZop+1ntffWMmWWpHIKm1lhwEdIJdQae436SSO1PlJ0rPl6wsxLYyWmo6FSsqU+daPPa0/t/KYp0pddHCqGRBxklbiAPUhx5cqG/dm6KvUedf5w8j8LVQTORGZo+iIQ8MQJP2X6wbIV3/P4gZPAWC1VRvOFs5JuleKA17/sgHgjgOQopXHClKHKxhoeE1QbYu2O4xG98yPrNc1e/1ToiWdEkbl/VBMVxoZbR/tR0QYDph+8d1KTK6pnqTKb5UK1XpSI4aGi6k4d5k73HBqA3NDYwiXgdg3rCiRQpjEv9p7jdehEbY0pKYHp+2AxC9TdAlkqn62yym0TEi7Hdf0O4i5oP52hUchbM1ZJxhAF53xb2Pz1sm5gtEZ3cms6sWLYBCau/DOcDMoWWkQxm0cooB/CkPq843CycnF2KZ87R1Ew
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde0-8f48-41d3-a5c2-4a6b950d210f",
|
|
|
|
|
"value": "bash|d51940b1cede6ecda2b73ee91d7aa68e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde0-2f9c-484d-9b5e-4fb4950d210f",
|
|
|
|
|
"value": "bash"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde0-33b8-47aa-88f6-4ee5950d210f",
|
|
|
|
|
"value": "d51940b1cede6ecda2b73ee91d7aa68e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde0-bd50-4e83-b06e-4c48950d210f",
|
|
|
|
|
"value": "694e9658f66e7a490bdfd98e19c7e627b83a23bd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde0-6034-41c9-a4e9-41ba950d210f",
|
|
|
|
|
"value": "8b5f33b88b4abea7848d5dbb097b545385b6bca9faff0610c78dec45d7577a6f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde0-435c-47c8-a9ec-4bf5950d210f",
|
|
|
|
|
"value": "90997"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "5c6fbde0-8268-4747-b0f1-49b4950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde0-8268-4747-b0f1-49b4950d210f",
|
|
|
|
|
"referenced_uuid": "ca5fadde-6d66-4478-9f89-15aee8ae3781",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-81e8-4fb1-ac13-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAhKVk6Xz/FGdZgAAMZgAQAgABwAMDQxZmVhOTNiNTQ2NjU2NTg1MWRmZDhmZmUwOGZjNDlVVAkAA+C9b1zgvW9cdXgLAAEEIQAAAAQhAAAA639V9JMaSYvAl4Oqmp6gK/YZ8tgliXU0kscKimeM2oxaVv9gr3pK2nqXH+Swey/xwAAJf/hLyezOuIOePJ389J+5TGBBxpe8i/VBStrmRmEwH5kkez2Y5sRIg27iOr6/K3ImiJMKqB86G19vJT+pT9MuXtyLCNWYsIWiz1TAWQDnm6VDYgG8lkTChpGm7DFgDinFc2QR0/ciVHwSxQWWfefj791avFOzenTOPGUO0HgJo8Cn/dsZ/iqQejRex71cShBZYSrkD+BuK0G1/v4SI38yloJBywZUS/r5AsASDXXHAaCb6hqN6CaPkLnJtCDXvWgjOw8ZnLx2TZcrH8629mwTvRLF1OgLG5UtTxpqwo+bsSzs5v48xUwPzWC3bj50xW/rZpA+BcKqNtUaoXgnKDuvTKB1DmNvEXYAJJ0K3RPm6F2jQv8xZuqri7Rx4DrKSQmNJePbF4aUTmos+6Bei7c2if2hqwYoFLXEfhK/HeJCNLi0fJA1f/Gjn/kBGNFgbv49sF2WkPQMtLdzBdlKzr5F5j+3Znp7NPztYLb6VoYOEyPcC+BXNpcPCa7qHqTDq6mwtddtLdg2pg+XtKcAqR5nDynZpaCTdbS7t6wuHj1id1JxI17U2cJb/7mF20Ku8gzUdiZTz3hPvBPhJkd7zCtFjoLi/LoLmSQ1akEAYSU2vSvScta8GMZjB7VgsXDPp8PLbAUBxoETK6G5PfsPQlsNwHUO6c6zWQCBNZEGiOLVaMMxW9gcqlzF+JVhWCp9sZkPvcZYtwyAXzeIl53zX4xDw105wov8GANB7unY8l0ftCr0IxxEnBckLlFubTTJMcrZ2Ztyn4ORsH9WsfGVGAMBhcu/ARQt3E9TU3Fl1rrZKsmP4N6W+BlsQUe/YtutmundRnPgl06q9rzDKrEp0deMoS65sIP4niC5WDwnJG4gkwBsFbvQRZ7ss7VZTXFfXXJNiy38MemvRAM7a8n8yN4GUeUGLIEP3WhMfIWKcgwJ0RhiGksJtbMKmLHw7PPq365Vqt+sshwRsOV73z2cpRlkCQiAkRv8kSesY7vaXfW5ERCAgsqYIvRSyZBy+RLp3xJfCKCgQtHPoZ9s1s6GHCYl4SKzcuMWZKn9+duN1oyn1y4iBvF+C/CzDyXZRl1M9YKWjYAzEBUJaLGZbUhLHr6xxhmHeENGKIIxRLypzkIujSBT3uHeOFsuioZJVHg/OJg0mB5vCUVmTBd47JMKR2itCu6Q8frrTIUBsui+xulIVmR9HRy/RM0yoxmkIVEUbhaxwkUE1EJM6bJRXKN2QcoT0iQJdMvlmijtKhK0/YM7U0mDNm9zlxqo7YlLhdx0wR0yzty6dPzpLKJDqvU8gmKVUYqmPjuImhlEdkymvJcJi8p195K+mHR0KIcl4wvTqJG1gQJ7qKZ340rblFIRGY5Bu0O7cV2/ZI2WRj8vJA61+SB93hRSsPcZGW5op9SA/oN1WBygWtiSc2v22avHsKBE6HUbJrSm3/f8CAcG71lZVx/bdYw8FSNubTf5EUreTG26yKDqEHYvWXVKOczPj4qBZvsmPct+qcEV/f2pzanTIn/GL/MNPF3O45O9ln8dK5670lU69k5loEXdHWvDdUuCeayOqc4F8e3Rz0xJx+XtW7a9gbsWDZ4QltZ8PwOkC5CVoAiJuuSAJN4rqi0H66dqhUtqinFOGIn/jVgfR/QPXc7My1XHCu/TrC2x8YJZC6aCaUahXX963qItUeIzBKmQozmluAmcqH4T+OQ76/HxRGT7h33aK7Iwxw6RYXuMG4z7yVUiZZkVJGxleV1UcDe7GRGOBxDj9Rc0qVJF0fManCjXraEyt7oZT4ZD6nO9jevUYrWQblJP2LyrGQFVyT8lFVbVXmWMrBOUazyUdfHPelCrqIKiky9L28OgEr1hmc6BSPyu+fSZC1gnWZUR+IeMdD0uDhZIvYsBz5Hou/ZImXsAiQ4vp2bpPYVlGUcs9oNzIMmeVCvnertPxefbD73IPs35usoi7gRDtPAJxnJDPr+gaw1orYM3WDOA3iQcfpju+mLrX6YkeieUhFdI65LzVIP/6toRPxtJHo0hfpIguwnK3sU5A5TGuazFtUN5mi8LWcBcNQGCNujalvjWwvhgCStCTQjCc3DNCfYzHt4YRutKJ2sUx+72/uMe1k1ybmZcP2r6TEHMUz4WXQU/glrxOfNMO63oalda1MnLqJPJCxVBR6UEglzKfGnoNpoLEP8AYRsA5bLx4nlt8Zm2ZwtOiQRSFWhV/o9FMaKpLKUI4mMvfMHT6N6CVmiXaV0Z8yoYUCHwM9pwEvkZu60YbBnxL/i/BrLAS0vtgbESE+iXB914Y9mVs1qlC9PtXpoBLDzOcvdqEjbpzts5R562xrQeHw43k4m5bZGFQw00zTGowcN6HkBoSh7HYtiSMhB6Z6Apwj5tjNf1itzW1iH9Pcgv7Bi5npMHY5lapIJbLv9B62Wkm2gNTTDinyRCCrLUm4F7BaFduQutLvYlBDDiO9t7Ihn3clPAEQ0opZ7Jd77vNDzxPz2ZgJJi/20NKD4RuKcUTJY7N5BMGtF9l2i4TXC9j9OHzusAyZEjm/0fKOOuY2jAddYI7jqO89vHxiOeK9wUP6/UejIZyZUiED4MMUkQFkc75nsw0tblfDMqwWQqsmfQIvKSLvnL4xpLJxgqa5WKD7qtNJ3u4a68lim9mmfkdQBg5qZDVG8+Uhr0zp9ExfR/AX+iwePNlTmfdgWuNyR4mOhXmyXM5d+TJDGu3sUigbxwhVVq4y+H68EfaSH9tsS5nCsLYXyZ46rAj/RJE/nkPXtWxRZ+kfU39fR6C6CO0jowVGhkPyAJ/cNuUVZlw0BGU4OuPXmb6dlGIGTSmBmtHDphexr4idhj9+fWsOh0cc5tOolUmrt+v4Fwam+c3LhNIlBJ+cY8+ElJnuQ9+lPYVZSZoSjI3NYarwcwN8oSD+Ng/Kpyi8kFQDdrySC9elx7x53e7mNJhaayj7NC+XKRpXyFm4agN7+wsg0wNDkSmA6R752K3CYglQyk8cNaRAzMH9/OOUNKwTAFCfCvzs9ZwrwdlS24IdN0JeYnAgZtsLPxe4IkKUDfJw+gG1z9hKh8gIwrbUFA5sy/8rGgU7v+wGk5hxJ9diWm9lUhRsM2NW0P6SBp9KVgKoeMWRJ5ZPLKdxOEjcmtDnZ2nrCJIfZNpdOpQfDRmLb1vKYvpZTRC9V9khG3D59wqHNJ+Nk1ccwFf7vDZnAD+6T71j+mwO0nrZxxBPoJNkpu0JkkMm3T/DovPHEPrR+ZBYlaF/GdWbffT2j3J6njChERqxEAVZW9qSVb/2183ZN8TPVeN06yFsekWqQoshmGgWeCTV51OIS3te0rFZQMKI1gwfoJYAv7havGuMbu09NhxhsdD1Lac6Tzg5/ScZLZmW9GZMJbJJkt8Y/eHXDacTB/Rnc7KbSA/V/6n75qycdtF6XNUcRHc5NE4WK1pf74/tchOU3P0eklOC4CA+y25e/5bLgSl9CjWtPhxKzB5/vBbWRTdNGY8HvXoytEEKJRGcOquhOGoHFK4PumaFYjI6MkD8cwti0WqOlXYqRVbik7mzsA7i2uUyJhg88Vx+oE8+C/WTl4QmJilLtkltSFcfSeEzzo/IefcPsEDEvZwd/a4tJRamlWM/zjAyMg+6We35E9Anxdp2IcNuXGJi5mNtyy5jex+ibUbI0Z8jFSYCxv/Lktfiyq3cqGCSACvyrvPPMxN9lADU1ZplQCC62XY3Tkj8/qDrRI34FaKv86i+L350gdLtJFEeX4nigQwR+DqTRndBd0FgbYGRTq2F1zYYLigDu5VPUUCFwgdHUDu5koZJrlzQmkjIU+zFm+hskzl+cqmRkkRDwxardM68KeMY9NX7679HT/+Qwvn3THRx8oj4WpW3a/S12xwxrsPFtX7B2yPF/6IjhHyC
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde0-65c4-40bc-9d02-4ee4950d210f",
|
|
|
|
|
"value": "cron|041fea93b5466565851dfd8ffe08fc49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde0-1040-427f-821a-4acc950d210f",
|
|
|
|
|
"value": "cron"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde0-bc78-4c29-b70e-4208950d210f",
|
|
|
|
|
"value": "041fea93b5466565851dfd8ffe08fc49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde0-7bf8-401f-8400-47c8950d210f",
|
|
|
|
|
"value": "2dd0609e289ad8c172ff2534010a8b9b56a54bd4"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde0-05f4-42a1-80b3-4cf0950d210f",
|
|
|
|
|
"value": "ceaace7eb68ce0faab1ce80a019d603c3f11bfc8e1384cfcbde13da4a08467e9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde0-67d8-4518-a9d2-44b4950d210f",
|
|
|
|
|
"value": "90310"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "5c6fbde1-de30-43f8-8bcc-424c950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde1-de30-43f8-8bcc-424c950d210f",
|
|
|
|
|
"referenced_uuid": "46a3f6a3-d2fd-4d95-91f2-63c200bcc518",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-e8a0-4ab5-9e15-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAlKVk4V2WuWc5AAAFowAQAgABwAMjJmODhkZDJmYWI5Y2EwOTE1ZTA5YWViNjc4NGRhMDhVVAkAA+G9b1zhvW9cdXgLAAEEIQAAAAQhAAAAY9Hy27GwVj3rdKJbFRd6LKdK1Oj7Us99JNAYu9U+YgumWAcuACcjwMtRefH7xGN/eTEnYxY6wafDspW3R/Wg9IQBCMQ9/tkXqVmDjxrwYpJMGT2eUsN7sy6/2EsE4VZ92TE1ouzVoPkL/X7uSfrLS+s+N/cEbzZeOaayfMmdVUldeRbaO9k9UQVJxsdsAvVrIKxQ4UOUFWnPWXlMroBCKSZZoHigSajuizH6VaxMxcNMOZZ3uOmovpseM+JTAiw8HU2jLkNizrljC2KbjHrFTuFvdXsb3Vj+KSMMN5CTXoNKsruYEWyr/o9tjoCantHcG/1gmR8dxZA6Zc6UPNmUx+1G4vVqp7qb4G9jrxH6m+IejRNIxWfPINNLSa9TUHEAPW56lMCnCvN2lVbWwsAGqRORr0vjPU49aJjOaa5bL4kgR/H7U3s8AfLIw+l7qnXeNmZ8zAcV2gvfOZa5JSElv2LtYpHyc7STr9FYbQRfD+HuHkDaIpbD8nThoeacc107SdPS4dFKqJX88iLD3U9AEaHO/prituqol7dCKC8ZyJ/qTvDLADGtLYngCjaYFjyLcHGjIOVE6u+W7U0qrZveDtIb6uodAprhH6iq1pko08DxxV2i8WNO5OmIpvI/f57l7qYkTzi+VIGh+NqcvImIEZPoLQmiFApZ2jWWz0aMkxeUk+c1ZxvrurvM+yUX+pv/bPSzQB+pGpxrbwiQr/TPcZUuwshxOBjVxJjFhPAo6Aj3+64TA1UsFaRrNKecgI4hp+AzeOLXoKkZyBO1IN1mnnqJNLcEmSWiKo6wOC17jCh1JybgkZgZ2RfKb03RbNA3GmpAWtzWffGF0TXHYiva3dcthJh8hXtPxUdlrlmTueWP9mvGfIwxbC37qdOtU8Lq2mQqyRQ3q0QYG3U7LQrfedW4fCeWreq6pVGdx2NGv06EPFKWsXGeoOwLXW87WRZUlEC7xYvEMUf7BjmW3ijQSxcTIw3d9wDW2PK/gbuZrg0wuaOvDCImStjSQohIWWWwVrj3jn3DGOcBQchNj9YCUox+hf5YCW36bg0+8T/Cj/cNf5v/F0eyK4FIRZoiOy0bNNig4448UiDKpLyWgv32WB++s3rm7e46Y0Oef2IuUjlTIngXtk5qtnb3Aj7Lw6oCJV5WQfSm17zLTEJWDhext5fe91vCtvWFnz/kW3WV3EhIdFQ1B0zER+sdWuoCx5bZgRdwo8xAZIgo4V86yrJ1g3UshCIBSddoYXWwzFsWI7ypuL+6yfKe9NLBlVkmVzDbW9uPB30TqpGEBoifvTGh4cavwVtytuDUs3lR1oiG5Mbd60z5QqMbHUVUxbmGtYVrz9+8ul2xENB7M5D6gH4BhWWJeVUYfwohWNU4Qsfim8/WW9MM0+pWuW8q8HVlca+rNWdybhCSB0fPahBk6+tSSKHLLHbVB8n6fJHvpXoMMwsMhFUPSChyk6klpxGZ8TJFonu0Dd4Av1Xhaxpv+OE22q7nMGBHo+qDd6JSwoXdMoEXOJo1VAedAYQ1rPRdRy1fNgt9EE9aMFVmDPyOwpgFjfh0zno/gh32LksQZA0/GvktPbu1UowimcoJzF6eqqKQAyOB3NAsXeU3zMazdOCHgA8AmY2SoUj/0K4AcXnGTujeWooPul/gBIgrqXWfFki2aDSP0Ff3aViiVeBKUiZSY0omDYLfMgGNzOxqJ9yC25K7FGxhhyPoV9VegDKsBd+qPD+/AQsalnLetyz99dIIYZCSTD/myK9IUsxxxCOquHWH25qb+qSxJ5u8ok0CFJiHuqTr66VwYom92Q75kfXDA6125HrU7xXfICKbSw/GT5uno8Cvq2yMe6B4XMLqRxtz/rjVdzTv2+rJ3cdOMqURwXkjknVxQUkxWYbk07BRsYuA3PV6mylqqFPY/eyhZZvOw0DpKzvechz2NZcG2xVcutJarmh9OnTfTSx5UkFCFYd1WK7jfGf23wk8fMzZNQ8G3eCrkEhfNGe4wf4aVOiCQhv1Upyve3M3tN6OeZr1oipbjcGFy5P7tnlaz3NDEw5m+xT2bgWXGSFaomg+88HEA2oPeEN8kk2RWM1TLMwhZ1gzybZKH8if06fzq105v2OptuKOSCm/Gz+aF9JDeVVKlNQLdl7okUoRNbsB5CaS4sRUueAZ2LkVlI/vfHDKyQq5drJUa+RdzmosPMbbquX7QqMGS/uk0ctvX1MHbV2Z7cRcaceAzjY4dX/CruXv0rFh5r+JWGu8EAeN1sUwz/EnePyzfgHknnUF+2Nyl17ioNC9MJIZWw6ZKTORYfFCIAU6Zf1hHEDm7H/X56RP5F/ZxVNm6Ioc+X/bAvJjAgMnONGGqph+o70gjwfSexjJrym2mz6uZYh26TmtWoHhGBwXg+gvGPdTuEGkNEzegkCnu0Pbg/BrPAT/wynHi/Pd0aAZhnk2lIFjkn5McO/O8IR+Vbdaf/udbRCyZzg/g32/7NAcfD6DEv8z9J7/UVLnpWo+HNnfL7NAMyIoSj6CyPmdeup3dpsUEA1X5KAn1vWTOz0Co9C/QEiiYsxkFBFssHj5ViWYJXk/GyjAiOZ4Fc95+0S5Bcqef9EXZ2hqusO1AdJvAdHR8yfnDpTng20fmmhq2YuFpwVGosm3dcdTFsl2ZuJ1+6Wj4nlcu3AuoCuKrYQnPgjnz544e8KKwbby6BHgrJhSH1EjcWoFGjonoKBNmfBvCIoxgnf+y9hzMAqXYFxThvEqomaAhoXPCB8+BbUftWTUgp2MK9IAS94PC5zO4JtPTPT2Sjk1uiLMrKcwPZHtny6mDDuIf9XA1808ly+uDMj91cujXKMku2nuqh0XhlVgozvE3oNUnlTd1jBagsD5bpTyMUf6ZFgRtddvgJoWhEsmUThG4UXL1SkwxE/iYHGSKUDwM14yw73H3b5uGEtVl+wbP2wyiwrQQoPFqYCsXumLW5KGJO2tlziUnZiny975HGXDyEMklT326tjAN8ye25v2aZyLZQlvYiOsi/QHtWnDZg6twArg8Gpnhnuywur1z5Z7yycpvhm4CX6I2T9KjC4+q1KfmD8FttUwaMsUcSPVrTktcejzZhATY+1g7h4XFs+50EoI1qPWop9ERMCCBmm+WJ6eMI7o75Q4zKGSzH38zoP8khqmNBhAidr4K+W3zbWDbbvB7P1kUJCkCc3oJ5B3Ca39LiCj3OB17Ipnw6+UkciDwczmlus+npTUHSHkUbBcPbxOhaUi23Rr5yKMgcQr4dVSAx4DBFQhimFnjRkJRcFeP0NfTF9O3jlTACT6D/fndo/PtfL7N1SgsvDVNfbwAalkvWvuZKWOJsA5mYAcz1cvsdaR+TEc2r7x3OF9IzTVk/TgLoaHz01g/q2XQpvzkSQo/NvB3XAoRlTKbZ6hK62JoNGkvAC4a2TpNG2m0WUE5/vF7iIKSjVR275AEfnNojsU5RycLXUEVFhHz6hC9Y4WF1cb/0hEhb1o73QX1BI4OKz32/IbKupYxP49+pVOteA7/S90tOyOJhEuUtH4xIu4to/sYZJIzQCvFbd9ESyyb7IJzyuSyPN0Aqf6TxX89mioVKyDTTi8HUJe6vDY6GFafcFEx9HGN85ciIpicBK7ribfae99H8QoUirkRiquMIqX0FoB1EEp6vCU8i2cJkc1uYf+LtjBF/9vYuKJYu7S7626VE2wORm389RpxdFO2Yn49S+7wyOjVcgbNObGAjGE68ZIn0flj75aiJG2XC6G+vyOUR544rXeOVNmBGFIxwQI9JwUWahH6AMDlTBCzTEEvHjsQlqI6tvdAp27LmijHPV7wQyoUbmXn2rnASqJEyi90hdvxT/56CKrdIcnCHKQPHOjFMARfeQGD0GwmqOTRKJtbtuEcxEh4+9mqB85mWZ0Q5tNwwCALUjy02bzS3/Rvf6ZwLiH+tEwfJeZR8BMjfzpI68EXIWF0LY7cGhOgO
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde1-0ff8-4590-bb5b-40f7950d210f",
|
|
|
|
|
"value": "ftp|22f88dd2fab9ca0915e09aeb6784da08"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde1-b67c-4c58-b02f-4a80950d210f",
|
|
|
|
|
"value": "ftp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde1-2178-42ef-9585-4b8d950d210f",
|
|
|
|
|
"value": "22f88dd2fab9ca0915e09aeb6784da08"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde1-d368-4172-b45e-4209950d210f",
|
|
|
|
|
"value": "709c7b60e3ebb921592be87015b153b482ff68a7"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde1-f558-41eb-ab44-4fde950d210f",
|
|
|
|
|
"value": "623a6f3f3192fe3b6a0e2d731a20b4e8eb5041fa4af3baaa68fde1720d296e5e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde1-c7bc-441c-9a2e-4714950d210f",
|
|
|
|
|
"value": "77914"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550826978",
|
|
|
|
|
"uuid": "5c6fbde2-bee4-4d6e-a824-4594950d210f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAlKVk5ilz34OQEAAB8IAAAgABwAOTJjM2ExMWVlNzUyOTg2MTgwMWNiMGQ3NDI2ZjI4YjhVVAkAA+K9b1zivW9cdXgLAAEEIQAAAAQhAAAA5vT5gjMXTQu9n4tUNHjLB3i/1xgD/YXbHbtpUWeJdvdlKDgXJf6YnGCA/NeVrTIU0dQTiolZPKkcTY/RBC5ds6QYtq9ZYioSAMT/FEYDFaj7yAbbEJgINR88vONPgtTfw07UfXYOs6LzS2Za0Re04GkfUsTE+zPwOW/HniRA2ZutVpUjjwYCipX245wRM9phQtcFNKk7omvwLmAHV9a2F9JY/EAJSjjleYc97v43HRWTACzrFw18pEYVvwU+KxEchu/Z5MJW41v4MfrR6pi/xfikp8yw2K9K7jegqsVWQ4rs9F/a/aIxd/i2FzM0ecwUqs0uqej/OxIjF8Odi10NwtlcI2OME6LB9kxTlytoJtHr8II4zBrRLENnJsAAjicecVmGfVon3O4LpJwjgMaICamgGao/IjH4dVBLBwhilz34OQEAAB8IAABQSwMECgAJAAAACUpWTsg+VCETAAAABwAAAC0AHAA5MmMzYTExZWU3NTI5ODYxODAxY2IwZDc0MjZmMjhiOC5maWxlbmFtZS50eHRVVAkAA+K9b1zivW9cdXgLAAEEIQAAAAQhAAAAt3p99UF432BNqS82G2hQet9yQlBLBwjIPlQhEwAAAAcAAABQSwECHgMUAAkACAAJSlZOYpc9+DkBAAAfCAAAIAAYAAAAAAABAAAApIEAAAAAOTJjM2ExMWVlNzUyOTg2MTgwMWNiMGQ3NDI2ZjI4YjhVVAUAA+K9b1x1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAAAJSlZOyD5UIRMAAAAHAAAALQAYAAAAAAABAAAApIGjAQAAOTJjM2ExMWVlNzUyOTg2MTgwMWNiMGQ3NDI2ZjI4YjguZmlsZW5hbWUudHh0VVQFAAPivW9cdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAC0CAAAAAA==",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826978",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde2-e384-467b-b5db-4a15950d210f",
|
|
|
|
|
"value": "ftp1.sh|92c3a11ee7529861801cb0d7426f28b8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826978",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde2-95ec-4bc0-b4a2-4e6d950d210f",
|
|
|
|
|
"value": "ftp1.sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826978",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde2-dfec-4adc-a719-402a950d210f",
|
|
|
|
|
"value": "92c3a11ee7529861801cb0d7426f28b8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826978",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde2-2bc4-41ec-a728-40ae950d210f",
|
|
|
|
|
"value": "d2c914309b440b2d33bc834c19372ad8d1faf1b6"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826978",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde2-50f0-4461-9053-48d0950d210f",
|
|
|
|
|
"value": "5b70ff3a728f8981d2827efc1c1682ef288584ab67c279901c71e8f5e360a2e2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826978",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde2-dbac-460a-81db-494c950d210f",
|
|
|
|
|
"value": "2079"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "5c6fbde3-d9a0-4009-8a03-41d2950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde3-d9a0-4009-8a03-41d2950d210f",
|
|
|
|
|
"referenced_uuid": "2e5a1e33-ce78-48cf-bbf5-67cde8b81971",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-9c90-4dbd-99b8-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAApKVk4S8RP1RKgAAPTTAQAgABwAODdjOGMwZTk1YzMzZWU1MWY4M2E2YWVlNjU5ZDlkZjJVVAkAA+O9b1zjvW9cdXgLAAEEIQAAAAQhAAAA7o62BPA0f4euVnwVjgyqp3oSPOT8V6ww7M+Vw1sdGvbSqki3k9exUKYg2Ez9fazrIbrBWDTGr/Gv58LCu9bv+PLBkTz0m88XXxPvPcLt06zddalXejT5TcenEQQtxsf2DJYTpeCFSm9CnlyFepsRYx36M58Vvw9AAEQ+ynhNkIKRigrA8OQeFAWc5cYuF2ngwzd9Sqbk3+yhmLutpfb+DktfAiyw20mKsVvHj3yi4MfZ9//izK0fG9G+9AtOEesxwlIUaZd54haoJO3NDr802JFbmBfAP4+afwuoyMRfBppLwhw2fu7zhRhqLeGGJb1NnCht7weCyD3dyt+5OHF9uPSpYUxlp7h1MHpgPBA43Q3rswcmMdNIW9BV6xtdmHlORORD95Y7MIkEHuj9kheHWN5eFmE/3NYJ4/iWpxgjR9Ifn0R2Gn4SlqpCmgGMdGneZK6KlOSKY65X1A3LwawwpbQjb/4EMVV9u1jaiRL8tGNY3X+HGicCdulH6PJTVRpqTEnkY9gfAhRBcKCVEW3TI328fQM6SzIHJQaNhQ7S1+u8AUdz3leJig06aZ1FE2d3S37oo26SAUvWSu6rSOyNfLMnGlC5TSG0nOtrlGSkIWyaMfb6FIoRhnHuHNS0A80yajC0g1RpNWKEHplu4kiyno+Mm4RsetWQwnVxLraRIw9twBJp6XCjCpICjDXAeXnnBtO4AiAJnMfdGrBf7jyxdeli4vif6y7Ool8YnwYqDGCxBGZETQNCsTdgV9Wt2rrLmJd1CL061iYJFaGwktXcRPxs6d+sDWcXu20X0IjpZiPeewDRdH7wkRcQXZAbotcfOVpWraB78X0YWDDhO/9/JofkVZe2lMxN+EBoo839nG6wvEj9Kq6bZD6rokFgTTMOMRJ8IWXK4ngMhS2eR8c70OzqXYhAx+iRd2DKhkGxJK6TOXzvBFrZi6sdjhiUqpWYLCOX5O00i9QtMIwdbRaFQQnulzPqSVv7AHIuzrUYLfQQsKLlGFrjEPi988nIqqj7bPyMeCt5N94ZGSdT//i1PbDId61MjgH/ajW+NxqIB13mJ+0mU2zUpPvovpHc0WcH7gktEFK7qX+sxOQUXlzo4Sxnx+G39jsvxtvzzCYhUNBBxjhrTnTUFEO3BieXcZ4njOKExbnxVJVS7v9g+X5bJgHP2k/Eu1Zuda0hRW7wrfLia7xq3q38f6PcvHBJ+OcmTQUC/ncoUcfyjcrRJ7xy2zqucuzZypAWCTYzQ21DEAGZOZGOwDwBujzZHBWglv2TGFTECCp3n7fR530PSnLj6w4A8FPF+e3h+h8PpGW7ZeVpMx8ajBbR1gzirp4iBKxz84YfgXzYeJZ1mo5GjpjAujCQrnf4u4iWqJZUVoXYW2p8oWVFl/NZ5xVwzlaVQJyNac4Lb4VswYcTj7rtzwqUvKpxlSwIrwn/FIPrDDBdKyt6kGiMBCMA2HHSlEYBc+8kFofmzn17uT7EypCWQjnYPEfM4XEOkJ478Ws7RIDk5brYxN1RVppOwn1JWarj7iTFuE573kIhiCChASHEmydXigjZkq2q2Cay3nXlC6U42cKGHJQDkNoU/LFOSIhfSIJYwxP5kg+aLjLpglXtc4sU7c6cKURkEvMjKMsrJGD99Y/CtfcLwZMX9vxzbm7AsuDyIJ+zDeIwzCSLkQNHiGOeCpJT6k1YY598PucDJSW7mS8dJhDIF753VjwSBiJjkAquSC41325kU7nnRCa8MfSTCz5r0yEZ1l0OSqYDioVq5eloaOX0d/svsgLOhia/rxrEgUo6gZ+ot3y3VCHsZFmedcmoQErPq8Pi7v+K3Q5jNbMIjLRbU6rPaXCPkN/ISldGxSP+TeESw/PaPXVqjD+dswxm5mL/Z4TRtLtDGoFYj506y/Cdq7EUPg1jFKU1ihsCXrXQ3kdT/XP/YKr4WPEmIPYdOjB7m/RAhR99qTbGAK6HR13PkxWWc6etgltoxpJ4Vbaic/WtNZCcg60w54gfI065HWBjR3bcFQil3dJY02Gu9RMKmYrEYM/KS3M9VF3cAegWm9pwKAXdc/ZEI+UrfFteQdWtFgdpeFgYgDAGwAfHCV+ieahk0Xgh8/eQ3+rYZUeseb2eCZpUkcIihPe3si/3p8nCXA4rJqX7BH0G/79bQInJU79TzGyMOiikpKikfg9zz9RhTOegZO1iIcmHtttlT5ZxI9gY0BY3p4In2xIhvuCiMgzPHWTZR5ckYFf6CFsI295m1CYy6+gBy6GQviJn3w/brhwxnYCLoneJlsUtrIf0Hh9pIotaB8n7zj4kcpNXQeLA7t+3IISMbPYR6ic5mPJPAMy7es7eXG2CUJS9iJxPNGzk5TqjxksKy8VuWCXBxw6R5XeM8rIR+H6Mcl9IaWF60kUqxCyVnvNi3lehHpkPjTuyiTCDEMjNSHiihq1Tzs3dh5qvAZEFfmBmsbxK8DWbgVLc23n+xUg21twi3bKkyDQxJDPx1HdJ9lg94r+wni7F4uOeUUZbVCny5jhzm/k+vZn9pm6derOabvD7ScNb4V9aMbBZwgJRTunqL/NpiZoiP8lqm/X2cdo9LRqf6bnyQVEpMvXBzjC0eed9IfY+3Kbo1bOgUx1PyTBQ0WbP1DjobMVMxefMwIN7BrDP00dYRbbMdOkE0n4Jsg49Tx/OrdnvR3slZer2ohMMuY4ezrQiNXTaHjejVueLJnP3PnWxGU9jubN1DofAp9lbLj7IfUGkTcHoNpGeeRfw0l4jtNDRl/Wi0pHlKpZ5luVI0cWGw1bvjWfPnsB+7YaLLq4RmBH8IA5jR9Z5vEHzFw1td1OLzcqXzUi9VrY9Yzi6rlxWPJRCawH+Isgfc1PQdxOIc1T0p/itEybeEsoEgLmtAb7088ybqEtzuRONJcC/nDQZmPPfzd+23O49XeEkrV00DK2jxpNbBNJDZx7Y9cgUgEDy69ONTOXrXrv4AkkYbESAqFOlPgjS5qV5WmkBd4YL6nbL04LTevIc739abk9+WUW1vGA4MVHyziOMv7kn8ZK/Az+9qci46ieg4E2pdqqkTf7TByRNnFAAf+xmme6LxZq2O8c7Z6qYOs/efhFI1QsgCPuFVEU0n0BEDYN2O1uVDnhJdmLjyWOxv3wwwFYRPnziNpcD3YofO88OU3zaYHSWPQ7KF66igdkxf7IhPDLDlFBp/DUOccYWFkqqg5XreRlefvWm1FFDFdveNzuSfrglmr1pqznV9hWSWuJdR/t+FesQK6lH30y1Ps2H6d/jFKdtkIFhVwyUsogaB9uNgL+KOwIbT3ega08+jgjnWlHOEluLyE9+TtfNIFBgwkx5U0hcoXfi6pdgIhzr9dUYffFkvjdaTZggroRLDvIJgVaj2KKoBB+GXdecUDh2C3GmkUx/qGC8rval3MWCPBUYPh3CMWgCM+7sS7T7v3Dngoux6JbHA/ChE5MGoN6FTopDr/1Jq2IQ7BVOv4ku+kT6SekXgkvroBX99la9nctVH/7mLxA/7F4G5fzsq6Z2eF4IOrRcuNCGiccPb+JE70Jmha2stdvrabW3gGnNt53ZCIp77Pyz0R5VFnFJULZmt75DrR8vmZG/wfdkG8pV90QEf7CxYRAjhPDZRkNVL3KoixyfngnzkvZS9lBpt4KHSN8DhBApdBKAOtApvzJspLHrXnFnQv/l66MJJjosQg/5a9EzaEh1OnM1vLHdWc1y9Z90UOOcYdOOH36tWUb1ZCznTWb6k2Yig3cP/08W7bh1y00ieA3CKV2UEmzkfBqwe+pRdBkEv/d8sqO/sdraKIPnYiawEURwzshtiiTyPaKCY+kPvDpa9k996pRFqL8WOSGiu2uGTcEqUan2CA7aIET+Xyk8CHXsPbxGRlXEFfx4/BdaYRIjPLyZuUxDZbeC9l6WBSMgbYBP+aocsrVB9MTsPJbk3fyTmLzNiucbFahJSfaxXa
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde3-fd74-4bf8-b8ae-4d81950d210f",
|
|
|
|
|
"value": "ntpd|87c8c0e95c33ee51f83a6aee659d9df2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde3-d234-46f4-98eb-40e5950d210f",
|
|
|
|
|
"value": "ntpd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde3-cec4-44f9-876c-4d80950d210f",
|
|
|
|
|
"value": "87c8c0e95c33ee51f83a6aee659d9df2"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde3-6564-44b4-8df2-4d9f950d210f",
|
|
|
|
|
"value": "4fc8179d56acb490e841ee884b0fe27be22ebce3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde3-d658-48af-a3b3-42d4950d210f",
|
|
|
|
|
"value": "b97e9993702e0e7c214b72c5869a8d9e4fd59cec7fb42c9873e548f52a6a072e"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde3-c5c8-4628-9c17-4b51950d210f",
|
|
|
|
|
"value": "119796"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "5c6fbde4-300c-464a-a542-4548950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde4-300c-464a-a542-4548950d210f",
|
|
|
|
|
"referenced_uuid": "65a677a3-16ab-4e76-aed3-ecba7abc12f2",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-51ac-4425-8c40-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAApKVk5CQcqA7aIAAJFAAQAgABwAYjJlYWE0Nzc2YjljNjI1YzAxMmQ4NTMxOWNiZGMyZmJVVAkAA+S9b1zkvW9cdXgLAAEEIQAAAAQhAAAA5mDjF1K0uwee/CxChAo/cx+pIIFvZZkagFoeErZt5FUnTW2axXZh09pxYesUBLHnuzk1YajVANtz2qh0VEJa/IYbA5lmG0XrDDIprWyPh3BU8xt96RruQ8xjp5CLu1cTIYAyx6RIFu18S3kEnijhUyls82lnTM8hVAZrplRrNPAvBPlaujoYxKRCWPh7kIloVohD6jZ7Frg9570YxIRM0K+/ZTtKh8Co/kBXNtK0PC3WjQAgqVlYyRdcHDTzWJdf5eY6QuK0/WGrh2e0oTxy1G9WtV49fUsqGy7bmrKUBKGqCFYwJ2U1ANi1q70/vQGJtZIzPmpWi/YsOzS6fk+FdqQ3a18gCK1EVz9za2uvIlUNykIuYLXNCN4LfB8v8Z4rw1hvIrRZrI3mg/TYvZoQBVublxLe5tEiLhUnvDNKJAUjbqxTpBLvRcpkzoI0rCD1LZtwrYPY1RZWmufrgPeZxyAa5g8DDvjp8ozHBYgk07Mz2H6r/L9rFZbYKRHBVPBDhU9noH8dwsIQB7ouj4vvo/0Bxlj+qN5WE8NLxjeheWspHDgu51YVl85vVpNHBJJqelolL1uBJcI/3f6heUnIiNTXDObIn5ZNFWeDH0+CojKHgVuUD+aRSpC3kGLL4avU/Onx6ARPcwn1gVXHwU+epMSWzpzyL6YxyL7MWekD/CqT0mnIfTHDP25jl/kWVYiTbNmivLGSbas12EN2gBCY23MqoEXxYz439n1lyGUPPOxDo9rX5tcgLUUKKs8RWtWIwhH/VLk5UXTtPxZYfwXyYn5kB+/iezJG3XUBcxKP7xCeTGGkxYmfq3PrVTjMSzmrwGr1dMydYtnxpoMy9vE3kcZISGsMwCqq+dHGHs16G985AV1bG64gY7Zt5LGsuh3lSXI7aHcAKrlfZJYX3lFNFMOLmYQSOwlhthOfgB57l9rzL0DHRMRXs4buSVHJFoQWP0XYpNQNuND3KdtE1vMQpzkPEjnhD9bj+zQ5HlVwzoxT5LGU3P2023XA4CIoDUPLDZ5kmAaQgWznqnGfKnjksq1CHM3myRic+t/h0IX806KzFiDByzZuUSdzArJ32G9qOAaqFvjCSuxe+R3yW7mbINBs9p+Q+UyOqB7ZwRIAZZgrZ9B0iq3Lh+B0t6I+1Kkp3RYfR2+UJ4Gt/mJJva70jrQ+QFwNCa0av2VvydGiiZrTzfMX8XzQ5silFvZeiiUgqWbpQGeHZ9IvWqaXEGZJ9Ns5CmTSodIyk3BthiuJLVfKFknuDbaDhJahldlP0HlReD5+aBU8QMCxaMDrQTkiDQIe8SZPLuE9SUKolJ2D2OqWVDSTZ041bsIYfVR711N3CXe2xuKbsIjkb+JfIkUAYu1Hzer2QmUgMMGyQfQCKkUE3xuuyO03SGO8ckjWnkEhjbmi0yO5WV06px/I97DU42yZY2x5k1JUIYjaGg6fjZspTAosedE49kM6w1PqFedZwQjxHe/G7eeCWLv/JuhxTE7E00hvxp1JBxZFnXO5xUl7CpMCdyI+Jj/CJjAa6rRtpXicGwK32Ttggjdntk0BfYvq+4Lgb052GdCsUJnE0oJyCusuuYScUNfKC9s+qpKJ7/OHoL8+dA/6rCLm/pz8EsqmfhmFLNj6D7Tjua2bCj9oraHtT0MruzFFqytWrHvH9vlv1z1Lxmk4myVbdV91bxXzHXDd+K+EM9sIfH476095re32UitXf7wuLPoCHsx90p+oS2f6s+F0g/tPcLEgTgq3GWeknmfe0CsYM2hNbbca44IEE7VOtqyFqE0iZtxxJ4K+pLF4cf0aHDN6Qn/kYkVjfcUyN1CvsfHX3lL8tVbQLIjSi76DeNlNLTlgJtgEa5L3jc6tf75PjEv81mpVKH8ah4jTMvhtGQc7q5a4h7k1EUTs0ti6lO0T5RvCBHVLFr5egnXO0MzUyRsJ1DTt7KZOfoJdk2bEQ//YsaS+4nOZgcivOfIBsh4qoraA7kATAwsBRHoAA4EYGjgiXGTApx7Ld1IvhXL5pLWRLfAj9sEYlrt0rzXl3lLbanw3vH1ecVQ3uoZ+9zi8sSSWCFlDgmjdFflpnFBLARYVG33Y5QSSwgiwY4soemL8CP9L+br/YFGWnCKKZrq6f3tMDiWEKqTfvrla/MrMySaAXP5Zw/9hf3EVdtc1/GyxwpgLJfNejMT2TDDmg5omjvNhwR2mN7d5uSs2BKqnXNYOUrN2t9AmXadLNPM7SOZBOI+QNL4YHhxmgSZzkz742o6J8zwzFLmKvzQZ/IDdT2VK/KK8K6c1o5ojcRsf61pzPPKGIeZteGPls5yDoqgET0kvfKzKD5gsJorAlmCJTl5uyFou+hn7FrJy1PGYf9zel+LNrTB/j3Z8BCWkqPcoeN9qry8bGYAaomLJNw+YMxRuC8W0Fhg56YT0cPOkGKYgvhxx8s5Xa1lTTL5NcZuJiNzwcWda4j55skZ9QbLWtVAASp/+zZ/EulaaPnOQHUWQ1Pt6uYc4bAnHzJ+xwSnI4V8n5RVrbyOb74xfdaOJSEexgNsTA2yRB0HWQX00E9QC5EYOOdN5ArHe3Fs+AvsWhrmZ1/ETVwRP/87TdU5j0/Vx+QIVo+0UB27pBfQRROnhbpv/ehBmcrO5WU1ZELers43HOTMSriHeQd/rKfJ+VBEreKOwwym+mDT/IEIwthXcx7FMlTv+8G14EVnnjXIMngQ7ezEwuJf3PJ2zm2Ul3MwcFSWSxajz6a5YOVaLsOAPVpVKdZRYjXmsVyKpRzRpUVEjKrqcZmH5ucmCXNqekj9WzrRHWHv+n627EAo3rpRQCPKpOjk6uPVZuovNJ8Ab+7vnZDvsRNOzFw53wLRsnOxzZG7gVxkp1FGfK9JdJE8Pmlz508QRH6qsV6AA0AuG5ZKQ7txW17aeDhV8+aQiSQ/PXABvEcGfvLSTA3sbeJOfggX2+TS7vMzBhh8TG7+JzYGBdbAFS+RqumCDciNFwwrboFTjzReI4h9Z1oGYiGfG67b5QGN9dTCq21rSi/qLzzBgc775rejTYlPGeRz2RAZKCBdk5JvwVNy6++m83c9S+chNQ3iS/0HUupYCOjZ9R3Q3Sh7IQbhVXMB5kNafNN3OhygOyvGQ8b6a0wDXJZyEgQeUNTEJX5Cjj5hrjLvYsNEn/dJyOcSyqvb5mTqtC43bU+mLguIy28CvV2T+qWUNoG89TIXikIQkAMIEyfGm2JBkaaKPYhWxCLYSs1+k/FlCR6r334rgeEUz1n+k31bJCAxVvinyUb05GD1jiQZJtDi//Q7/VAxPscA2XJyLNZPVGhRYjvXoa+3ETYabm4OPt/tQjoGsq5Ngl6QqbU6+IWp4CSmoovYfbg1BORtX6SZ7K9PMmIWhkgW+C/Ueib9YyVhb//AZoume3nJOjgWpHOfjDFeZC46NQJ+B2OTgdP0aN6EVkx3nTD8molzFUunRYq6G3dPy40C7l4pQZhYSyWlkkIhbFSms9jlbSK6WwxyeMdyTeyJXl8zgE7r8XLVZ2le3JDD37WcFyvBDeQqB37hf2TtaRKkmRA/XGe/szEOau/1wCVFrsUEJZFRQ2Qp69Degwok6AZU2Upqg9KmxmjiQGLkcilNgp0TAGfVHlMEHvdd0D3gK6YitBxOzGlxEF2/BT24WZsIsbBNfVovJU340I36aHnkZSWSfLib+tp+Kb9qJo9psfsXlwLJ2pNhPp4ZP+Omwfiz51fBmbAV5QNEP+s/QPIs8ltgTPDo7rkK9mmVRKitqUC0o1gely8ozJ5jxrfJc84VzwYeqOeHzRKUNK/L6JnqbA7Muz7b5vU6+kpohpGfffM+fU6zUhhjzmR4I399EUX4+440MfmtkyPYO3ahDmlpw0CeUB+GXyU1GCWOlcFEt4mZMgQHuXKcA0rtTJpxy0B8GJiBdmaLItHsZCmR9q1r3pBpaxUfNG4XFjX87OulfKG+IXt
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde4-b708-4cb4-83bc-41b1950d210f",
|
|
|
|
|
"value": "openssh|b2eaa4776b9c625c012d85319cbdc2fb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde4-2b0c-4294-b8dc-4788950d210f",
|
|
|
|
|
"value": "openssh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde4-2024-4339-ad3e-442c950d210f",
|
|
|
|
|
"value": "b2eaa4776b9c625c012d85319cbdc2fb"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde4-b610-4805-baee-40bc950d210f",
|
|
|
|
|
"value": "4bd652c7ec439021e6ba559eb5b96a671aa71386"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde4-12d0-4e48-84f8-4477950d210f",
|
|
|
|
|
"value": "e3e7ef4f1b56b1a6a208df5f993989b2df33ec3c9e27a5bcd8add0bb40b63fe3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde4-b388-40ca-981c-4484950d210f",
|
|
|
|
|
"value": "82065"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870769",
|
|
|
|
|
"uuid": "5c6fbde5-e8bc-450c-ac02-4a4c950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde5-e8bc-450c-ac02-4a4c950d210f",
|
|
|
|
|
"referenced_uuid": "404871eb-92bf-4226-aef3-e35dd843f916",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-5b8c-4e52-8138-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAtKVk4niATIxJcAAKFzAQAgABwAOTU2ZDQ0Nzc0NWZhZmUxMjk1MjM2M2NmZDFhNmFlY2ZVVAkAA+W9b1zlvW9cdXgLAAEEIQAAAAQhAAAATwd29gn7hZ9+knXfoJ1EnfkNy9SqTV1BNnZjbKc1fNK8N4XHZ3SfWp8pE5fdSs4j3/PRb04eIEYTfEsnP3/zIsiR5pVBgXmdhlreaXscHX7gOLcILLA63220z78DEbkCKQcDyc0WMGuxkMUqLKywMhn9vCNEphHyvTVpsNkMHdaDJcNDWrLqnN70ljZ0EglnjC4sscQIfbBkc6POc4WH7yzM5zO66Ax3Eqi9MUgG/S+OlOqjYg4zRLuKIGRRh76uccQjzeduNXVEA/kHu8sOhGy/1q98Csr5n1zPXIIvSuMj2EPopOeYCIWKsBr/7Q4grbc3u+W8bNBPM/SlcmNvhiGjOe+iYD3vhoHJF5ba80pEUAUBvoc8efYBMV1JBblfpBb3I9b+Urxf7jEUQRRW3Kc3Ds3bt5py9YG1Gus48HjFd2xsslz8Om3D37k8aqEMbTNgztSvjuAan/vorUCAolCYDr4XY3IWckEypUzDrvtB2b2fyfeLv/vzf6xWnbQo/vtp54Ae/dckPb59W7rOTo3zNJwoKnwf9LFt/tWOX5AEQtHa4mDoJKf31xX+OppZOjBp2DrKbyrWcYTVZIfpGCZFGVRUUMWhbWM9awsxJ8JUmPyhI67RymSymhTXEhjYuE3gX9T0KMM3byCwloXAv7mhXkhk4Jdxftntu+/T4bjVbWN2H2C1vT+fT090pjGdtXUy0qnas50eYucaDCgdjwxwgMJ19hb6mfbEPQROsTflDsXiFaSZ41Uv3iWYc4WJleEdjYmSlV7A3k7umvIir5/Zz/QHdWAX58DbSvHuGYxlSazTJtXuveeN/g0HZ/4gv977vxRFpmbEZ+Q6NHcees3xi81D+PzDQFit+mFrcaCy2/k1NPSbSxPx2tdQDh8tqKp3VF54ITTlGgXfjyU0LTJ+ouBCJxYvKgWkQ81peinQMfKwYWmN9QzLn5XFvXGrxZ1Do3IL4ZQV1MgRdnbf0wRfn9fHZ2MB5gIm+HmRSaH98FDnDDjMzaWrUKuZ4A/K6kCYri8m0EtWB/CEiDqIq3R7kAqv7wrOMCz0EzdIkUEngD0axDiI/PBvgQb0HQ6AI0GqqMoaovIezi4vpCwlkpK8KYySec8ZYpZDYiq1sPZk2wThschuaX+A912ofR/dLIoigoIWC1/9PmNhthvpR+V+6NOfGt6hXHREdn9ytBl7OyUzt9yZzPvo2RY44IdItvX9mfhol0UEFg/QZGwcwDFEi9aiHccwLXoEEPmT5M85+hmR1LgOWGdXujVyX32hDp5KeqaimwsAmB7LWAWZadde0dNT5/KYAcYafwv6Q9B+7LRdUrsqC1kMIW7kJkp9JG9LTpLkrKkwzl0RVaVCZraY55HJwW2idnLtnhxy/Kd+MhYfxZMCnSrqYbhNEUnILB0VfQPtpBn8ACL0jiC/a+Ehny96BixjhQW15y6h70DzUygdbLUSRdxoJo1dDun4Hp8YXYwY1cRdYbc7+SAH2r8XFVekHyuxfPDWIjybvJkxwKyDBQWlP0D8Jxq48zpLbUIDyeTr1Q0THc90LvYEdaW8PdqbN7G00fPwykFZ4HY2EXwHs/fg1+iQwDk7EMJmtAuANfZhJgzW6NniJGqpdbdO0GUndLGn4nqT8DfIA4G+XIq4ua0wISFfF4+NRNTEyPsBZqhiwyGwlAwoPdE1vphovztKUiEMdzk0KurjQmuvDq2O3+0UXHU3r+/vJlTGbp9y0XiL8mfpUtd32ll7vVbB6QRdFbyiHofFQMSUVmSXNGHWtzfc3+fFsahk9VgoGtebLa25eqnz3LDxXsCZYbRFXeboU+c/tOqn4l0J/sLAwziL9tN2c17wi78WomQ1QAR4sN2Sbakg45/BOaSphjDVBJqsEx6mlzkP4o0OCR/Dv3TGUmovVUDVlA5+CGV6fYTiJcqzlgfbQKObZwsA5MgXXJ/qAJD7FBly47nQCfLDo5gLDEFMkYGUYnwFlZFZcyyCxN6C5HYmIN9UFxKh3l89YpdbghEAP3B8N6OD5+KMXMiCRyMnABwWSfbI5cTTOTCo91xBhAHI6jxjF/K85kLvBfAtYitgO2C2qJBX/ROO2hkAQm6j6ePIZVIAHL/uFmWSjSULKqYHAQPazyM0Dg7MyuGSaMkZzgR4dCvwA+2tyyZLZxawLRr2MsWUrYAhLRTTFRizV2jWVdAq+T5TqdG2/u+N/gcNHMPhYZ/DkfJhc80aDxr88YUVArv5ZDImuNK5a1O1GzIngHMjToCe9SN630CIcgPDjKBQpSMk6xi35LDk/bUBjhpnh8EGizF7goiqIKRo4HBRuIml2EFFe5t9Torr7aJbg4fcQmRL7eNCi52qFhGqwdrBv6BWLyxbs7ZenQTm9RsngNdz+pcC1p1xbnIdyynn11xj8UXs3upAmkoUWegv9HalqHmVyExqafM23/ESXazHtUFBqX/BGKvPr7b3IH0979ineKKNnSy5eO3Y75PH205Cuo2W9oMG6Y5VJxFvUdliL5siN8Bcc1lsYuNrSEX+toXEbaEyXfiS99hRWCzr4v9C90aBiFbXnuPRSfHUJq3z5008Kwh42nBivtYsn/yas67gjV8XK6tM0BrhiPyHePDziz2xkECyOEAgvSAbQCyP1Cp7T+h7Q4JhcnhIHvneHB7U7RiI4luDpkWU8I8V3+EFVCUpGRKoEw6vX6cVxj4Dk42NXPN4omI7VfdCOA4CzEzjaXn48Qyy39AYtEbi8OQVHZW3SCGJGMcKE0X/GT+ia+o6DNHMj/ckR+D2L+dihiF8zmiRzRlBe0NkevSGycgxF7rT8KwRetSxppT77S43PIIhecM6EOkgOM1eO1RUmmvjhapw8YbEmQiAQY/KIJEc/o/wKoP2Wiwl6NpwslWr4qR6o5MytUIMrKdIil5m4Ej/eyPo2xwZ1jI6yQsdl8EL/Mg4RjHXlr1pftgJNSveS+z/ItYCA5DsYP7OBrq0rjvGy5xiMO6PN9cZPnVfnyUae5n66gdSWomvXiSNNF8Yc3IQPr/VrQ1tpv0LMKK4t7iXFofseSwowDP9qbMgo7wMXep52x3L17iuFK2MSseBXoxPh8zqpM+KEJLiSMQARZcWi5tscWyl7W31imsO+86TwiDv/86WqMyL3LgenC1TwJKFB+ya5s55mJH6J6FhoqdaoPABpUYYNYUFueu9QlkICfa0WaY44gft1tMVUeDlSWRqBRuxLH8T/8CVftQkKBjLZlk5OQY3apCJ9WYwFA6ehneaoG9fsLdatjxrbiae2tgM/NwSQnvcJl5bWpq5H6rFK1373Ubsqpud6NzWDCBOofz/KIoS44dZ4GfhOkxyiVrTN0GsPIe6wm7EsxrNuLJxZNhurHBo5tBB7N5zpGM7qhLuhXjKb5SBw0SoMlRMpmX/EOWtbW7HOC3QhyCEW7Sstr0E5aDdEbjZ3TW1AG1CyAsNA0Z0Z7ZJAlmFKp7FLt8Fyiw+JKH/qThl2wrvUUD9y4gPY+PBHCbAz7dnhgvRgDrdQb4I27Ika/FPsZ4xPSLzMX+Y1Llm3VVmWFkPW6cpc+nmrs9E3EOs8bBNrd06pQwkWqGeY69UOtAgVi+1ej0ztMIRyiaZsMz9NJhzrnTv0AXpDpkB7cOFOqc/T05mL9ThcfAccVVuQ/4ghM0Om7CYnPeBLMr9Ems8er+/MXp+TJ7vFgmtfCtItRjv4lwPWeS9fuFUqejUiPAeRztXHocvCpKnjzkQ+dWLYJsptT6Rl2ju9CIdN5ym9D8lyWwrG643iaFmqY5GCKUeiFiy6GuawQ2ePyTdeqkbdWYZ0Xq929FB0wujXft60g+ftNo8RJk+etdUH5FaQ5rfO8xiL35M5t4z97K+XlEGqp/wkn4dGTRqp5ObDKDVKpsdfFGPm1LExB/mumR3VBpAa329dOGHnBYjCFbotlcFt0uOFXvYi0VDNjqAcoYVXp
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde5-b9d0-46a3-90aa-48b1950d210f",
|
|
|
|
|
"value": "pftp|956d447745fafe12952363cfd1a6aecf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde5-5914-4db8-b45a-44ff950d210f",
|
|
|
|
|
"value": "pftp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde5-ecf0-49dc-bc04-401c950d210f",
|
|
|
|
|
"value": "956d447745fafe12952363cfd1a6aecf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde5-b7c4-4b53-80cc-4bef950d210f",
|
|
|
|
|
"value": "57447545237c0c4e214bd16795c1ad3dc587128a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde5-c478-455a-ac5d-4da2950d210f",
|
|
|
|
|
"value": "8a0abbf321c2368b162c15cd322e465a02e696d2b0fbcf2f748cb49e98d3543c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde5-510c-4194-9811-4b52950d210f",
|
|
|
|
|
"value": "95137"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "5c6fbde5-dc84-4660-af29-4a3a950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde5-dc84-4660-af29-4a3a950d210f",
|
|
|
|
|
"referenced_uuid": "a6780ee2-559e-4d53-b571-df123fa7ade4",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-35b8-4e9a-b1a4-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAtKVk40PlpZgaEAAByIAQAgABwAMzg2NTU4ZmNlYTg1Mjg2NDA3MGYxYzMyOWM1MDFiZWZVVAkAA+W9b1zlvW9cdXgLAAEEIQAAAAQhAAAA3EJiOGoNjdMXquIQBHRfZrtSujwHgg/mYOY6H8rLpP3Dumh0HmSowDxar0km6pMKa7gC4Y+V0OJ6eu+sMXW1hbQU9XV6Ls1fx1rtwFD86QzzdaEBRSo1b3hrdzCRZ4wreg2kFZKiRjzvGLmK5uKXc47m7pIlelfk2w7W0tWmvqQdLJDIToApNfBjcDlwO7snd5YO48IUf6ABxlWY42949NKxwOCfCL/w6Co91sNiMZXB8NZjzeUBjIpzAkw0YbH5ZQ0u81gF5KDPCA4+r8SuNF3G3qa5QNE3Hriyb4QGlCfPWX8uo4Wca68mcQGEmOqPSenSg9Zn48ziaL40BzJNJci/bKc9TKM1em9fmPpKzXhD6ynbNCfRmkAD8zHs+0i0nEKBGi+VoCRHt5epzBmVyUx7d+DYqndkV4ObVR46xLCEuKZB5FQoBGuUOpOKUplpYRWIKypPNoLVoYCKVfKTIjN4CBSzXXVsD8NA5lUxILNORyaO4kxWo27DqNqcJluIePNwecJ0educJfzwm5fQuVEw53gpVdjz+4D+GmEf5vPmmJQWAtDGXrSVy98MN7CKxrbZ8UIpz0CtZcAdC4TnliO9ZyyTYBw+eZDEf1R2CKQnGxEm1c+rrvdnxtZIzXvaP2cbGHTizuAWGAidzngf1h/7BaJ7px0ujxnSGo59lg6/N1j4KWHNi09sGGhdgwYCLcsfhqpg1DPadjKfg7fgFVMD+lgF5XBb1pZTUaYnaabT8DeMe/Y1NwMmeIlF1nNRLysWHH0v2Cb3FiLVtZaHEfFnuO60o7yozRZraN7rlPe1zT8E+yjPT73uzKAv5yUtw9Fa0j+f4I4oSOFpiyd1IO/OGjcRSO78Hlb0PqkKlTomZyDgDhLsvzB0a7Ca7SiS42zx20DQdsWyoxWHjkI/c+aWMXHk8EnCoT6e9ekX0i5OyDwGU3xEXtV8O78tpR0xa/WZBT6doMu5qV37+6GAowpgzoeHzvf7pEsQUDEDCcAYpnGN08Twr1dKJTjkK7+kDXg5Ul5x9h1KIqpZ6VkYbYwJCn570hcDn8l+EFWGcP9BRf+kmfR9GCgbUMzJ++PosMyVSZtSCNmCzw3SvSWonshz3GP+5KFd4F1eYLKrN+Zirbz5430zibJDYGCswtOTjZin5OHzomg3KcXYd8xiU1rm2I3nZtUSGyqX9qVrximlmsj4M/jT8a7W+x2cY6bbLbRecQ/QiDWE4otgx37qX9zaWiKYoYhtRCb0p851E2KE6Bgs5J9LAgVhqUplATo+VWX7dPyK8QApjfkPLJgCyX0PVn/Y4AFDQw1TOpSi6sWtxXmVcxjBzheLM5CD1FJ/K35BXOgw4KQlqyWJzPO1q/4nYAj8dQPtz/rx9asxTYqvc4AuXTSOo2s4GPye86qfEHJSeK87f0jPGNZ60G0hlAQxVqRkpxdPhpeT3+wnSS2g8twXQAsq1yW5Ei/WG/qRdNhDr1FjW78Aq2Usq7nOI7ETrcgko35637Yg8bYgAIqpj27wfg0+7R7aKTxO4hnVQTFOh9OAyA0hWykSdBg1fe23gMpVDzAuShpT9RvBXtOEVS+JI1Doh7JKDS+k6j2JhU8JXbHcNN5g9KWSIggDcUguivoM2GVxYIWJ7VIxfXEFS8vRmyXRZUVW+JyCo4CWinCiAZSSe+SV1DfymgJyZz/CFn7n6uARDV4td40PC/IFTKfkBugN6ndL8vfNDMFaX3627d/Cv67aHHb9nv6WELrwOxHsUkcZELynbm08uUrwcwJOR9KM/1FVryWigs/oDkS6+z5Pw+8lm/pLTzbZmBzBdrL6DEAjoBBzpKMv0IbfH6DK36aJiXzOs3AU2WJpCiOU9SgtcmCjkpdebhF8W4b0SEWkEmkqn1fhvmjg+T9lwwkKce42K/XoAqp59w5vEOZpwQRY32J2y4Vad2EA3akzCU587m+jB4fHukCQLIOMO4sPd1/HKSXjYTcevIvn5ZHlkfiX7JYoSoXuXs6n/q6WtU8Cbz/WAO/HmpA7Jvh23Z/Va6wbBOIZaIR88Ry6l5q3fd339lqA7sk8Jl4OHu75cY1GLFLqY0TbakLlhjAtnJN/lEK6zB3CXBKEBs68ukt/hgbIRRxKkelMw3dY2EGcxlB4T1ATvcOqLtEH2a+O3G0UAyqbXOYWvPgRoiE4VvSF9O6sOWIXRjsStRajRylccoqc7ZVGRaGemCzjnqtxdznqxT8zg1LubgY+CaJf2d8b6/yFTKOtAlUm85qxOvaVNBJ4dZfnpjw5IJ7XOjYXubJDXXNS6SBSyraaa9rPopu47HuvGotHyhH/QIo9zKjmXbyNAc/BVfGGiygZHKpmc8/InzQiFOzzxvu7+MFtv7UN+f5rQSJcm7Ahaz36MZERtM4oO/wEKOlfkck+5/UTXZ8lrjXfvfnosWVjmJ+2FRcKnKNHhb6V4A46WH6QXvt2MT6T2FvNMmKHEKDDftpl/U/cGzB68L5U2ZCWnh+ts3p8j87wB7oxtH+arUscpPt9nOry7r3kTb4/GINWItOQaqXrLKcUOCPEk/EhGBBT8l2Zt/63uEe4Jh/32rmgQg0wJnsq83GLjVtmIKehjN0DewuPq69pfHue/JUgmmgQ5l2CCF5Om9Mbq0Z5yzprzsjOsqidDnqIzHvtqzvF5H1r6U24eXZS7Y/AZ+d+0VchPXgbKZXFFNkzWvrR8QWxOEO1WEMDIY6RLCpT6CL/wnwCAr4QCkZ7xLChe6NsEp8dU3qO/eOU4KqWhpM+/lPNR8NR8Xbe0MBJIx/jT4Y1jOmSHwc4u1K1iUoRr3whH6BFvGX/yzSe/LJzbYLcwssacoHdFcWnbTc0YlfM2pmOI8zk1NitMi4z3oIYtha/mZMI+FZf7U1yUnSh/8XTwh4NkqgNRxONYpLcXMF/7zJ5uHfeeADfEw4FChQIJD9ooNnT88Es5MsNy4ZTcMm0cI4+2rE/BEvJerEfMbfJ1Z4whQHiiQO++7BDmpHPRhOdKQnJjBnJnM6/dz5npr9scGAWgEuKSATPpbQR2pwteoJdGcnxEFNOMANxKEjF8HZ6KysI1jpXUUTGdtBU/2x5fsdmVvqmcJEtsRzQ/YaSnbB6mpwGvu5SFgNbqP6Q7iytIL37oNtfr1vEtsvXaxDEph7sNcqOz95TOXiDBFtnQI/LH992a6yWuoow8+hbjnyfvEth4GKWSaHVLpYIb4mx7CSED1RgswptxVEe3aGVs9MTtbnDL+93g6llPNSFIIVUmc4cvT05IwENPrJ8EegqWzn6YdhBGV93fo4XtCUuS1AQS10OAyO7U2mNoSRajwL0F3zQ3VoCy6OMoOe6t4glEbRz6zGlOs19C9JCKKCvXnJa9PUSQeMkqR57/hXMy1KZtswCOhwkRs+BF3nN5XsfLcmtoFfPw/C0tf36Cqj7QxKcLKVaHhoanRs4SKp4IGJR5YJ8G/Bi6Yg/wXzw7YMPJfZw8XMNCVJxKxjWb2Eo0QLbbjt6fYYcUwcorM2SBL5kQQOQEW4epFtR8vfK76sjc30Y0x5+dzsx4bnUiQLqZcwoA0WojQf7c5jB57nnKiK9qVFve494QIdlpncGUbdOWwn0wjpHneee3LKdBp8weOcVbzng3C2TkFzM0d5C6HrZi+4AQth337Bu6GeN/GNaAyQ63aT36SA0GxjlS8d+18rn7mGPYkW7V3NSi2LL2YRFi4bzmW+4jdEnaNIaibB1RJID13a3Bz92Ygel/4Gez0cECoe4qDmKb0FfZCl67qHqLr2sPRW4Y/Yj5FU3z2g3TSZV9kg6o/JgQqKhlGmNn1x096U8RScmKjwJUE8GLgUrsojjNlPQAfVKkRc9s7gpsEz7JsV2dQaqRJ/m8Uwg8Chd3FaGxB0r+aK82JqF8HZLupBHHThhnbEkJxxPz4JFgYdqlmCIyvuHoi2W+ARVGIBPeJmJjS022z
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde6-4b4c-4f47-a665-4241950d210f",
|
|
|
|
|
"value": "sh|386558fcea852864070f1c329c501bef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde6-304c-45de-9490-42c1950d210f",
|
|
|
|
|
"value": "sh"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde6-b92c-43d2-9529-419b950d210f",
|
|
|
|
|
"value": "386558fcea852864070f1c329c501bef"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde6-2070-471b-a053-4009950d210f",
|
|
|
|
|
"value": "190700ca3942b310ae483f46edf8e4e7e3b741a9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde6-ce28-4cb0-8f96-4b94950d210f",
|
|
|
|
|
"value": "f8bb5631336876a708796184833c78a8feee167ac4d65da0625c28ab9f32cc00"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde6-2974-4a0f-9a81-434b950d210f",
|
|
|
|
|
"value": "100380"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "5c6fbde6-3cd4-46aa-bbbd-4a8f950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde6-3cd4-46aa-bbbd-4a8f950d210f",
|
|
|
|
|
"referenced_uuid": "684aaa66-2785-44f6-93f2-08fe5ef56710",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-61a4-4ee6-b0e8-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAtKVk7wNBJkY6cAAPTTAQAgABwAZDVhYmU0NGE4MTUxY2E3NjRiY2NlYTdiZjgyZWJiNDdVVAkAA+a9b1zmvW9cdXgLAAEEIQAAAAQhAAAAAG584RyoH0rBcvNzYj1iIwdJMG78v46b9lw3mOitvKvXkzd+MwZcT2mkuLTngGzAhMKLcY8IHiB6X/NgZFJrunda59Io3mHPgIEvRfCdx+wzhHQb9j87Mmjh+Jn/+rJ1YbIcYpHdXKGPaDNTt7n3Da3UZnrB8YZVZsWy/XPHgm01vnhje/vO+/27KqJrhlPZetObVv0xxtKiIQ3fAkSQcJZeoiuocx1bECXXTbndyqze0JERu11gb8I7hMCGdEge96uJpru3GfnnJAgsfH8cWDUBRQhhTElUv8Z/YjF2a6sSjBMxXROBIBOtECDSNArzrks2Z/kCVrgtR3SNEFwM9PAXIRY8bIbPpKEBgUcHi392TSKz1wRAAPcQGmm4jyayJdh6D6TU7lo9BJdvVLbCTRBSsWVg/srwv4Byn26Syta+MvxBrQPvb+gtwCdjSiR7Ux8mpuBbLJOIdYDCD+O/ECCPSUKW4KFlZ5jbWudVbsyl36KemvCYxIxCeV9W2Xq3XzbHVzF2qlRrltVgQjM1mz5/Hs/hrFmHzcBqwJsjROnfkwpG/BgTa0M4l7nMP8HLDqE48UkrGE8Ld60QEozTmGNZD/LCxsLniIOc0UAhWQ9r3jHAOz5RRJlhWQ32JTClwpuVHrloLQ2EWCjdsA0kPUD+cwCEIna5lR2+foan1HBa8g4HCYwYWMrb3PQ+o1m5DUC7BmC1Ao5kxv77YNGK7zhXo9V8UG75PK+h5z/W5WJ5/zqN4OCmjp2+ayqaEQR6rYTSEcYTUsXYB5v8fsVL0atoPJ68qQjOuRcxbekeQrA6ckcRKpPIzxaaT9lOiLdPECx+FwhIg9KU789pvWCCnQxj6VBV9I9F6bcT+xOPH9G7427vB43m0JdmUAmOWrs7B6SO1HCMyISqul+ffTNbJ9bTGdgLwnQ7qDn87fT1C/7Zt/85vCZAoRXzK2/r9Wk4rlT74uSZTrUYBX9ozWkQ2xY0fhsOlRFW1IAEhJIyHtPnA6yliZPIjHSsu8XYFm7u59vHd+xwQacverpycsL9CvzOh0AXMYCkNTcZhtS9wYiR/CIYJW7mdRAE5KHE9p+UKUmyN9LCaTDkUWANDDicKLSbmUWqihTN3uqpVRsjkFb9CZQozNJDtMnHFxsfWo4I0PYv7/zCPsQYi5XjePjbqBTkT14blPYoIqIwEhJX8O9h/riR6QL5bpmC9yHyyFWUELhlDOms+A1kM3dnBiWm2p5kvYefMmX+vbFuZyOMPXH5r/edmMWAofpiSV/ucXkXU1zaHi8VbbjUvf4+jiTT6jxRqdS1lWtlta8VcPDpgJr/VG9d4RVV9XfLQBz/JtDbYCWSAHkIPTgfyI8Rx86ld1jLsb+L+nvwTYRJFvDHOBfvS4LPpk4Csj2yV7IU0Qbqmp6q57qdwQe3TIhbVdad6abFtfIQAJf3N61zKt3jwEgbNdCqdVrvXfxpvJAkZa879VAKC7/eqBA56WcJeGH7JZsAsQsmMqJn+ALQtu1fLtdrL/zp22JxOIz1Xcfw3lqHA8hD7B9p1/7Sy9JKU7675vXBKRjt2YAAsl71hGkSsW1xyquzS/OxVax61scT4jsIe7lrRyAlOipl7S0mUSnqs8VYuApqlHy+ryJNl6JhIfPL4V0AYC3k6mh06W/pNnjHRByM/5/JHuMZ6ag0bQtO3EEaRxmUCQvcEiZhQlg1Mqn0+dGYgQ7LAoN84ATutlgFyhFyld1yZ0EA0VlgZJHNqyOqwRwumYlgQ/Vl6qJ0IlXfcZF+Sgoy4ZBj+tymHZBs8IQ8fAaw7ieotq41eDBhRH/LhIC/1yrLLX6QvRD7POZcLx840OUMqBcS++/3Yut39WQm53Bdy4CgQ9t1P9UNsgiGSDu3pwKWQZopVNqKhvFAOMyYhPESucBJmeGwuEJnxv/CoDerZ8BTD8frL22vjX3cUilhUfldiBGms3n6Occ/yrLSlBn2pi9np9Urc+drb3PLicRnOfeQqd97nOAqTqaVcM7nD21x6GfJKIxYZX8/dHu7rppMBtoBSs5oHMo3/kc0Ura+1CI+xj1ZsPMLZ5dzosf9i9lOBmfNqAbcacGTO6or7gXNUzphqYxaUWm+dLIbFVCnpJlUjTaRv/bml1OJmejvlAnYgl5bVxf4rsHYmLXNuOXgXHk9IqYj2ZO5grBaI5fN5C8CLi/jFCN6BEVE+oWFrocUOUsLvZekwIY+ORnWbGUqzpx5oji/i1fX2ujOgKjXKamGAD602p0kqX1da3p6fUFzYM5cCe8MHT87kFIKO5F6i2gcmG7SAD12ZEwI3Y4VMaA6PvsZJN9W/e1aGf0oorG2sLcLn6slzhP3DN8lfSbk5PA8dXs2f1eky4FdNMvKNqrBWw3z6z+ATHM6mKGmuCzcHwLZE+YmOfoL+eXyv9WliI1QsU5JoYM4mIY/yq4r+MSzROzo5QmIN5ixxhTuesQ9/OXGqClK5ueIowlbzhYFNWi4WgbcvHrYlYxutv+EuUFXhyEFb7OnZkzcpsH2pgVDLXD8LE1Oka+Tq6iucKB8DvrjfwR9Rr1rcdTbfN8YDDSZ/dZJX6RFUNSJpEcUb1rNB2702RPPK1N+ye1/ldgALBovLgT5dSbBuYk3hhfk0w26zO3xgKbWx0zWXpKknwzWVzD2crr/RikDsCjneFv5SSdCBahOJxgBG9EZUtsxDkU7YRBFXawUYn7xcGQt7ZTBYiSRI/WjbVENTrz91eonXqXp+2BZNjhb66stey0gWMPS3u8ByrjgWjD6+MZmZha7oKvu74vbT8JDQ2aR+lGLLJC1kDTdGK9NZOW/V5CUjxnKebXjbG3fbLk3TDdpmpFvJhcKsiKf3To4HBteRCXFKuljxsHHsbY9osGy7t/sDDLIhEDJvS9FLj4OzXkocsYvu/xuwV7bdnjpI+uAgrgr9uf9wrpBEChFiZC/24MxOlZXRnS2tG+t1PidpQY6HoQI4cMrKuUFEe0oINxWSIVvIEbTvozV3IFz4am0ORNVVFXQQqfgg4Z/chI5aB2tl9qFf2x4Ty+7AsU2Pdl23NxHmoY5kTrV/offNaCNlO5nxOh8JGdWXAUXePor2HDjAgRrLNtUznW6fGAYVYSaktz1MM9qMlBmmBsYapYXJCqxRVaeh2ug43NCWGIAjt/syOuQD2/taDrV7rbCS9VPhF22ii91d29OByxbjANyVHAv3OqtcVT0ubtbtE0Bli7GDGLVrJDCzTswADec+rH4nhgsI8kRq8JGP37FL4EA11TlF+vGKHRKYbwC7DK8r0OddI/pBPKu2pgO+ntXAFcl3VnWlheHyxb4D//qCXj7qq6kvBIE4keV17ZMVms5fSBiBY7HwcVHQSzrX0TJNQHnLUaQeHueu/C3kab/eP43B4VN+Xhr2CexyGdOBixeDSKjZsz0NXZ0qauVMjqL+ifKjHXjvvOEOphf8KBV4qlf2b80gJ9Na4YWSM7ePPVn8i6It/N2T+WdFCdTanRvUaFGD9SYkYZW5cPwMMJWCLQuYn8wqXIeiZQF45liX3NPCK42VnTYfaJjcgvn+Wbd9VJHnMiFnV2Gem0sWJkLthJSTtm8z+EA0fguGvGjgpZha+mfu4Ne8uanCCkZSwfgHSnLdoNsPnnO+cmmNN5VnZRs12dHDmvKdfJgWvEY4xys/eQ0HWEbS3Pbma//frp8Ynq2RMbFLDfnifFOVChAoIWuapdIbRxA+G/jLyjxZzp2mkABEKLQ8Hmn/ZC6L6nzSbll8AzeoHnw4YvYiZbtBI87Hrpmtuh/aX8kGOtjdB0iDWTjAwDxIXWj8k34fYDVNUmoBqmwZakhtU3dlnMxp7f9VQdhbH1tT7SnOJoluuKZxhcTskw0iYjANDdAjMJbMw/DhbCYvRlHo7Kikd9OkMuAUWWJXz+xOVRgUHmJaIvGQXfPpj7Un5LWMoK372u1fJNWlB
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde6-fb8c-43e0-a801-4b38950d210f",
|
|
|
|
|
"value": "sshd|d5abe44a8151ca764bccea7bf82ebb47"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde6-9f84-4e59-8b01-4c0a950d210f",
|
|
|
|
|
"value": "sshd"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde6-1fec-4044-b539-4935950d210f",
|
|
|
|
|
"value": "d5abe44a8151ca764bccea7bf82ebb47"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde6-bf80-4225-9a86-4759950d210f",
|
|
|
|
|
"value": "7dc2a20e6ae81fcc09d96e9fb58f4ed4ec06d9d0"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde6-5fdc-45a0-9e54-4fbc950d210f",
|
|
|
|
|
"value": "7698bc8a71875a8937488facf779d023834f92f6ecf1e926fce7e5857f8b1306"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde6-36e8-4ace-a7be-437d950d210f",
|
|
|
|
|
"value": "119796"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "5c6fbde7-a888-4f78-ab3b-43a7950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde7-a888-4f78-ab3b-43a7950d210f",
|
|
|
|
|
"referenced_uuid": "90a03b89-315c-4f76-baf5-270b8f50dcba",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-7d6c-45df-8c34-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAxKVk4LUH7QN8oAAJ7IAQAgABwAY2RkMjI4ZjQ1MWZjNDQxNWQxZDgwYTU4YmNhZTdlMjhVVAkAA+e9b1znvW9cdXgLAAEEIQAAAAQhAAAAesLvWkpmHtoBF4IWFHPg31wfoKyQ+nxHOib3GflnCUD/HUnwsECMhGpyCaP6f6EE1QGavulL0CD4LZzdw5ZT+W/fPJF+4I+RmXePZkH0+Qxc6jruFkIMfyx1Dl/xVblkgARWAQMFN0OZG7iiCTPQxMKKJyPXdoginGZzFOpVJGlW+46CAB0uUrNJL/qDZcj4Ys+LVs4888moqUSSupjQc/Qr0uzqv4NPE3kXUEFgu1R/8sgSnjQNvK+KxRACSFfK2w/MF1LOcArQiTesy8TZ6tZZ1x9lGTuvtUgNmDbHKvUsGLuafekU9XKKvAb1aHPATF0Mc9h4X2Z74vvV2fZ+6Jo+IF24yT8laZToeZ/kMR91/ZvT2poyjAI36rMfpreUVJE9maf1X+glH7UUQbxLkNhM3tQMDVjguPAz4dqjHGxvveLfR1YKMMtXoR/2LjVEjgeFl10PUQVoPTs8vmTscJaU50uA/eHmfY6gs6f3Evqmq6+SIG9wzhb0/UvV9gR9Q3vrlu8e07NhnvQJ28lQ9H4fyJcxcUbRgff5Y/+wk8RHtWj/yiYVA3axJzQLxtFQWOuZE8QmvU339sd4m7y2LZJF/vvA5qMCb8x+Ef3ERGNIIbeQD1TG1ZGLWrxOIX0ITgEfzTRwcY4rIRhx2pV7xq7a5KxNj64mbzLso1eU1HLn0HppgTJgpdMr0VhvPhceLtvBzINAoBjMypvmBipkMluB6/6x9MhH66NwUjI7MN2daovAfVamg2oTGeagOsn31cKKfWIddnS7NubaU4aDZ/opxekRNPdSqZQ+UyNF1LxmCXCejbSUVXdT9fFTfnHXGWt+n5CG68XGVIFylVk579kjoV08c2NZuAWnY3SODxtXHmaKwLDZv2VAgBa9AAs9AyWkMwoWudAyGua/ua0tYk7S+T1NXj+MouLBkGEv68x7Fe/HmglwQW0BYvf8+nhXfo4LSsRyF1gW39Kg5U3Vr43asDfpuHcSe0i3HZBd5Ju9WAVQCxRPxSixlymTEORgqQWDthyycF/uO+/r+FqWTPvXoKbDkNS+EFELzeftQhTm+hMoiVagzs69lw9N6QNNTpTdNfxvhMGqVr31BeQn5bM602ZjXaKyVfzJQuW9rOJEPd9Pei5xcsm+eUj/ta5a3amYX0gAkJl4QkDLA8ujxvoXNPhZ+l7jjW1/bAGDSnSMlcGyECpiPn0zl9AiV03388nwQvc5UmLLcN6yOPCKruXnvVIJ2/F1eLFz5YVkgRdslJF6DyQDK0C1jNkq+n4y2GfT/QU9hsKoefHdQQBYnGPIRIk5mv3PK3Kd1Lld1nUupyypxtOprs0RU+fqhGanjNwyQLeQHZIXSCZ6L6pya13odwN2Jn17NKM06FnP3Mm3CamKF8p9boWe1C9hLkQRqyEPzn2dnsvqzqGdZQADQ8EbJGNbPC7rSTCA24QfhgJU+eEp70mOeswxQzH+ZkOOH4YSp8EOki33WiJ8Y5ifGqQ6XI2/tTcrhGF8kiDpO3BicDQlCt/j3I0JbYGI+NQgdEhfaV9e20jc8BzaRMI/iEfNeXb1AV8cvWpfarx9T6R8Hq4uLoWz0pOgbDKuXT3j7Ba1PJu3tWfxG4jPmZoSJUaNTt6Ebb6upe1puZIZgaIwhy/WEF3+mDbj9O4xttbNxD4V5MbDMwgyc1BsuBHuCFihz8/GAmyJT/KQOjw3CInXTbY5kdiDt5DTLrMhnr/c01KzyMKVI35D6Iew4C48hmvB2AxmAKdmTmH2uewjSDbEFKLpmSt3AAXrRGwLKXfEtgdokfae7WJ4ePTxNeXgAngc1+ky3QGqcMPFjI/31siIto8wgUaHJ83hQaaT4PxbM9cHbVRgWaFGliuqWqDrnN2r6GaQ1Fm1JPZ4LHkzoGncASRpicS2mLnj4y/ot/RdDxfZ7Js+E+qfQWT5Jn+IAoNQu1TPsadE+9k/hOaBL7aFf0qgTd74SOT4y0QmW7fK1r+n+4lpBHAcduH+WyoAmWWIdJAG4oek7W9hHbrcrzK8+XJ77UFdOQINzO1KYgD1p2+xRp3VeoWJScrOQGLo5qwoKKlW+INt9QLtLzbCZDf3yAPqOPiXeCRHV953B5PU05Ggc+hboBfCaEj4/92l2MTRJtxG1ReDVpWlOSsPeuqxx3Wp+g6Ijdgp/WMgl/DLScpCmSvAaRxsMc/PlMlUGb0VTdNHzEgB3D8L+swwyAQK1PZqjvckC5RCarXo93v8eNjkjdzmjzU06JgORNiT/pXhme47iKsASdUttdgx4aiQBjiae97jmZ7P/UkOEb3u0ehgAwMB4irQ8OCB8IXQXP3fFGAltYGIm09uQxxqaW6IwzqoV9gl2+LC+TSs3uYFR9ZyqhNLv3qtHTY9dX/AsnPi437s8KUqF6vyUZ6NdBjm4MFQI4cWzs7uRTNhgVv5vb2vhlhobTbdiWtlUj1f1OaKcx+G/sZhFK1NA3cVF424Xc2C/juQ2t0CgGdRvJQu3HktXkQ4dMSHveAEhe8dMaP5qQxKvNCQY/hp8W34n0s3ZWBrAKLnYcuAWVp84tIg4M+HxRC+XFi06uzrUwLSWnujziNQor0geAx0sO/MdQ98U7vMXRL3vElWqK6rMaRU8KZk4i7Z4SwNY2WWncMaETwjTdGQ1VTL+Sa98gtbm/GMdhGOKtA3EKngo5SFfMSBrUm/75UJkfOU0vfQsrKSL7KtJZ5y4dv0PmDqpq7kPy+n48yNNPKcZemQhJ2l8KmR148hao7nd21sAMjJ254eOBb8n/tis5PMtaf6MNNnoTdKZ3o9RcVAxXLUyIi5fwngye+jRlg5bm4w+bxsPRmE92E0W98jv3lQrNzqlefCSXxJKitbmfToW8SpMkrEhh6tpcqVNUE5Y2zRRKScFSIgpzM2wshP9pkU/Tk5TCCNIxTDlvqxAOeOC8IOnPkVx0UXdWZQc4/spDbtDI0Cd8Shd85n6ena06IRytQnJU/2q4lV3tUQT89++RchD9EQIxTGb9YRVIieBEFE6JANBDMXN6jHsHw2zxfhyYJPTDAKYsVJQKjYLhhmhK2BeCHE69Z+YiUrtGe1nSVhaammwOFlfNU8ULqLomOezP91rcIwBUb96qMMAihgvNZDzpiPpJJ0tr1kHrMIluomb/Fv968b9ndY9ORIAiZtpzXqBxmL0HnN3mopsm1k6E0cedNDid5ZqKQNVQXCJx713VZPC42vE9AqAaNJyuu/giCpP0vyRD12d5KuZzn0c7W/da08d8mnSLEcs+dEQXFAruccF0c5/hgPYnhg9KV6+AHLA/5qU7vAVJ0qpp1Rw2jmxIDgwn726CdjsYmptydQVW3/1foun3Y3CGb5SXzcBUsp6MO4dHNk669IHlnf3be6f9WdmBLVJebpVIAdjf6HkagcRscPJTT9reI1U2JCJTDMTvd07gJJNR/XPRH5R4uusCnmu151rnDVUTyC8qYwRNg88qx/UI/lDffqqXysRbyHMtD4+yPgOphGgELxGkWP0pyqz/5syNp3CJ9QvPtIFsYZIE0RS1L32B5ep8UYq9s9xpCE5YDTzl1XOujVqWou0WlmwyBwRhDYPENQXftgMVFzdS2aek2CrgqPQKdIwjldgXxv/8vEXmbQRJOkQFwOQ1s0Zp1N2oNkfivlo4WwlXUMB9g2Rh3czNa1Xr57+bmDMviBYEd/7UfKfFBrJEDpch1TwsYuYa4i3f2QspGWGu+P7y0PF1DxOUptEL1TEUcwNa4iS5/TLsUOPaMKPRsTXwPPIm7r2UZXpUo/AmfOI/8aBmUYUX9RzBnu8uqxzZTsv3nqi0mMJQRcu/SRZCmAO4IeEUXnTEjyq1JQhKlUWStXEl3j0UKtPJt38f+y0I+KyldifWQrLbp6VTGef7rmHMmhL1WCOOx3AsF9cagp/W7YVrPBewEuPFPhu+w3rv1f7FcTSpM3pibAbg
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde7-65d0-4362-9e61-4a58950d210f",
|
|
|
|
|
"value": "tftp|cdd228f451fc4415d1d80a58bcae7e28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde7-26ec-4bc2-8e20-408c950d210f",
|
|
|
|
|
"value": "tftp"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde7-657c-4808-81f8-4aa3950d210f",
|
|
|
|
|
"value": "cdd228f451fc4415d1d80a58bcae7e28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde7-98b8-41b8-b387-4a8c950d210f",
|
|
|
|
|
"value": "e975b3691ac96227163f3dde59183d2b7effaf3a"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde7-ee38-424b-b085-455e950d210f",
|
|
|
|
|
"value": "e1c050a5425f935557f947028ccddc0af7674b144baf959b5221ba8fa4e04f38"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde7-f620-4099-a878-4bf1950d210f",
|
|
|
|
|
"value": "116894"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "File object describing a file with meta-information",
|
|
|
|
|
"meta-category": "file",
|
|
|
|
|
"name": "file",
|
|
|
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
|
|
|
"template_version": "16",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "5c6fbde8-f124-4ab0-9316-4235950d210f",
|
|
|
|
|
"ObjectReference": [
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"object_uuid": "5c6fbde8-f124-4ab0-9316-4235950d210f",
|
|
|
|
|
"referenced_uuid": "1c0c430d-30df-41e1-9e1a-1e291bf92014",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-12-14 14:30:15 +00:00
|
|
|
"timestamp": "1622037665",
|
|
|
|
|
"uuid": "5c7068f7-8858-45f6-874a-9eb402de0b81"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"data": "UEsDBBQACQAIAAxKVk6y5YN7wZEAAFowAQAgABwANzRmMjc1ZDJjNjYyMGQ4ZmQyZjU4MTlhZTkzNDExNThVVAkAA+i9b1zovW9cdXgLAAEEIQAAAAQhAAAAlncCFs2qP8Z3IusvUeCUofsfsKLMMU32rTEeQfy54VAiCYf/Wh1StQtnvlQIuRSDSWELUl5DacW4UjVhuk3JEbzjgfTM+U969Evn40+I/ESZEql7/LP6GXycMdNBiV5La1Lnez9GN2CbxjUfc71/0fS9LzEFuI/62Bw7OKvkYG77gzSMD9J+XN3yt+gYADCFxQn/Un5VXENRGCHhzzYWCqRVeHl4QcaBDvdGpIh4IwahopTq0W2OeqYxfNBYyKXiWIBqn9MOYVpvOXkNh4h62WO2EWkbMJ83DLHpV7P851AD/fNFEmobdZyV3COown78fG/S+Vz5CJfDj90sC2/7wNoP7xe5cNRDpnLYVD1/UVd/Q8/n4P738lo77UmyG2uNvCl6I4bVup2XeP3EN+jmPhN6WPXQGIebRSgy8ApyHskzRmV395cml9cEf0FmqptK69MQVpdJiqJVcc0IUSRt28WUhv1NhO35vPsMQl5aqTbIxGBB+OtI9oO6zjT7KUGZ14jERSAYPu86QFGIJQMXlIn5aZ1voNnwjcd9/OmP2zMfgG+mlvay+A5ePkQ9JWwzPAj1B+PsH01bUsHtFoxyw1vubJN/hzxRMNmuy0aVwav3Aa2hIwAbzpXt6o2sYCJRlT3B7M/bmkiGR3rY3DUvpfhM7vaIfQoEg5Fytgk+eLz32MCZrF8nqE8NbUGmayx3REELvaXfAW7/3MHJVQ9op7bfCbDtsk32UdcxlCMKWzOiFt/ZeAgufD6zDxioAVoNVOTCE0Mr0Uq3DL/z42c3CE+QVejcbNDL6ffrpJV3cNQiuAmsQraIHsW49yikYy+a8rsO1W5UBmrFqNxQdoJmpovKM/6W7YMtg4H756FNESKuiCwqY+jS+wm7vohxxRfI3ucfCuy9zU2QDRzQV3/aybag6hrMsFCOlrlVrUw7C1iDwmZhHdIyj0ewptCA/Wb+xBCiHFFmehT2SUbY5OXfGyR1Ehft75kyrpmXJ9+ogf49Lpc1sNA1+fPL7V4ft3RgKgXa3W2jd2JOKG2gFRuS2qtIi9yDEnZV0Lxn3TGFLbedTq7n2fI7wLM3r3YIquT1tr+Xvkl+9cirUXFarXpfE+VAYtpj/xSoPpp6zQ7fSNHU0a1Ac5MXhUftb+28h3Z6IoaYODkEEpk4SJZ1vNBPIHiP5PQpuFY6PjuV9ks6du7rHrpOzYGDhk6F2Jv5CQKyFqFjhAsdZ6Xgiq4Oe6LQKIlrtZi9bV+T/F/XwQjPpn0Tqg9BQbUoahTgomTeAosS6BNtdh0RAm2uITa19X4Zx1aTuDumy8Jq1FYtM7QdH6R21l6rYUYznCffOoTcyJNH/4YyV5DA2kTlea7B+mKEbiu2oxobM0hRNIFMcF++cx2QWemEMCZnSZa8sL18uO9CwXKYqOWPIxDC6OhvwRotN/kenXnSRboUZcbYssoi3WBTmW/A1OCaNt6nmkqegiRKCvSfx8XxKkjU34BCN/3g//2F73sx/UC8i4ui5vdbBFVILxgASeJolB1BkrA4vRKJJAumitqEIH5j0uS4zlimS/dDDeQzGMEOwEsZN2uyatWMk9Ga8XvrilNa4BClw88TYsN4m174MMSkVodLA7UkzCatrWd1MKfL5BApRxJr/wx06uZ5b7rPD44N9edcCWQH+TeGEiCSzfyYUzJbQTGHeQgDnc1TCLMtGHuNrmLMZd4DiHA+ETEj1XJTGjOXHPUlxK4M8SHsLwwRMf23rDpQkTz1Wwn2By0A7uGFX4Fjp+5iBjHswxR5OxChEQEIZl+j2CU6FC8RxQwyxd1Z6xcv7hnP/dwLBMmEHGSqn04B3flz2PPV9UZUr+BJ1umEKDlQIYBQKYQ3DiZWjvAG9sEfxL1NeG/7PJVjpaWsxo4tav2FufnVI+lzodRrufQlLKieLz50IYrBfIpx4BoX+bbdRMYZAwQaRXnjSFO1+YoVOYd8s1R0FrSgvqHl5FwI5vlGBqraBzx6PB1F7bkArScBT2aPK3iHDUgOM254BMc7eoqWALi+53zek2ATf1EE41fuIr5kQmJzwUuEmEK1bXDiXh/lGhUcGU6HT2Gw5XPkGO86Y68oEW9kdWH1H9M5iEMPftBGrSCLIsGyN7KWJElTVDPlqXy6axNourAw25gznBGB2nf/n3lQk/4/8LmLova6PSTUydfNQfrNi3b6BqhG+NFfZ6fh4o+VSkYZEdCC27F2ez9s4+n+ZN1CAsjR3KHaWBjTV6qwvHBxX0KbW7CCJbeE3kUdF6k7knfGw61bkRB4M72IzriOkh6NsduTOp7SDfnte8hNGLpJR0283iCYEHndmoXblEBm8IbNuOJ/hpsZXE40GBYNSeFaSOlIeU56GeZcu4yz9c358zzWDt3L1xs2IJd34MBXm9pUZtysM/qYtEd5EBHgjJTNJ7ZtjMpV+S7evvSZvzL/r0knwNChA2zJ4fhj/91WpfTHLm7Do4IQ9Vxs6+P1Pa5mggoyewNeMexxK64vN5zMKSj7LoNfbyGVJeydoyZsju5ZgNvXGhaHufpmdKiJTtGl7RU53oKrNBihASJ4LFolCu1SHf8mmjsJ96C4BkHfvGX4xS/v/y/gWun//35MrG5QSihPXi8RNcTJhjEsMiKRwfQbj/8v+vu+iWgcZ43q78nBExMwgXkJpCq2XR4CYXDvlwniFKZbiWy4yDjuT6PRd73QMiAilhF9N6Nc/c409KYyjtwboS9syulSQ2Mt1U6fqKdAGXZDhYi4SIEkRIeNd2ty6HbO4N6T1hL4qDxyPOCBUk2F1iMxnFKNeKA3zfmOw9aYvuJtfp5xHaY4kKrCl1F4/CHhdu63iMDUZD+MJ+zt0675Kh9N4P+A+obNZrLtjzbuPwms7vSjgyt5ZzPDFENTSESUoOEYP9u6SwLnshmjoyhZuiNir+BjiLFdKv3VICRzxkAdrD0kuzazzR8lNiN9kYigtoqLua4N2DQFBTpkLy8wMAWF+LlvTnOH/15SRza5iKKvFovUPuFLpxHS9yBOWc0S5Fk1EDBGv2m3JZC6Q/yHQQx6d0BoEcXARpePP8dfHFyBKvKnnNZqKT3L074j6dTE843EMVUFx228NTOAZs55w6wk3rUfTIZTedDdsSILmTlkHht2U1H1COCR+1QfwbcRL+KKHc5umrzTPFGQeGl6md+oUpSzwpKacidHd41/+VbHDML33C3kMC5MTILzicNHNkwAQAlQaohwWn6740cb00kW6JvlTz89oayPDNYtiuFIsHRnUCTUC275at/oWU1LDFV/atYGYtp0/vznc/G4xONIYihogBwyvYtx/p1dGQCEjxf8SrCxjj1xv4zuCPTMeKO1iz6pHLFI+/znj+z6Jg6s1mSbHKizbIVosBYoTZxqn8l4MM4ZLkVXD8WVVv/mlKiX2uJuOb9ps1cxAXEdQTpHESCe9usTflrdefZuexewMpLwLBOkKSjgnaYpjRSVvV9c3qisZEDBpoOJNRqB66AfYY1hMNzCuvbVZp0Q/EiCKtan6779qaTwiwfJaQb80jdiJWCgOidixb6VAc1pbukrtci9QC6WG/8lKfAweVMd2dRTdnVlyxzlwcSCAg6kTiBiRIDhw37fln6KK0D/FXNyNx20M7aoE0MdHEOCMrV8KQRstJdDGslbSA0/K+PbHAHGnEPELMKVSzAmtdEL4cxlT679g92wNRLwzi9aMv1lxR/TI3Mu6chM0T/JxGAAafy2G4zF9C10c/Xe1l5jgaDAzEHSAgBNJjc8hld9878fG3ocIsguPfCazg12kD3+Z65/rhr5H9Wu64s9e/hjtWS1b6v/Az0+66QxzIZgkg0Q3h9pBbbtRSVdzbGT7HEuLxTE80L61KeMz/rLdTvcXOD2XM5IGkWXlJ2vIRltgHySt0DTRvAStTPWDco+Du27w3g6ymlK9Mi2vArlm8pgbW5CxzR+Vc
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "malware-sample",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "malware-sample",
|
|
|
|
|
"uuid": "5c6fbde8-1ba0-4a6e-b1d3-4939950d210f",
|
|
|
|
|
"value": "wget|74f275d2c6620d8fd2f5819ae9341158"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "filename",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "filename",
|
|
|
|
|
"uuid": "5c6fbde8-bc80-403f-b7f8-4654950d210f",
|
|
|
|
|
"value": "wget"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "md5",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "md5",
|
|
|
|
|
"uuid": "5c6fbde8-b8a8-4d45-996d-459d950d210f",
|
|
|
|
|
"value": "74f275d2c6620d8fd2f5819ae9341158"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha1",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha1",
|
|
|
|
|
"uuid": "5c6fbde8-30c8-4cd2-90bc-4282950d210f",
|
|
|
|
|
"value": "8547ea228be2bd2563d87742fb25ab5be5126b9c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "sha256",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": true,
|
|
|
|
|
"type": "sha256",
|
|
|
|
|
"uuid": "5c6fbde8-1500-4a86-b780-4aee950d210f",
|
|
|
|
|
"value": "05394ab6eebdc4ceef62efebb2a4e760f3339ac27af22b490057b92b56eeaf5d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "size-in-bytes",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "size-in-bytes",
|
|
|
|
|
"uuid": "5c6fbde8-70c0-4363-a354-4cd3950d210f",
|
|
|
|
|
"value": "77914"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "d782cd47-8d2f-44cc-b5ff-5179f2f1f2ba",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "d5534ef9-4955-43d8-a763-c873ff3e0ceb",
|
|
|
|
|
"value": "2019-02-20T09:36:20"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "13f5738f-6efb-4623-9b00-ce66326a62f8",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3b72288b292a5b18d870277a116713118e23b103fe58b8b1ad93f0296513b509/analysis/1550655380/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550656676",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "3b3ee2cf-71c6-4a12-87ca-d5d8a800be34",
|
|
|
|
|
"value": "15/55"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "a6780ee2-559e-4d53-b571-df123fa7ade4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "0e52517c-13d6-436a-a296-fa6e7b6f38e3",
|
|
|
|
|
"value": "2019-02-21T15:16:34"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "e85c98c9-07e7-461b-8ef9-becfe1226b51",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f8bb5631336876a708796184833c78a8feee167ac4d65da0625c28ab9f32cc00/analysis/1550762194/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "5eb6276a-c276-471d-8e7b-04a9120567f1",
|
|
|
|
|
"value": "16/50"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "1c0c430d-30df-41e1-9e1a-1e291bf92014",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "50eb5e8a-92b8-44b0-85dd-f4d8919ad63a",
|
|
|
|
|
"value": "2019-02-22T06:12:43"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "ae2e4b31-58fe-4ca3-b8fb-2e54657cde57",
|
|
|
|
|
"value": "https://www.virustotal.com/file/05394ab6eebdc4ceef62efebb2a4e760f3339ac27af22b490057b92b56eeaf5d/analysis/1550815963/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826984",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "57aa71fc-56b9-411f-be79-084cdd5cb3ce",
|
|
|
|
|
"value": "18/53"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "ca5fadde-6d66-4478-9f89-15aee8ae3781",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "a8e4179f-0c5f-429f-a33c-59b04c090dc0",
|
|
|
|
|
"value": "2019-02-22T06:12:55"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "e28cb24c-131a-4b0e-93c5-3ff69241126c",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ceaace7eb68ce0faab1ce80a019d603c3f11bfc8e1384cfcbde13da4a08467e9/analysis/1550815975/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "7b368696-ef51-419f-98fa-20bb71174612",
|
|
|
|
|
"value": "19/51"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "bdd37f7f-ce08-4bf8-a7b6-378947ac1f32",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "5fe6212b-aa7e-411b-b220-cd020cd8923e",
|
|
|
|
|
"value": "2019-02-20T03:14:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "8d679758-5593-4237-b30d-86e8cb3fefb9",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7eefa483e23c0ae2e67ce3c3a399527b3244c6d23af4401842bab88276b26840/analysis/1550632454/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550656283",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "2c79d764-0dab-49aa-b961-184c9f35a00d",
|
|
|
|
|
"value": "18/57"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870770",
|
|
|
|
|
"uuid": "684aaa66-2785-44f6-93f2-08fe5ef56710",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "fde4d03e-ab60-4701-adbe-0c7c5ce8d34d",
|
|
|
|
|
"value": "2019-02-22T06:11:56"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "4168dd19-db47-409d-968f-60c12939aa57",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7698bc8a71875a8937488facf779d023834f92f6ecf1e926fce7e5857f8b1306/analysis/1550815916/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826982",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c54742dc-e63d-40d2-b21a-b51c2500dde4",
|
|
|
|
|
"value": "21/52"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "8560e314-a454-4bcd-a2d6-3f2f948f85f0",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "88cb4d72-5e56-4852-b843-8684a428b6d9",
|
|
|
|
|
"value": "2019-02-22T06:12:29"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "5559c79d-d521-4def-85d6-bc704ad2c7f4",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8b5f33b88b4abea7848d5dbb097b545385b6bca9faff0610c78dec45d7577a6f/analysis/1550815949/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826976",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "e1feefab-8a8a-4283-b401-29e3488438fd",
|
|
|
|
|
"value": "20/54"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "2e5a1e33-ce78-48cf-bbf5-67cde8b81971",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "4ee08472-e3a3-471f-aebb-4c219bde1338",
|
|
|
|
|
"value": "2019-02-22T06:11:41"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "c031f0ca-2b19-4a69-9704-53d4111598cb",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b97e9993702e0e7c214b72c5869a8d9e4fd59cec7fb42c9873e548f52a6a072e/analysis/1550815901/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826979",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8b4747ae-af90-4d34-8002-258f2c2b1c82",
|
|
|
|
|
"value": "22/51"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "e1c9702f-771a-4bc6-9dda-605e62b64bd4",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "80990bae-045e-4f88-b687-0c62c2db7527",
|
|
|
|
|
"value": "2019-02-20T01:10:44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "a9aa9132-aab4-4d42-b3ac-a1253838159f",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9bfa55698985096343655c5c2bf7c33f6ec8460c636922437d5109480c60fc8f/analysis/1550625044/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550656050",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "65044a39-47cd-4035-a975-0a7b78cf740c",
|
|
|
|
|
"value": "14/51"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "c445863d-249f-4f4f-8a2b-f334a57cd879",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "950e511e-4b8a-468e-a5f0-9ab28bff00e6",
|
|
|
|
|
"value": "2019-02-22T06:11:14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "d0f3bb84-caf4-4db2-8ea6-cd9bbdbd7aa7",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7eed6eecf1b5b167ee266b04ff3b146231fe47531a3f7ad122651db37a860257/analysis/1550815874/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826975",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "f71cd1ed-febd-497f-bc4c-9fd39f43a58f",
|
|
|
|
|
"value": "21/52"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "46a3f6a3-d2fd-4d95-91f2-63c200bcc518",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "baa4255d-7968-42dc-9358-ec738df49e80",
|
|
|
|
|
"value": "2019-02-21T08:56:49"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "2f8bb771-220f-48a2-997b-f09f6310fd3f",
|
|
|
|
|
"value": "https://www.virustotal.com/file/623a6f3f3192fe3b6a0e2d731a20b4e8eb5041fa4af3baaa68fde1720d296e5e/analysis/1550739409/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826977",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "be099aed-c239-4c8d-acca-e27154b50088",
|
|
|
|
|
"value": "16/53"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "90a03b89-315c-4f76-baf5-270b8f50dcba",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "9167fbaf-cee8-41ee-a479-7a2d197b3568",
|
|
|
|
|
"value": "2019-02-21T15:15:28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "fd9c42ed-27e9-4e77-9ad8-e811deb3d7d8",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e1c050a5425f935557f947028ccddc0af7674b144baf959b5221ba8fa4e04f38/analysis/1550762128/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826983",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "10271050-d088-4cd9-8072-78d7d9ceb357",
|
|
|
|
|
"value": "19/52"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "e56872f0-2860-4b90-b6d6-e90e54a7062f",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "0eab675f-98fb-4a0a-91f7-370b3ecb0f71",
|
|
|
|
|
"value": "2019-02-20T03:14:27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "0055f6a7-b033-4367-819e-bef60f951738",
|
|
|
|
|
"value": "https://www.virustotal.com/file/85a118a21531fdfdc62ffd2f39376fa67644d8cd4041a288b770def0a4f5f5d7/analysis/1550632467/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550656091",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "8cbb1f8b-7fee-465b-b27d-169713c14104",
|
|
|
|
|
"value": "16/52"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "404871eb-92bf-4226-aef3-e35dd843f916",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "a7d8f99c-3d46-4e45-858f-25a7ae4e4d54",
|
|
|
|
|
"value": "2019-02-21T08:50:44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "42a21570-8cff-4605-bcdf-ea2c1725e1e4",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8a0abbf321c2368b162c15cd322e465a02e696d2b0fbcf2f748cb49e98d3543c/analysis/1550739044/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826981",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "d3029ff7-ff63-4c5f-9c21-45c71b427f52",
|
|
|
|
|
"value": "15/56"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "db87582d-4bc5-44e8-bb5c-692c0a1675b3",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "c20162a3-383f-44f0-8bdb-0a2bb3466c42",
|
|
|
|
|
"value": "2019-02-20T10:09:28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "847ef514-c7c4-4e18-906e-6d9e890ce255",
|
|
|
|
|
"value": "https://www.virustotal.com/file/25eb40f52fbf71f729b4b7422e181e22ef19e38a461ce450446d47fa765cb153/analysis/1550657368/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550656534",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "9fc15743-0ebd-49f2-b767-d95d27f24585",
|
|
|
|
|
"value": "13/52"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"description": "VirusTotal report",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"name": "virustotal-report",
|
|
|
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
|
|
|
"template_version": "2",
|
|
|
|
|
"timestamp": "1550870771",
|
|
|
|
|
"uuid": "65a677a3-16ab-4e76-aed3-ecba7abc12f2",
|
|
|
|
|
"Attribute": [
|
|
|
|
|
{
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"uuid": "d8818d9c-1cfd-4f52-bd6e-51e9e6dee01d",
|
|
|
|
|
"value": "2019-02-21T09:00:12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": false,
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "link",
|
|
|
|
|
"uuid": "98e18b0a-52f3-4cdb-8f6f-10bb0989be27",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e3e7ef4f1b56b1a6a208df5f993989b2df33ec3c9e27a5bcd8add0bb40b63fe3/analysis/1550739612/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "",
|
|
|
|
|
"deleted": false,
|
|
|
|
|
"disable_correlation": true,
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"timestamp": "1550826980",
|
|
|
|
|
"to_ids": false,
|
|
|
|
|
"type": "text",
|
|
|
|
|
"uuid": "c30f13c3-9e96-491b-9d3b-865068609f38",
|
|
|
|
|
"value": "16/51"
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
2023-12-14 14:30:15 +00:00
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
}
|
