2023-04-21 14:44:17 +00:00
{
"type" : "bundle" ,
"id" : "bundle--5a3faeda-9524-4a8c-a329-b4d302de0b81" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-05-24T09:45:58.000Z" ,
"modified" : "2021-05-24T09:45:58.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5a3faeda-9524-4a8c-a329-b4d302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-05-24T09:45:58.000Z" ,
"modified" : "2021-05-24T09:45:58.000Z" ,
"name" : "OSINT - Repository containting orignal and decompiled files of TRISIS/TRITON/HATMAN malware" ,
"published" : "2021-05-25T07:05:15Z" ,
"object_refs" : [
"indicator--5a3faf9a-f514-4358-8ace-b1e202de0b81" ,
"indicator--5a3fafbc-3504-43c9-be65-4e4d02de0b81" ,
"observed-data--5a3faff3-8d78-430b-9d19-4cc702de0b81" ,
"user-account--5a3faff3-8d78-430b-9d19-4cc702de0b81" ,
"observed-data--5a3fb014-cacc-4379-9b55-4e7102de0b81" ,
"url--5a3fb014-cacc-4379-9b55-4e7102de0b81" ,
"observed-data--5a3fb039-5e74-435d-8157-b4d302de0b81" ,
"url--5a3fb039-5e74-435d-8157-b4d302de0b81" ,
"observed-data--5a3fb104-c860-4517-a674-b3a102de0b81" ,
"file--5a3fb104-c860-4517-a674-b3a102de0b81" ,
"artifact--5a3fb104-c860-4517-a674-b3a102de0b81" ,
"indicator--043762e7-6aa0-4a14-83d2-81a2109b7490" ,
"indicator--185d44d0-544a-4e42-839f-d6502950565c" ,
"indicator--e40170d2-b26f-424f-a788-196651e787fb" ,
"observed-data--157e2cb3-598b-4663-af34-28358808dd9d" ,
"file--5a23f9e1-beec-5637-b8ae-3f5160686a66" ,
"x-misp-object--1f1c1f68-c9e7-43e0-9779-98ba4c889dbe" ,
"x-misp-object--11861108-bcc4-4e10-9cb9-9d3a3acf27df" ,
"x-misp-object--5e60369b-411a-40af-92f1-18e01ca64a63" ,
"x-misp-object--7dbb436b-9e54-4d16-89e8-05f54984e2d0"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"misp-galaxy:tool=\"TRISIS\"" ,
"veris:asset:variety=\"S - SCADA\"" ,
"circl:topic=\"industry\"" ,
"admiralty-scale:information-credibility=\"2\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3faf9a-f514-4358-8ace-b1e202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-12T16:56:07.000Z" ,
"modified" : "2018-02-12T16:56:07.000Z" ,
"description" : "Yara rules to match the known binary components of the HatMan malware targeting Triconex safety controllers. Any matching components should hit using the \"hatman\" rule in addition to a more specific \"hatman_*\" rule." ,
"pattern" : "[/*\r\n * DESCRIPTION: Yara rules to match the known binary components of the HatMan\r\n * malware targeting Triconex safety controllers. Any matching\r\n * components should hit using the \"hatman\" rule in addition to a\r\n * more specific \"hatman_*\" rule.\r\n * AUTHOR: DHS/NCCIC/ICS-CERT\r\n */\r\n\r\n/* Globally only look at small files. */\r\n\r\nprivate global rule hatman_filesize : hatman {\r\n condition:\r\n filesize < 100KB\r\n}\r\n\r\n/* Private rules that are used at the end in the public rules. */\r\n\r\nprivate rule hatman_setstatus : hatman {\r\n strings:\r\n $preset = { 80 00 40 3c 00 00 62 80 40 00 80 3c 40 20 03 7c \r\n ?? ?? 82 40 04 00 62 80 60 00 80 3c 40 20 03 7c \r\n ?? ?? 82 40 ?? ?? 42 38 }\r\n condition:\r\n $preset\r\n}\r\nprivate rule hatman_memcpy : hatman {\r\n strings:\r\n $memcpy_be = { 7c a9 03 a6 38 84 ff ff 38 63 ff ff 8c a4 00 01 \r\n 9c a3 00 01 42 00 ff f8 4e 80 00 20 }\r\n $memcpy_le = { a6 03 a9 7c ff ff 84 38 ff ff 63 38 01 00 a4 8c\r\n 01 00 a3 9c f8 ff 00 42 20 00 80 4e }\r\n condition:\r\n $memcpy_be or $memcpy_le\r\n}\r\nprivate rule hatman_dividers : hatman {\r\n strings:\r\n $div1 = { 9a 78 56 00 }\r\n $div2 = { 34 12 00 00 }\r\n condition:\r\n $div1 and $div2\r\n}\r\nprivate rule hatman_nullsub : hatman {\r\n strings:\r\n $nullsub = { ff ff 60 38 02 00 00 44 20 00 80 4e }\r\n condition:\r\n $nullsub\r\n}\r\nprivate rule hatman_origaddr : hatman {\r\n strings:\r\n $oaddr_be = { 3c 60 00 03 60 63 96 f4 4e 80 00 20 }\r\n $oaddr_le = { 03 00 60 3c f4 96 63 60 20 00 80 4e }\r\n condition:\r\n $oaddr_be or $oaddr_le\r\n}\r\nprivate rule hatman_origcode : hatman {\r\n strings:\r\n $ocode_be = { 3c 00 00 03 60 00 a0 b0 7c 09 03 a6 4e 80 04 20 }\r\n $ocode_le = { 03 00 00 3c b0 a0 00 60 a6 03 09 7c 20 04 80 4e }\r\n condition:\r\n $ocode_be or $ocode_le\r\n}\r\nprivate rule hatman_mftmsr : hatman {\r\n strings:\r\n $mfmsr_be = { 7c 63 00 a6 }\r\n $mfmsr_le = { a6 00 63 7c }\r\n $mtmsr_be = { 7c 63 01 24 }\r\n $mtmsr_le = { 24 01 63 7c }\r\n condition:\r\n ($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)\r\n}\r\nprivate rule hatman_loadoff : hatman {\r\n strings:\r\n $loadoff_be = { 80 60 00 04 48 00 ?? ?? 70 60 ff ff 28 00 00 00\r\n 40 82 ?? ?? 28 03 00 00 41 82 ?? ?? }\r\n $loadoff_le = { 04 00 60 80 ?? ?? 00 48 ff ff 60 70 00 00 00 28 \r\n ?? ?? 82 40 00 00 03 28 ?? ?? 82 41 }\r\n condition:\r\n $loadoff_be or $loadoff_le\r\n}\r\nprivate rule hatman_injector_int : hatman {\r\n condition:\r\n hatman_memcpy and hatman_origaddr and hatman_loadoff\r\n}\r\nprivate rule hatman_payload_int : hatman {\r\n condition:\r\n hatman_memcpy and hatman_origcode and hatman_mftmsr\r\n}\r\n\r\n/* Actual public rules to match using the private rules. */\r\n\r\nrule hatman_compiled_python : hatman {\r\n condition:\r\n hatman_nullsub and hatman_setstatus and hatman_dividers\r\n}\r\nrule hatman_injector : hatman {\r\n condition:\r\n hatman_injector_int and not hatman_payload_int\r\n}\r\nrule hatman_payload : hatman {\r\n condition:\r\n hatman_payload_int and not hatman_injector_int\r\n}\r\nrule hatman_combined : hatman {\r\n condition:\r\n hatman_injector_int and hatman_payload_int and hatman_dividers\r\n}\r\nrule hatman : hatman {\r\n meta:\r\n author = \"DHS/NCCIC/ICS-CERT\"\r\n description = \"Matches the known samples of the HatMan malware.\" \ r \ n c o n d i t i o n : \ r \ n h a t m a n _ c o m p i l e d _ p y t h o n o r h a t m a n _ i n j e c t o r o r h a t m a n _ p a y l o a d \ r \ n
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2018-02-12T16:56:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3fafbc-3504-43c9-be65-4e4d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-12T16:56:07.000Z" ,
"modified" : "2018-02-12T16:56:07.000Z" ,
"description" : "mandiant.yara" ,
"pattern" : "[rule TRITON_ICS_FRAMEWORK\r\n{\r\n meta:\r\n author = \"nicholas.carr @itsreallynick\"\r\n md5 = \"0face841f7b2953e7c29c064d6886523\"\r\n description = \"TRITON framework recovered during Mandiant ICS incident response\"\r\n strings:\r\n $python_compiled = \".pyc\" nocase ascii wide\r\n $python_module_01 = \"__module__\" nocase ascii wide\r\n $python_module_02 = \"<module>\" nocase ascii wide\r\n $python_script_01 = \"import Ts\" nocase ascii wide\r\n $python_script_02 = \"def ts_\" nocase ascii wide \r\n\r\n $py_cnames_01 = \"TS_cnames.py\" nocase ascii wide\r\n $py_cnames_02 = \"TRICON\" nocase ascii wide\r\n $py_cnames_03 = \"TriStation \" nocase ascii wide\r\n $py_cnames_04 = \" chassis \" nocase ascii wide \r\n\r\n $py_tslibs_01 = \"GetCpStatus\" nocase ascii wide\r\n $py_tslibs_02 = \"ts_\" ascii wide\r\n $py_tslibs_03 = \" sequence\" nocase ascii wide\r\n $py_tslibs_04 = /import Ts(Hi|Low|Base)[^:alpha:]/ nocase ascii wide\r\n $py_tslibs_05 = /module\\s?version/ nocase ascii wide\r\n $py_tslibs_06 = \"bad \" nocase ascii wide\r\n $py_tslibs_07 = \"prog_cnt\" nocase ascii wide \r\n\r\n $py_tsbase_01 = \"TsBase.py\" nocase ascii wide\r\n $py_tsbase_02 = \".TsBase(\" nocase ascii wide \r\n \r\n $py_tshi_01 = \"TsHi.py\" nocase ascii wide\r\n $py_tshi_02 = \"keystate\" nocase ascii wide\r\n $py_tshi_03 = \"GetProjectInfo\" nocase ascii wide\r\n $py_tshi_04 = \"GetProgramTable\" nocase ascii wide\r\n $py_tshi_05 = \"SafeAppendProgramMod\" nocase ascii wide\r\n $py_tshi_06 = \".TsHi(\" ascii nocase wide \r\n\r\n $py_tslow_01 = \"TsLow.py\" nocase ascii wide\r\n $py_tslow_02 = \"print_last_error\" ascii nocase wide\r\n $py_tslow_03 = \".TsLow(\" ascii nocase wide\r\n $py_tslow_04 = \"tcm_\" ascii wide\r\n $py_tslow_05 = \" TCM found\" nocase ascii wide \r\n\r\n $py_crc_01 = \"crc.pyc\" nocase ascii wide\r\n $py_crc_02 = \"CRC16_MODBUS\" ascii wide\r\n $py_crc_03 = \"Kotov Alaxander\" nocase ascii wide\r\n $py_crc_04 = \"CRC_CCITT_XMODEM\" ascii wide\r\n $py_crc_05 = \"crc16ret\" ascii wide\r\n $py_crc_06 = \"CRC16_CCITT_x1D0F\" ascii wide\r\n $py_crc_07 = /CRC16_CCITT[^_]/ ascii wide \r\n\r\n $py_sh_01 = \"sh.pyc\" nocase ascii wide \r\n\r\n $py_keyword_01 = \" FAILURE\" ascii wide\r\n $py_keyword_02 = \"symbol table\" nocase ascii wide \r\n\r\n $py_TRIDENT_01 = \"inject.bin\" ascii nocase wide\r\n $py_TRIDENT_02 = \"imain.bin\" ascii nocase wide \r\n\r\n condition:\r\n 2 of ($python_*) and 7 of ($py_*) and filesize < 3MB\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2018-02-12T16:56:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a3faff3-8d78-430b-9d19-4cc702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-12T16:56:07.000Z" ,
"modified" : "2018-02-12T16:56:07.000Z" ,
"first_observed" : "2018-02-12T16:56:07Z" ,
"last_observed" : "2018-02-12T16:56:07Z" ,
"number_observed" : 1 ,
"object_refs" : [
"user-account--5a3faff3-8d78-430b-9d19-4cc702de0b81"
] ,
"labels" : [
"misp:type=\"github-username\"" ,
"misp:category=\"Social network\""
]
} ,
{
"type" : "user-account" ,
"spec_version" : "2.1" ,
"id" : "user-account--5a3faff3-8d78-430b-9d19-4cc702de0b81" ,
"account_login" : "ICSrepo" ,
"account_type" : "github"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a3fb014-cacc-4379-9b55-4e7102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-12T16:56:07.000Z" ,
"modified" : "2018-02-12T16:56:07.000Z" ,
"first_observed" : "2018-02-12T16:56:07Z" ,
"last_observed" : "2018-02-12T16:56:07Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a3fb014-cacc-4379-9b55-4e7102de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"source-code-repository\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a3fb014-cacc-4379-9b55-4e7102de0b81" ,
"value" : "https://github.com/ICSrepo/TRISIS-TRITON-HATMAN/"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a3fb039-5e74-435d-8157-b4d302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-12T16:56:07.000Z" ,
"modified" : "2018-02-12T16:56:07.000Z" ,
"first_observed" : "2018-02-12T16:56:07Z" ,
"last_observed" : "2018-02-12T16:56:07Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a3fb039-5e74-435d-8157-b4d302de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"source-code-repository\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a3fb039-5e74-435d-8157-b4d302de0b81" ,
"value" : "https://github.com/ICSrepo/TRISIS-TRITON-HATMAN/tree/master/decompiled_code"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a3fb104-c860-4517-a674-b3a102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-12T16:56:07.000Z" ,
"modified" : "2018-02-12T16:56:07.000Z" ,
"first_observed" : "2018-02-12T16:56:07Z" ,
"last_observed" : "2018-02-12T16:56:07Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5a3fb104-c860-4517-a674-b3a102de0b81" ,
"artifact--5a3fb104-c860-4517-a674-b3a102de0b81"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5a3fb104-c860-4517-a674-b3a102de0b81" ,
"name" : "TRISIS-TRITON-HATMAN-repo-decompiled-code.tar.gz" ,
"content_ref" : "artifact--5a3fb104-c860-4517-a674-b3a102de0b81"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5a3fb104-c860-4517-a674-b3a102de0b81" ,
"payload_bin" : " H 4 s I A N i w P 1 o A A + w 8 C X A c 1 Z W 2 C Q W e A H E C h L C E 8 C N j W x q s m b 57 R o b Y Q h J Y 2 G M b S c a A b Y Y / 3 X 80 v e 7 p H r p 7 J A v L r C H m c D i X Y 7 G D c a 1 Z Y 2 K o B M x y e N k N w U A V L I S z i g J C w s K y h c m G L D c p Y A v 2 / d 89 l 6 T x j G y X q C z z S 7 b 6 e O + / + / 33 j 1 Z f T 3 d v d 29 r X 0 933 + J F r f P b + x L t i 6 K T D m z j o K m y T H / z q s y V / y 60 S b w o 8 K o q c o I s T e J 4 U V S F S U g + w H y M 2 f K u h x 2 E J m E 9 b + J 8 d b h a 7 / 9 K W 99 Y 9 u / p a u 9 M d E W y + o G h Q Q 2 s S F I 1 + y s 8 p 46 w v 6 S A u y D u w J D f e / u G 23 / 6 d O S 7 A I o i 3 w n g Y j 72 E t h C C W w O Y o e g H p K z X c O z n a F Q a D o g d B J X c 4 y c Z 9 h W K N S X M V z k F C G Q Z l s e N i w X 2 Y 7 R b 1 j Y R C 7 O 5 k z i I m z p S C e a n c 0 Z J t G R a + c d D R 7 b a Z Q N C G H P w 9 o q w + q H X r J Z 2 z K H U N 4 F U M N C 3 Z Y O l n I M 6 K 8 D K D i 2 i X q H X I 9 k X d T c 3 d H b g s J 9 j g G 0 y e o w 6 s V p 4 g 0 B C i D k s 8 T y o A s f G D W D p C 2 M R + j B J I 4 b Q a f Z D s r a Q N 2 w 0 r a T x V Q s B A L C e + T Z q C m 8 k G A H l A E g 4 a Z I K N S F t Q w I 148 t 40 I f W G f 6 S F G + P a q N g j j A N l W M 47 m + G B j p R j p N H O A I W T h L U L O v + q i v + K i v 9 h a f J S + D P U D H r m 3 N h h t C + 3 O R Z S O Q c X a g H 78 X 4 B o Z H n A G e K Z O H B Q u q D 4 Z q D 48 h l X S B r U J 4 y s 1 R A k U 2 W a U N T t v w h v a e 95 i F q A g g 4 a p t 4 V C w 2 g R J e y 3 Y Z T o l N F e 2 z C z G a M / D i Q g 0 1 p s q P x m 7 D Y a p C 4 k I A N + Z d r 9 E f V C y h i X k o i q k J i U x p K u 4 L j K K 3 o s D j l K E R Q d x 1 O o C E 9 W k 4 I 0 i i b G N T E t Y S 6 m i 7 o a S w s k F V d F H J d S u q r y M U b G N F I O d o Y o n W G k K u m Y p I u Y E F l M C T F Z k V V Z i 6 d l G X B i K l F R C f 5 C I x e Q 4 d J Y A 874 t J o S 4 r J I V E 2 I a 5 B b d S U W U 2 R B Z G S M L G i a C Q M Y O q + K J M b x C l H F N J c W N F 5 N y Z B q s c j z Q J i g A j y 4 b 9E2 k q i m e V F O Y V 6 N x + U 4 l m O c x A t E B k I i K C L N y G D T 9 I l Q D F l S B R I n i q 6 m t Z Q I w K I Q U 2 J q j P B p o q V j M o C 0 m w W n w y l 7 g B J u 3 b s D U B c I U S z s a B l j g C K C d 7 p E y z v g t I O G l 0E57 L q D t q O 3 o T B E L 9 E g 0 s O h U C E M S s k m q d k 6 K Y u C s j S U G / I y E E m M s 9 m F 8 P B o L K c d O 4 v C J V u H G R B L Y + E y 0 4 Q L / B X y A I 10 K i E L l M W s w 4 J i e 4 i b N 72 x A i R B g A 197 z G w F 3 + u 9 q b c v Z m 7 D i M / d y c 94 n q R 3 F A 5 D 3 k r N y R Q q J P g k i p o y C R K h e d S T x x G p z E r g l R p X 9 H B W 9 Z D E a 3 S j A W T D G E H J 518 Z U 6 i D x F 7 i J p Z 8 u l G O I s w S 0 Z 2 u g X 0 6 o F p R 6 Z X p l 7 K S r k I 7 X l Q o 1 M 7 n d R I D g w 6 C 5 Y 2 s O V F G H / D a J 7 h u Z C Q T X P I M r R V q D k R v G / x o 0 5 z W z X i F K E 75 / d G F 3 V 0 d H d E Y X h q 7 e j q 6 S t T B x 1 F l 2 W G 0 J J 8 y j T c D I g 2 F 3 W 71 i w P E j n S s d V P H D v v z g 2 F e m 3 I s z l i Q x Y v 5 G C a + v O W A Q P c I B 0 U H G y 4 v m r o A O H m g / y d K / b M 3 t Q Y g 7 N G f 8 a j 2 b 5 I O 0 K N 0 O 8 Q A M p b n m H S X l z i k 7 T s o H + N Q m X w Q G G U Y D x Y m p n X A S 1 d 8 B L g x o R x z E P e o B 3 g w c C O B 7 B h 4 h T I F T A x 22 c 8 S 7 B F + R y C c Q 5 p U I X o 9 q B l 2 l i n q j H S a J V l D 6 J B N h 7 C 6 O w S G n w R U C a g U t + A U X o 2 M J U i p k E G A l 2 U D 9 Z u N N D m Y M Y u D X K M D + j O I T A g U k J U T 0 w w p n G c w y n D p C o H G J 3 k T H u I c Q O y 0 S H a D A o X H w O b 8 E g H A T U Q i l U v I L 9 N 7 W C A L X G / H U E j a 6 Y s X k V V 5 f l 1 i I 9 o U J b o 0 F 6 y N 2 U K a 1 g n W Q M z / n 2 z Q Q J c B V U B 5 P G c Y w 9 Q i + s k T S y X a t b M M 6 E Z q o t p D n W p R z F W A M W 0 b V Z u U T p F t 4 C i y P d Q v / C h P E G s h V k Z 6 H i 0 W u h 0 Q A w X H i K U 8 b y c 2 x a N 6 u x R B L q I p i D Z R C H n u I Y b D a Y X H B / J 6 e n K T g r h g 5 p P M x z S N U R a K j o c H B y M p O E F G S J l v W Z A t 16 r Q 3 y 7 R w W Y S E R 5 I e r r H z h v 9 a 3 T a p H B V h q R / o v W t A P 1 C t V T K / D l 2 V Y k 42 X N S n a K U d r M o r a S m W J w 54 P f / f Z A F I x H 3 C j o G k N O j z J 3 j + q 2 x i p O N 5 p o 72 n l 1 V Z R F k D 6 G Q L n F 3 c z u o Q Z M W 5 G X P J r V H j u F 6 Z w 0 Y e d f k h 0 O l w G h X e y V + Z i H Q X N L S M w R M N U Z W z 9 D 4 B F b a Y o Q Y p x s q p I X A i w w u 0 W 1 N A 5 H Q O r 1 H m p O 5 c 5 H s 2 w Q C l r 0 m R i A j Y J w / j J i j X N a 0 O U 7 D w d o n l V F j u h I G N r X j P 2 W u C B Z l j s H a X 6 d U 9 j G m 0 f 25 j z / 9 I o f U C W g s a //iPLEtdY/5mIVsv+FUXQPtKosf4j84JUaX+BE3ixsf4zEY1aOVj4ScIQmDytpz3RtWxxz4LQmpBfrmaJh9tCpUIa+yX2KagJyuCMbWIY9bHjjCiPm8owsrpMwWtNXstR9NISE0UNVqaKwziMYRrMsOg8UM87tIIpVhMgBK1BDZ2uskChkIPyhxS6pitIVr9bLs6J/gQwWayJgRzMi7QmKHM1DEUUdjXDgOmmTsbAytrgFiTJ8RQtWbhNjg9ZoMgn+3c/qQ81mMT5dKHwo0VMnzs+XEYWyhfkuWMxjFCoEjmp0eUmNyDa1xvcg7Jq0i2iCoE1OxYvqh9JZEiO0ev56231Y0oUE2kZDPW0OxbeaCE9F6azBSFPJ15HjpLN19ZtEZPJyHRaE5RJBpOYC/LE0kj9JKhc0aLZm+cbwwvtweFTAbdl+Xlt2MxlcNvKaN3d0fCM+v63wp0LceWCmutHV6gUKZih1S+ASlFgutIPpvLqtEsKQArO51JZ6/K8Ah6zSsRHbB6LYglvVA8Zo0h3vlEnVYrDaK4iUOFD/V0vkhg43hLH/luied1W2q4XVSqh9kOq7KPT2npxWYqms5L2XI5YetBFwtbr7UAJFDzfaC54foBYNdDswaJewX/rVCzDEnz/MSwvCQOQlySOYztjkB0bWwxYBaJj8To2ElOup2VrxDUFZbpEfR0Jf12kvuTqaIEy4KquAchHYZro6OnglWRiceepS3v3wh5DYMIvsD17ALWbeDWMm8Spk5YU0ErCDLmvL3k2EOxK1KInBzLxikO8WsBKSRqfxmq+kzutFhbNJtEyrOXnJSH77U3bbiZQtpupouvROBDIdK05QESntXcvXNrTtRfeigjMRu5QNmWbyKsSlKPpwTDZ2bWorzDIWzQb0GX62h5bxBT88iBY399rWMLcXjfo8FpeHAl0d665UDiEW9g6klp4WHjAlj6MCwk6GYmJU0Nrv+6attHqb7XmfxXL2vtIo8b8TxVkYeT8jxcb+/8T0qLhEAqjzq7ejp7uJX3dixe1oXNK2zGejbLY0zJs3ZCuvFuILULSbX6oPi260kmzAX3tL3DS3ipacVeZLW/SqVphox65/j59xW48Xa9kJAFyVF9lRN0MW7vPGB7KF/c/mjLYy2LIc2xWS5fndT+nUUHwaNboarubI5qRNrQCcjLso0coePvSvvmLe9p88NE7OgASDYWiYXS6aafozBexMwt0VZ3uergge7DnGWGQULAMQCWI+hm4z2VAtZhD24InyJ9/j5GWy9Itz3ELIOEyHpYEnQeWoxsfVO/+yQOP6YeUdvL9fRgfuJK5cq5c4rls9jOSrVET6RNzdFHe39o8Ba1BMQ5xHJI4JGqIXsGPItCn9BncxPw3cCPAvYhUrbzsrmxz59KfmEChERQhpb6U/evLv5EEJMaqwUNbW80Qgcyg/7F0lyVZLTdUW3E+XDJFfMUB8zhOpcAKonzFJJRO0x96o4iFmxiAMU1AdVBV2DgAiQEQFROuKDoIK5HAQqCxMYQtZ8wMGAN+KFdxymHABfBGNeffAG/0BkhBt8BbTKvKVwAjUgYpO4BNnUVAzIDMoBKpRKluhJL+bKeM6SpW0Y0BKHucOhwaIPngmoofx0iNIVmh/K2tgBLKoEQJ8ULg79VZZl3TyomhV+HUypumm0/VZrQ
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--043762e7-6aa0-4a14-83d2-81a2109b7490" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-24T13:44:28.000Z" ,
"modified" : "2017-12-24T13:44:28.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 0 f a c e 841 f 7 b 2953e7 c 29 c 0 64 d 6886523 ' A N D f i l e : h a s h e s . S H A 1 = ' 1 d d 89871 c 4 f 8 e c a 7 a 42642 b f 4 c 5 e c 2 a a 7688 f d 5 c ' A N D f i l e : h a s h e s . S H A 256 = ' b e f 59 b 9 a 3e00 a 14956e0 c d 4 a 1 f 3e7524448 c b e 5 d 3 c c 1295 d 95 a 15 b 83 a 3579 c 59 ' A N D f i l e : h a s h e s . S H A 512 = ' 8 b a 13408061876 a b d 7336560 c d e f 24 c 23 b 8 a 619 a f 8 c 53e29 e 970e620 b 8 f c 79 b e 1910 f c 0 2 c 2 a 68307 c 37 f 7 d 3e5502 d 6 b 14e3392 c d 95 a b a f 875 a a 419 b 618435910 ' A N D f i l e : h a s h e s . S S D E E P = ' 12288 : z 4 t C V 9 J y b p / A X 2 N g 4 T B D H b o w j b V M d X 4 l M B y d i x D o C b s + o K R p T 1 g L h c F A s L c 4 z 0 D L : x k A J 4 T B 6 X I M / 70 t x a Y B 57 A T l t T l H u ' A N D f i l e : n a m e = ' l i b r a r y . z i p ' A N D f i l e : s i z e = ' 1708616 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A I 11 m E s h b R b C F B M I A E g S G g A g A B w A M G Z h Y 2 U 4 N D F m N 2 I y O T U z Z T d j M j l j M D Y 0 Z D Y 4 O D Y 1 M j N V V A k A A z m v P 1 o 5 r z 9 a d X g L A A E E I Q A A A A Q h A A A A 9 C 0 j K a 5 y 2 J e W 2 r j 8 o 4 O d N o 0 X p f w s c g c 4 A v 8 h + 22 o Y m g k X i j u 7 F i V v 32 i v I W F m C 5 l A W W M j n d g 1 y F S S b b U V w 1 S 7 c g / b Y 3 l 740 v + 4 y f u A U / Y k l U X u r G 5 z C G M H G h e V E V Z n L L 7 N H T R g h Y A i 0 7 A 2 g a A h k u t 4 H V a M X z h a T 6 r Q l I f 2 j h L A L V X n H 2710 b 8 P g b k R O J 7 J / H 0 g O l K S j M S l 31 Z O l y v f F K V 3 O 9 I X B p e p T H Y 0 L 17 P m 6 P r F 7 F + r m s G S r o f R Y E / r n a 9 W M u I I 3 H f r M f g V 6 a Q e t g i N j x l / 7 v J d e y e j R 3 c H G I P 91 j L t E Y B O o G X v T e Y E E P H t V d M b H z e n t y + 9 p 5 C l 2 A h 67 Y s u j c 6 b z a a E Z n q d r A r P 7 + M D x L w O G n Z U y f J M f x d q K / u W K I u K D G 7 g W M k g O J 5 e A L e D i c r U 2 j E S D 9 g A e P N N o B o g G G B 0 C y n w t l A R 5 D J b p G C A 6 u p c u k / J F 9 P S G w S v e P V L H f n h x R u Y Z K r T 1 / Y q D / P X I F Q B l z N 7 u e C n S s r b U R j D z w y K F l L + H g s k 9 d B r I 7 p 6 I d P n p v V V p g 5 I X I 0 z G u U Z W 86 W L + I 2 + k p r o U 7 B 8 C d 0 C E X s 5 N u e t 6 o H o R X i e H W 0 i e O Q f J v V V h L D I n u f L p y h z f E 9 Q Y i W D V l f h u / m d / L D y h I C H j + c g 4 E s i X 81 U B k p R X 0 M Z 6 n g v B L + H z G E 1 Y J c 1 V A 4 o J 9 e i s K z x g u T D 5 u r k l o J E j N H 1 N A N B + w R 8 N M b s 267 t o j 2 K V v f a T h K 2 q h Z 106 W / 7 s T + e i c 9 c a 19 W W D d n D h o A a g N o h f B V T + g g j N k 2 N n b t h p / + Z z 2 W r w b N 0 o o Z w h X m 2 k h w 77 d c / k w x e j L + L n U B o f E G T Z D U 4 i 4 q n l 3 r z L l G D 4 q f 67 K 66 e r g D 0 n I i F 7 B l r d j D U u m y y 0 W m 6 r A U i s Y V O V 0 P g F E 3 U 7 J F C r f W Y H r 2 b R y h z Q O Y z I 59 Q 9 o V / s / O L V d 9 g G r J d l f z 73 v s 76 j U T 0 C 2 K P h j R s q 1 r U Y t 6 i n X d H P G H Y E f 4 v W B m 0 x X j 8 s 7 Z a i d w V W R a i R r H O g C z i a j L f d q f W E 1 Q f h N 0 L g I Z 0 q C 87 L S e K r F n 3 g 9 k / 9 n y b 5 j M W c a P K v I 3 g c w 2 P q d z Z h x V K F i 3 C P Z j q f Y W o z r D T O L j 6 w s U V U A O 7 c V c q S E j x t K t 6 m + N s X P W W l J W X v + A P e 7 t + 63 D 2 J F 0 R v X Y f 8 z j R g u T 9 m W Q Y 1 P l a w H m 0 X 3 G F / V 7 A w M s 2 Q Z 4 s r M f 0 w o P m Z D A 8 o l c 2 u j 0 8 U Y x R D 1 t Q h l d d G h 2 M b r n k C V 95 U / Z h B i L 7 g V p o 8 G k M C 2 q f Y k d 6 U I z Q i P M a I Q t V l Z n p r b l 4 D 4 G V z p k W 66 + k X L y O N J L q e s b x C p l n E 6 N E p p 2 M I 69 R Z 3 d 2 S 0 8 g S 3 o X C y x X d n W U o O 2 K A l x u o e 2 q s w f D b K a 3 I A i J P 75 O T U 63 P x j b x + i x C V L 1 R G L 5 H 7 i C b R G 6 G 3 d 7 j Q C i j / f v 7 k 2 K o M h Z Y Z / T F Q 0 8 U A r Q X S 2 s D 7 h f 4 R G 4 k 24 o u Y e a 9 G E v K H C D 3 o l j d W Z Q 8 h I o w q B H j 50 d G 7 r 2 V k u X I l H A c M c 3 M z O V l Q J 9 b J d U n 4 j Y l G 24 y n k J I M 75 B 0 3 X y 7 B q W k j 3 q z A B 7 J f P V g p 40 r O I e E f c Z C g I + v J C Q T j T s i i v w U w 8 p r x w b w H e w m k c v z A A h y H 2 N 0 6 T E o 6 N Y e x 2 l + U e W u n k o 51 i M 5 Q S 4 G a w r G E 5 I a z E J H e i C / 9 M o f 0 n Q 6 R v 0 n 42 Q y k a f u + i q b s 7 y h t h h + q P v W Z 96 O 6 E r N / T v I Z 8 l v x B y T K A t J Q p w A s B a U a G 8 D 0 7 Z T d b G F N Y 420 O W X Q K B i j 90 + c f n S Y E f p V p V e r T x l K u B i W 9 B J e h Q 91 B o q p g b G F l t c 4 Z z 0 I G G C f Y j w U g n g 65 t 5 t H h I Q T 7 L 0 7 B 4 F x f k + 5 o D B 2 u p G / D V 5 m e a + / T 56 F S e H F + S S w Y 8 z U P E C M M E f n t i Z Q V y T F t e 5 e N r I Q Y Z z u e d U 3 V f j o v 71 J u t x J 65 l w p G p D q Z L Y A U t z I D U o n f X o 61 L u w F 0 16 J r s l o f P j 0 z Z Z C S Z u q o l E z u B r N e n Y Q R k S G f U 5 D u r n j q Z h m 7 s 0 A Q e H 9 v r 1 u j W W 2 p v I C n N g O H s t Q j K q 3 R l F g N O 1 p N G I U j F O 6 k D M A t h 7 h C + F P y J z s 19 F + 2 K K i w C U m 9 q Q T i x i C M J F u 2 Z s p t Y 3 O u U j L g t c / v 4 G z J x r w I G T Z X X Q w 1 / x G + w z X T 5 J b 9 H X E c I f t h p 5 E x 34 Q 5 Q w t y g n l v y R 9 B U e F F q A v G e H Q i O G l v E o T J 65 n s X z F H 16 M 7 A m s c R D I f D J I D i A m k 3 a B H n F r V h f / b 3 t 9 p G G l 8 u l r 9 a D o y v 0 B w l H X r r 2 N o D 35 K + i d 4 Q x a d X U K I 0 Z t T L 5 f 8 D + 37 c V Z J M F f e j y + u N t 2 x e 3 Z E V g F E D t w z X B h i H n m G 182 D A 3 b Z j 5 P g V f R I 0 V c E F o r X m z d i + / 0 r t + i a t 3 W K H / p t / 7 z H E 4 r 2 e W w L 1 R 8 K e b C 7 a a j H q x Q A O 8 b y U d V 7 p T f S P 94 s 73 a m Z q M m L Q 3 q d l D U Q 9 K z j + I 0 a 64 F F 5 g v B n z g q G i R F 0 T v Z s R Q G b 5 b 9 o 0 O H u C R E L / Y x m H n 4 v S R O H z S R f Y k f b y c Y o Z U + J Y o U Y q d L z 52 I n q l u z g a s q X Q S K 5 e o 7 q A V W 2 / T m E h 8 w L N h 6 l Q d M k V 3 G f C W B e / b G 1 V M n W / S n N W 5434 x Z G E z d g l U I y z a U A o O x W y 6 C z 4 Y W 8 Z h o 4 L v 649 H q 0 R 0 + y Y 8 k + 6 P j / v E j X f R M O g 3 b y h J I T P G b 0 o q 9 A b 7 b 1 R K K r O A K h j Z e O / p Y e 8 T S 7 F 41 O c M + d u a J A + 1 x V C 2220 v h T Z f M 0 L w Y I g D q / X M i b F u p 6 M h Z D 8 V L f W p 9 x a h Z S 7 q X s p I B v 5 w o 39 a h t q H D 3 Z L g Y 3 p A K p z t S R H j Y m 35 e k V 6 m k x N 5 q U 9 S x Q O S z G r y X A G 3 d C w x 43 t o n Q 1 C R R s 5 V l Z 9 U y x k I W E C 1 e B 0 d / s s f 2 R O h / F 0 O d v a 8 b + E m o b S o 2e4 W H S 2 P z v C K 0 J 1 u M l q c 5 H Y / k E 3 m v H g y 0 o + 4 K v y W s 9 v G e R R C U d k q 3 x o t l r l 1 F v / m l 6 H p a j 2 i j 9 z X p g j K G G o d L C D g C I 52 I n 9 Z 3 R g 8 F W d e q R Y 0 7 Y 5 W j l k g v S 4 M V r H j J + + E y o h g M P N y P T p Y j U z B t 4 V y R e 0 g 7 O w 19 l A m + h 6 F R 1 z e t W r Q W V b M 8 + I X P 8 k 1 a H 1 T a J 3 x K Z 5 b 33 + Z a I O R 6 I 6 S n J w s g 17 y c a j K T l 7 v f v 3 A u T W z v H S w Y D U F 4 L s E 4 Z h 5 R 6 C f k N l Z S 8 C H U K q S 9 T X G o D A / c G B b t X 2 I d l a H N P W J R i 0 K f a Y Z 8 G 3 G L a m q r W p z K u Y I y U L e e w y X c b b f R Q Z J T i p S B J 5 a 47 W a P C K j X h n v / 2 I o 9 z M V F p T d L G 97 L / K 9 M 9 c M D l S j g o M G l 3 x A B H J 3 p T f N L 2 p B c o + U j z 3 S p C F R S L J 0 1 a S y P Q Y X z h 31 a A C s T C 7 v B f E d E 5 / s h y T I V c I A + E 2 c m f H T D 4 g k i 5 o l e / l d u g g i R K a u 7 t 8 B s M 8 H y D W h 4 / K z f R Y Y v D X c B u a n Y f g g N N l J w J O 3 G p p 5 r m 9 m N c E s E K j 6 d 7 t 0 0 r + X v m 0 B c S G / H K 4 L y 0 9 x w 27 R o D v 3 V v l y h u k G H F A N v N y O J q 1 B v W 1
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-24T13:44:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--185d44d0-544a-4e42-839f-d6502950565c" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-24T13:44:26.000Z" ,
"modified" : "2017-12-24T13:44:26.000Z" ,
"pattern" : "[file:hashes.MD5 = '437f135ba179959a580412e564d3107f' AND file:hashes.SHA1 = 'b47ad4840089247b058121e95732beb82e6311d0' AND file:hashes.SHA256 = '08c34c6ac9186b61d9f29a77ef5e618067e0bc9fe85cab1ad25dc6049c376949' AND file:hashes.SHA512 = '9db880f9429573c2471c55f1578319bb7eeb2243b64493d79a3caa0ed964f88c2b560a862f54b7b768ce9e184a3763181e233a94ca896275a43d38bef1c6359c' AND file:hashes.SSDEEP = '12:7s5q/29Vdb5t+JuqqNvIlUBrlf+X9tZaf:Qg/0B5titsvIaBrlf+X9tkf' AND file:name = 'imain.bin' AND file:size = '436' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAI11mEuAPgr4aAEAALQBAAAgABwANDM3ZjEzNWJhMTc5OTU5YTU4MDQxMmU1NjRkMzEwN2ZVVAkAAzqvP1o6rz9adXgLAAEEIQAAAAQhAAAAi9qeDRSR3JRmL4y+RbQcBKzTIVcIvvzgBQUJGxpQGo/rsCYwfRiGd6QDSo0rzBqRUwMLQygNUGRUre9SLFUIzKvHOqYz9X0AF1W6ValugkhcHYqKCztpB0yrG+nTmlGGTK/iO/N1Ik6UI6A+y/cV9YAhYZddiuDLdqLHI0VMJ0Oy3XpOkdfIg0h3hcJY0/5GgJ5d6YPV4mFb4jAfQayCi8WoAq01EniDIHzJXqcq7Os73CTqCaI55gtx2uzBacNIgJetRATkdxGvVjzjF2tDUNETabCqDZVdPuRn8z0lOiitbKg/RjbiXurQSPccHG4ELd21Wo5UU93g0fFRErU+h82ca/45279esLNp7yBGk0H9PzUGQwxqB9bkC2zEEaEfdGDf8KFU2CYh0fuD2ZrX3BWJTo8RYlSWp3nULB+Cb8cHwvxw2NHudtkNbLhsH0SoEngmREMXGEIKUVgm55q7Ty/DlG9Ns/7JUEsHCIA+CvhoAQAAtAEAAFBLAwQKAAkAAACNdZhLJh2UbBUAAAAJAAAALQAcADQzN2YxMzViYTE3OTk1OWE1ODA0MTJlNTY0ZDMxMDdmLmZpbGVuYW1lLnR4dFVUCQADOq8/WjqvP1p1eAsAAQQhAAAABCEAAAAP07aDX0AtOaGghobkL0gKKRzjLgxQSwcIJh2UbBUAAAAJAAAAUEsBAh4DFAAJAAgAjXWYS4A+CvhoAQAAtAEAACAAGAAAAAAAAAAAAKSBAAAAADQzN2YxMzViYTE3OTk1OWE1ODA0MTJlNTY0ZDMxMDdmVVQFAAM6rz9adXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAAjXWYSyYdlGwVAAAACQAAAC0AGAAAAAAAAQAAAKSB0gEAADQzN2YxMzViYTE3OTk1OWE1ODA0MTJlNTY0ZDMxMDdmLmZpbGVuYW1lLnR4dFVUBQADOq8/WnV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAABeAgAAAAA=' AND file:content_ref.x_misp_filename = 'imain.bin' AND file:content_ref.hashes.MD5 = '437f135ba179959a580412e564d3107f' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected') AND file:x_misp_mimetype = 'data' AND file:x_misp_entropy = '5.44610603085']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-24T13:44:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--e40170d2-b26f-424f-a788-196651e787fb" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-24T13:44:31.000Z" ,
"modified" : "2017-12-24T13:44:31.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 6 c 39 c 3 f 4 a 0 8 d 3 d 78 f 2 e b 973 a 94 b d 7718 ' A N D f i l e : h a s h e s . S H A 1 = ' d c 81 f 383624955e0 c 0 441734 f 9 f 1 d a b f e 0 3 f 373 c ' A N D f i l e : h a s h e s . S H A 256 = ' e 8542 c 0 7 b 2 a f 63 e e 7e72 c e 5 d 97 d 91036 c 5 d a 56e2 b 0 91 a a 2 a f e 737 b 224305 d 230 ' A N D f i l e : h a s h e s . S H A 512 = ' 57 c 4 a a 0 7 a e d e 473e5 b 8424e4 e d 8173 d 0 a 6215306 c f 9 c c 44 a b 91e4745025 a 0 1 a 720929 a 0 2 a 25 f 4 d b 24 e f f 81 b 624 d 6 d 6 d d f d a 191 b e 0 6014 b b 319 a 933 b 9 b a d 12 e e c ' A N D f i l e : h a s h e s . S S D E E P = ' 384 : e I n 2 v P e q U f m E Z + n U n 0 f J C f M d X W g u g o L 2 R r X d U W J C X X t B : e B P e q Y m E b 0 k U X 9 X d U z X v ' A N D f i l e : n a m e = ' t r i l o g . e x e ' A N D f i l e : s i z e = ' 21504 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A I 51 m E u w U n 4 I 5 S k A A A B U A A A g A B w A N m M z O W M z Z j R h M D h k M 2 Q 3 O G Y y Z W I 5 N z N h O T R i Z D c 3 M T h V V A k A A z u v P 1 o 7 r z 9 a d X g L A A E E I Q A A A A Q h A A A A w c s V o J c m V t j i X T m F Z 8 v 2 A u 3 R 9 p l C n p 19 G O 9 c y I d X l r e / 8 Q M d J F w 0 r 6 R L 8 m Y D 7 E s H m B t E B x E Z q b u Z n t o + X X Z 2 Y 2 p l x W 0 / c f S T U 1 c O v I G y d 4 H E 8 O n I N T P T t 5 r U 2 d R Z i R J N T Y x k J 5 G B N g q f 7 g T f p w G 0 D o 1 M h N c 9 i + D V j L Y z F G E Q g h M n U Q c 6 q n L Y 2 p 6 / U 20 X 4 O p V 2 G M v 9 k 7 j z Q Z S F / O J 4 y I w t K 6 / Y S t 7 m k z M Z M 9 J x 6 + c b x 1 N n / b 0 2 d I n a 3 B B S G X f d k Z j O m p W u + U d e w 5 z n c V u a v u 5 a W 88 I X 7 W Y h I V O X J 7 O c G S r H t c 16 W j N A w y m 2 G 2 i O a Q R A / 0 N n h 8 M x i o M s 5 e H 3 b Y 0 n E X h 5 v + 0 s 1 e O 82 I 9 U J 9 V N T I 1 m 0 c x X V M p I o i C K m S c i J / Z 1 V h w 8 Z K a 6 I 4 Y b r R f v d 1 m 14 d M c 57 l r o 706 t u O C P / H 0 p R e 9 M W o B h A e g j g P D s g X h e J W P w 80 E B e Q S 2 / 8 l i h p n l h s f b p X I R k / G 4 o 8 B y i l y c y X 4 W x x T k A s H B x X V q t u X v I O w t I p F y P O Q o O x 3 b s e O A Q + p g v g 4 q U m x F W T 4 x / n 4 H v 2 J t G q A G n 2 + 9 r N n 2 P D O G u 6 Q p q O H V g g l S v P O l t W p k m l t u V Y / X Q j V B P z w o V B x H X d f B n O 1 d X Q i l 9 a y O G x A G n q F u c P X H b r S l 69 T E X 9 G / 84 R K P 7 G 9 t v w s g 6 l Y W g r R e Y 36 O s w n 8 Y y A x q i Y r p c j N o z i u 2 T r t e Z + P H N q I j R r d s / C h g C R P q z T R z w i U f D W 4 b h k t 0 p i o b o 2 F s P s 5 o z H b r 1 z x o u 2 C K B r r B V O k f D 8 k j R S r L l k j 8 r U o G r e X E Q 3 Q i w I d a V x 5 z r P I k 5 W / g f v s l k E d e p 6 n + / R F l B h v F c g z k c e X / 0 x P r u d D t i w m G 4 W z n d s D O N 7 v U J 3 q / 6 M k H 9 K E l p / 1 y P 3 / j 3 t 2 K T Y z 3 w b i Y f d B E V V N t g F g + s 2 k t j n Q / E v e I C P s m M G 3 r f m N D Z 8 d X W u H l C Z F K 8 t c y K W Y 1 G O U h 5 I u b Q d 16 r f X Z 512 b d i q U 8 P H Z N W s 4 S H T 3 B g 4 c o 85 F f Q 71 U 7 N t f h + 9 Y I 7 H s n l z s 7 O l 4 I / h k o z l X J A 9 T P e U M 17 w k p n H a Z o W 7 G n Q G Z r D r 1 z o G N / g d J e o y I 3 C u s d l D Q p h 45 R Q o 8 G G 4 P f A n z 4 D r / S v j q j B e 3 / t Q O p j U U / y F k U N r I W F D 58 y 2 E b z 64 C z k T z N k k m n h 3 Q h H 3 a y E G p 13 o W d s A G u E i c q Y o 9 W o 6 g g Y 3 j K N V D Z j g z 0 o c R h R P z O 92 W 1 I S 4 I Y m 100 h j Y 32 D k i B m W L c X 5 x U o O 3 W 6 D N g r O Z j Q g 0 n X 5 a K A H 9 x c O N 9 Y 5 k G B 9 D E N I o A Z 8 m b M / Q W O 9 h V k + O 0 x J + 0 o 0 b b e 7 P 8 t Q 71 o Q V 2 W y o d / i 9 q j A a b f q F R u y C X d s G s k e t h U y E W h C e S G 6 Z t O h 82 B q 4 B C d I N b Y + A 0 o + A + b n r w k p I i l R r 1 B 1 i e b G A 8 r V v Y Z n 8 N 5 n k 0 9 D B Y u K + I g j 7 r j k z B F H t w 8 w n M 8 H Y d p 6 g + p 6 K J K / z n 6 R M j b 5 L m J y X Q P o 9 u M Z m h 0 r e R A P B g Y f M L 1 Z b 0 0 Y Q c U Z q A w Q F B T 7 X 5 D a A H 4 k 2 o f m g / N U 0 p p L l j P w u v U p K X o o a f + k n S h C C 0 6 f O r U I 6 X s X t t c B Q 8 z 0 a U n z a M 7 g S 9 k i g O 8 t t 6 d + Y K b 5 q K g q Y 3 H M 69 X 2 b F a Y k j 76 f g T s e d n S p n e K I o X I 1 p q e P 2 F 0 Q L j a K P 3 K 5 m G V V z U P 8 b P w U y f K a v l z g 4 P P e / N l f V M 6 l g 6 J v 2 N Q 8 / m g c m G f 70 O b I M W R D 1 m t v + J y 1 j T l I n R 70 d l 2 W 8 P C B k h 1 m T f Q o U Y V 9 k A p H 4 j B e w D f O R o 8 H W s R 9 o Z a P D / Y Q o T 5 G b 6 T v 4 p a W Z D b W 3 W m V t l 2 H 1 M Y G X F o p D P 2 u W u A 1 P U A I g R 3 J 5 T K Q z q O g v r J A f + m t H q K N y M g Z H W H B 8 z k Q S m a p H a 8 l u I h / 1 x e z a p N 9 c Y 4 W 3 v t f B g 2 g X 6 Z V K D p n 4 W i x / b K I y W w N D v Y C q L 90E9 + z e I l q 9 L S U k w S Q h m G I 2 X r t t 93 i j Y A S y o B x / s c T k o 8 R / u b z d C R Y 4 b 97 y R J L W D g s W k h Y U D w V R z P O L b s a 14 r 1 G g h 92 u j C 1 N b z o Q + I m 5 b v Z Z W X I s J o z j + Q 3 i D 78 k M H u a v r / U 9 m e u K E q a i Z g D p R n 3 r T o 17 p 7 B J Y U N i w s y B A g S 0 w B T x k L 88 D v B L 9 L p d B S M r h + J V f 20 a f a r r W L L i u 9 D H h t q u f u T K m n 6 N 5 E G K N D 19 B R u 5 n h N a u 6 E b v u K I 2 k P d / X a s k l T Q k l T M Y C 5 / q N R V R / y 9 v V + a i 861 b V V 2 L V H Z 943 S E q p + S 4 e T B T W K T H 2 a L z I u / k P 4 S t o e N C p e J p D p y 2 i O w k + M O L s x k T N G 5 G L d f / A b 18 z + a 6 Y 1 K V H T A I I A w e 4 d W O m 3 w X 4 S T e u I o s / A j K 8 M 7 l X o M A K d n U t a 2 G L O M X U J o p i 5 d F z z 4 A c 2 D y / + B g X z X 4 r I h a P I C 4 c L H + N S u 4 Q 0 8 h F p F a 43 K s G P I / W 1285 C 97 R X s D T h u y Z y S l U v 1 g k o T K S b w v 8 V z / r Y 90 M 94 h u w n y b F y r 2 R 2 Y T P c A W b 6 Y u y I t Z h n q v E 2 r G u 6 H j O x H 14 Q B T b + p n l n T k v L 3 W f h I 55 b g 9E7 k r 4 B T u p u B S Z c g L U d v R Z b Y X i F H h + n j T F z + E B j 0 E U t R L l F K 2 Y I 51 R w 7 v e x P p w x + T Q 72 q c Y q 3 V t 6 h A W 5 / 6 z t K O B Y W P t b 68 d b j J N 8 U w V Z x O G A K N 518 P 5 C r 8 J s p S c N + M b l 4 q 3 t J r 2 N X h D C r R R x W E f v 2 I R i A p Y t Q L a g 9 D 1 V D I a O t T b t v k 1 z A S f j h P T J 6 n O K w z k w F x C / 5 l d S I P v 7 G r K + 4 g K D T Q j P 0 1 E p Z b c R 14 w f V C B Z 3 + q z 1 P a 3 y K U V O x p m P l A V 6 o w e 0 F H O M v F q y J l h / R r 15 G q x u 5 E y w + v b a 9 R S J d a P y U I 6 u + 6 U q X v T X S a j 5 g M Q U i v n O G w x R E 4 + o I o c + k t 0 W M k f e S v j H k n 7 f v h W H 7 o Q S z w 9 + J A a d + D v b 619 / Z + s G 2 s / X o d 0 g o t v Q 6 m h s F h 8 q o G W L g e 7 k c z Q y 8 W N 96 r c y / m W u A V R 5 y q A i 2 G P Z + U m q L v 1 / Y w R 8 r 1 N C 1 h X S f i R O f E 4 + J m S Y v E 1 G 6 o 1 M B s m H a w U 5 / E r U b z h K n 31 p L j 0 v d o l e 9 A Z h D / z 1 n / h P y p U Y p e C r n 7 / B J Y N 6 + r E B a Q O w W 0 l u B v P 4e8 s 42 v / I D K I T + J m W h N X i A x G Z 79 g K 2 a i V o q 6 N L F E w P j m b F d L w n w b K S l T 0 K F C t 4 O l H n W 1 g w 5 v g B U R I K D u W W E c o H 3 W S / W 3 F B D p U l b P c B + M Z s / l i U Q u / V + k 29826 z F / x + N X 0 C F k t E t i F h T d T f I M C Y B k 6 r Y W s w k I G N V J D H v n / N u F l Q 4 L G y h d 7 / W 8 Y g t l 4 J i y b t x X + Q P t B P f z 3 + 9 g / j y H R / K G a 1 H 1 / w 8 P V N O e o 8 r E k r 3 U 2 b 8 p 3 O O x k N S Q w o / c 2 y v w o Z C s e V / D v P w e 2 j 4 O w 1 C c S 59 h D u P X E Z N M n S t l A f I O m i a a g j y O V N Z c 255 j x S P 1 l u 77 X q 83 / r 2 O T K K l L S I a 4e5 Z U q 5 s D x l E z 6 h 9 x S X j 177 y R z d f c K S 5 q H 1 g H v + n 0 Y N p T y R d k R 6 z L T I p E 2 b 9 x L G i w J 69 g w d m M F O o K X O 7
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-24T13:44:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--157e2cb3-598b-4663-af34-28358808dd9d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-24T13:44:31.000Z" ,
"modified" : "2017-12-24T13:44:31.000Z" ,
"first_observed" : "2017-12-24T13:44:31Z" ,
"last_observed" : "2017-12-24T13:44:31Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5a23f9e1-beec-5637-b8ae-3f5160686a66"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5a23f9e1-beec-5637-b8ae-3f5160686a66" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 4 ,
"optional_header" : {
"address_of_entry_point" : 4205352
} ,
"x_misp_compilation_timestamp" : "2008-11-10T09:40:34"
}
}
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--1f1c1f68-c9e7-43e0-9779-98ba4c889dbe" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-24T13:44:27.000Z" ,
"modified" : "2017-12-24T13:44:27.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "3f1ac2364c8e06237f6f841a302f249108aeaf9b" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3b-1f74-4a7f-bf41-4c6d02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "5a3faf3b-7c44-459a-b890-46e402de0b81"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "8704" ,
"category" : "Other" ,
"uuid" : "5a3faf3b-00cc-4562-860b-4a1f02de0b81"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.24017560026" ,
"category" : "Other" ,
"uuid" : "5a3faf3b-8cf4-48d1-85a6-461302de0b81"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "768:W7fTBN81tL4OGpnvnRzLC5uE4LCwtbyhmjBBvpLJzpVA8NQ8oazAlo1sBG87jGrk:dlQOb7TH" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3b-cab0-45f9-82d5-493a02de0b81"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "bf235b24aec5b15ea5255261dee81284137c2f31ae64e03c6311377a00ac114b" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-2ab0-440e-afc9-4cea02de0b81"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "818a9eea1164f02a20207c906c0d007ec98bc589a323d9993fd0859f6b9aa59f4c85e9966afc05281bab7feddad5e25a8039d2bf7a98b0e60b3214cf89ed008f" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-5608-4b73-9045-4ac602de0b81"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "1d2a14142d0e98c0ede881657be0b620" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-b134-453e-9d99-41ee02de0b81"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--11861108-bcc4-4e10-9cb9-9d3a3acf27df" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-24T13:44:28.000Z" ,
"modified" : "2017-12-24T13:44:28.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "a07c2e5b0b903b4d4602474a2c3e26300cb5de71" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-b884-46ce-9b6b-468e02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "5a3faf3c-f938-40c4-9bf8-483f02de0b81"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2560" ,
"category" : "Other" ,
"uuid" : "5a3faf3c-9cec-450e-bced-4d0702de0b81"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.02793750695" ,
"category" : "Other" ,
"uuid" : "5a3faf3c-3664-49e1-bc80-4b1602de0b81"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "192:bPwY+mHo4aSgsRPwY+mHo4GF4M+7xzGtXH5dJL7VGO7tr0F:UNmxgTNm0QF" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-0900-4dba-bbab-486902de0b81"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "f510bee135f800f910f5987c2684c3051756e7182939b93dfddc457c4be8a005" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-33cc-4f2f-b1c9-4c0c02de0b81"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "990bd0267b536b3768fdbb768e5dd3035c0f420f807c31e54eee794144b97e2a13390e0d40b33da6d84b600bb83d8d64f207ccffc9784243fc0c54f0241df514" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-bf00-4a5e-bd96-4a9302de0b81"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "4959dc6a9b68e9d55b254ce76c458eed" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-de90-4c8b-8ec0-444502de0b81"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5e60369b-411a-40af-92f1-18e01ca64a63" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-24T13:44:28.000Z" ,
"modified" : "2017-12-24T13:44:28.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "196e027a8328ce2ac5fa1431d501c257a9a79f1a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-4cbc-49af-95a7-45d502de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "5a3faf3c-335c-4646-96d2-499c02de0b81"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "3072" ,
"category" : "Other" ,
"uuid" : "5a3faf3c-af84-470a-8d32-473c02de0b81"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.52960066296" ,
"category" : "Other" ,
"uuid" : "5a3faf3c-87f8-4286-9f2b-44d802de0b81"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:o1uiM+CMvScnq2p20lZ+IG6Vg8xHj6tJlDiABF3Z+qd9NUjHJ2C:o1uirCmlZ+/8xHuRDzX2pB" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-1334-4264-bbf8-46f202de0b81"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "eda3c565062b52ab2ff5cd7ec7e7a9e3198da40387d916c0e74881b4636a2d5c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-4c3c-4587-bf34-40e702de0b81"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "fd978c87f845c632997d723ea3d1ec6d8fd61f4f30f8c3a95e71015b3ee693538ad5878d99f5111c096e22020e6363ce2642ab09a5b52e5c8de1ad0797659c63" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-df08-42b7-a668-4f7902de0b81"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "2354a2e07869f9a732f463fe084ad6c5" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-5780-46c3-92b9-468d02de0b81"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--7dbb436b-9e54-4d16-89e8-05f54984e2d0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-24T13:44:28.000Z" ,
"modified" : "2017-12-24T13:44:28.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "b9511de0a85e2bcba775228260c748ed0b9faff0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3c-bab4-480c-9a98-42bb02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rsrc" ,
"category" : "Other" ,
"uuid" : "5a3faf3c-9140-4ee9-85e0-4cef02de0b81"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "6144" ,
"category" : "Other" ,
"uuid" : "5a3faf3d-50c0-4c80-bd70-4e0d02de0b81"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.06803807105" ,
"category" : "Other" ,
"uuid" : "5a3faf3d-2ea8-4996-9f9c-4ab202de0b81"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "192:cFRr2VNBK3keWukvnmsg7Lapoyl0yrKzNVOQfcdfQDnmnVY7n9:JukvnmhvEwNVOgrmi" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3d-46d4-4580-849f-4a8702de0b81"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "9b8a7bec5a92a7c61abd1db2afc121c00ffa803422ee2e4e9c419bb2d2533d7a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3d-c6a0-4765-bf0b-413002de0b81"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "d89a6dd18dffc82c9a532d925ca1e0177d0ee6152ea3598336aa5f56804330b7dae82891828b83cc11708ce50975dfa089933124f4561ea4aca77f96ad73c320" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3d-7400-4926-bf0f-416902de0b81"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "fe8374bfc19886efe88fb53c50e26e35" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5a3faf3d-6af0-4505-9281-4d7002de0b81"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
