2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--01e8868d-48ae-41aa-8516-ea5a303758b8" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:23:31.000Z" ,
"modified" : "2021-06-19T07:23:31.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--01e8868d-48ae-41aa-8516-ea5a303758b8" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:23:31.000Z" ,
"modified" : "2021-06-19T07:23:31.000Z" ,
"name" : "Netfilter Rootkit Samples - F. Roth - Google sheet + expansion" ,
"published" : "2021-06-19T07:27:39Z" ,
"object_refs" : [
"observed-data--f37dea30-31e2-433b-a5a7-496bbc29ac07" ,
"url--f37dea30-31e2-433b-a5a7-496bbc29ac07" ,
"observed-data--01758ee5-c2dc-4efd-be6e-047cfaadbb8a" ,
"url--01758ee5-c2dc-4efd-be6e-047cfaadbb8a" ,
"indicator--ed183e3e-ac50-4ba7-b340-b7cef8292189" ,
"indicator--08c1c0b9-3f26-44b5-9181-1bbb71a9b921" ,
"indicator--54cced0a-cc7c-41ba-890d-b043db623bab" ,
"indicator--da79e5e2-3944-4de3-84c3-5a59a16fb3fd" ,
"indicator--5e1a1253-df3d-4d7c-aaa2-36db9ed411f1" ,
"indicator--48bba73b-ad9f-47d4-8c75-b4f0dfa77c22" ,
"indicator--9c23f0ba-8a41-464a-9bab-60fe4ec0034d" ,
"indicator--7bbad130-f1f4-4b17-bb04-3d4d7d6bfc37" ,
"indicator--66cc5e31-e702-41bc-ad3d-c7d4e6f363df" ,
"indicator--17464b7e-b2f4-4c40-b4a7-acde8e505e20" ,
"indicator--8182373a-9d26-4be4-a029-209b05806b3e" ,
"indicator--67c2f5e9-cb76-4e8a-b758-f5b944e1cebf" ,
"indicator--4c53521f-ba6a-4919-a7f5-1a486177bce3" ,
"indicator--110ba31a-bcfb-4b6d-b365-3bea15e6bc6f" ,
"indicator--28b4a43e-ed8b-435a-9e3b-d7fb6b69ebd7" ,
"indicator--7d7df2f7-091a-44b2-a91b-4ea03d806a22" ,
"indicator--a770c83e-0eb5-4442-aa3a-19a38f0f94ad" ,
"indicator--468c9831-66c2-465b-8e97-aa2cfae5ca25" ,
"observed-data--cb2ad8d2-4513-4824-98af-2417ede9f9be" ,
"file--538fd0cb-d095-5a45-b311-c04ce8e7791d" ,
"observed-data--c234d4d9-40e1-48a7-ba2c-0b5f007a4663" ,
"file--faa06b9c-cf5c-5f94-b066-1c11d658258d" ,
"observed-data--f41bb4be-9919-43b6-9196-0840d368ee1a" ,
"file--bd5e4742-0223-5297-adc9-5a0d18aa448f" ,
"observed-data--64bed6a7-3297-4789-ac29-49c73b493235" ,
"file--127e79c1-76d1-5672-9412-d0edd90b1d99" ,
"observed-data--73fe839d-d8b3-4b19-8df5-e075319f39cf" ,
"file--fd2177a1-9176-5869-b199-9f8baca59774" ,
"observed-data--14cbcece-f046-4ffc-9558-8a1bbc704211" ,
"file--bd5e4742-0223-5297-adc9-5a0d18aa448f" ,
"observed-data--2c0b5972-cd00-4f8a-9e8a-cb31b9914593" ,
"file--5078cef2-64fb-5b7c-9194-3566536e6c00" ,
"observed-data--8d7a063c-54d3-492a-ad81-5352128577a7" ,
"file--016b55ea-6462-51ba-b868-932818db01f4" ,
"observed-data--83630b45-1bf6-46fc-b17d-3a4c69127899" ,
"file--2ba7efeb-43ba-58ec-b9fe-76bf8c92b957" ,
"observed-data--2a138470-fe21-460e-835d-0fc839b2a9a3" ,
"file--127e79c1-76d1-5672-9412-d0edd90b1d99" ,
"observed-data--adca75b8-b784-410d-abd9-4b589bccf3df" ,
"file--3366f255-2a49-5470-b397-6e35dc413a51" ,
"observed-data--3d608d86-3642-4eaf-93b5-f9a2e464d0e3" ,
"file--bd301ee5-60e6-556b-94ca-84510d7bc8ba" ,
"observed-data--a9ef8fca-738e-436c-8664-130419d87650" ,
"file--b65af11e-0995-5704-9392-cb52403d5c2a" ,
"observed-data--4badc42f-32ae-464d-bb86-d335c70e8821" ,
"file--ed52a7d9-24c3-502d-b4c6-7d2e1c286a03" ,
"observed-data--03846d30-1141-4004-9f4c-cce033977a00" ,
"file--03698891-97a7-569b-a302-85a2ec308d63" ,
"observed-data--fb4648ae-f09b-444c-b713-50e55353621d" ,
"file--83b1eee8-a95a-5ae1-bfff-9b6adeb014cd" ,
"observed-data--eeb9a762-1710-454d-8d57-178ab5e76839" ,
"file--3f6d7cb4-fe61-5056-af6f-ded4af854c8e" ,
"x-misp-object--6321c3b7-2f5c-42bc-9678-3404093fcc86" ,
"x-misp-object--e382fa8a-ec6b-42f2-9aa9-d0c67d3ce31c" ,
"x-misp-object--a5122353-0bad-4b08-9755-48619da51f61" ,
"x-misp-object--d20843ec-7a04-401b-909e-c26ebca453c2" ,
"x-misp-object--c3389c56-14a2-49ff-a14e-a9cf391c07ef" ,
"x-misp-object--67ee881e-d39f-42fb-a99d-5c55ca19a6bf" ,
"x-misp-object--47b82d50-d85e-48c2-a3c9-3d34d0f9dcdb" ,
"x-misp-object--5bcc2973-c2ab-4e94-9fa6-c7e7ec195fae" ,
"x-misp-object--69b9552b-6d64-4b76-a0a9-dc0f90cd6bb8" ,
"x-misp-object--2332dcdc-e184-4d02-8df1-e00055e7c435" ,
"x-misp-object--fa1b96f7-95f4-41a7-8282-d51ea35a003a" ,
"x-misp-object--d40bd6a2-0eb5-4796-b699-dffc2be4b431" ,
"x-misp-object--d7bf8eb3-19e9-4aad-92b8-3a95c884e22d" ,
"x-misp-object--c41067d8-f1e0-4a79-b653-b1de3a333983" ,
"x-misp-object--d54701ff-0998-4d1d-a226-52968b38688e" ,
"x-misp-object--5460049c-12dc-4c6b-ad1b-574ee6e27b46" ,
"x-misp-object--8ac5b696-de49-428d-8edc-8ac677efef52" ,
"x-misp-object--8688dd97-17cc-426c-99a8-663fb002ae49" ,
"x-misp-object--0e9b987d-c99f-483c-9bf8-40d0adb31ba7" ,
"x-misp-object--e92bb5ad-f7e0-4f31-a7a2-8091fa441d02" ,
"x-misp-object--ae6ea4c4-1136-41b1-a103-b760a5d6b949" ,
"x-misp-object--98c6cb34-b6c8-46d0-a6ff-c5c01732510a" ,
"x-misp-object--86fb9914-7d7b-4236-9abd-9d102ce95d08" ,
"x-misp-object--bc94cea5-59b0-49c6-b478-db6deb6213ee" ,
"x-misp-object--244e9eec-ff34-4fd9-9899-5259e99af7f1" ,
"x-misp-object--c4f4dbf3-50b0-40bf-b658-9775ffec4b0d" ,
"x-misp-object--d09fb46e-5fa5-49a2-86dd-f3d8d1804c8b" ,
"x-misp-object--e6358f45-c3fa-44be-ab85-eb8ae2b92b26" ,
"x-misp-object--94756020-94fb-42da-ac3c-9307d2670cc4" ,
"x-misp-object--e85cde67-3817-48d8-b6ed-a1415aec0e57" ,
"x-misp-object--07a39763-3d47-44d3-bf12-fec30f348026" ,
"x-misp-object--1fa704f1-5526-4c00-98ad-970a36b2b688" ,
"x-misp-object--bdfcfd96-ec37-44e2-b012-6729b188db11" ,
"x-misp-object--5a0ff8c4-9323-474c-8f79-6f56e78b57fc" ,
"x-misp-object--a13b139c-8971-44c6-bd15-771d74eef813" ,
"x-misp-object--0c46da1e-551f-4952-b183-0bf6281bae5d" ,
"x-misp-object--c13b7e6b-312e-4ad8-bfcb-0ca5d14c40c4" ,
"x-misp-object--9f405895-ce3c-457d-93a3-572d4c91dff4" ,
"x-misp-object--763f4304-eed1-4c21-956f-2cbcc23e338d" ,
"x-misp-object--695b2e91-223f-48cf-abda-0b224cd0dbe0" ,
"x-misp-object--63384292-3560-4fa2-8a58-2c7f60f64260" ,
"x-misp-object--11687ce6-7ff4-4aab-a60b-39ae2517d112" ,
"x-misp-object--3b50a303-b6bc-455d-bf36-3ebd14302773" ,
"x-misp-object--7e34aa06-bdea-47f4-8831-8df457b51504" ,
"x-misp-object--a7655859-ee97-4f41-b84e-2e1fcb0205b2" ,
"x-misp-object--304b08a9-d17b-41b7-803f-9c572aac0bd3" ,
"x-misp-object--2d0875b8-37f8-4c74-a96c-0bab0a77af8b" ,
"x-misp-object--62f7447c-fc39-4d03-8172-ec14eaa04460" ,
"x-misp-object--04314631-c3a6-48e8-bb9b-6d5bd11dabc0" ,
"x-misp-object--70c9a0a2-55e7-4801-a1eb-38428b7753d0" ,
"x-misp-object--d7b4fe9a-b4f7-47fc-980f-a832d5436af0" ,
"x-misp-object--1567f95b-65c3-4730-bc4d-93bc73d5892d" ,
"x-misp-object--020e7d50-df08-4474-ae41-7f5120f0e7de" ,
"x-misp-object--5762f80a-2219-4fa7-b847-5d16c739f152" ,
"x-misp-object--3573f36a-2d32-42d2-bf5f-2d91a580510e" ,
"x-misp-object--eee305b5-1d33-4751-8438-e4e425dce7cd" ,
"x-misp-object--81b3754b-947e-4508-abe9-c9485907355d" ,
"x-misp-object--5ac0e594-a97e-459e-822e-a5817e4a7164" ,
"x-misp-object--4a858930-96b7-495e-9d9c-70ead6e7652c" ,
"x-misp-object--ac495c0b-7c85-42b5-af1c-5448b40f5987" ,
"x-misp-object--df11c33f-30d2-4c05-b727-bd223e59296e"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"malware_classification:malware-category=\"Rootkit\"" ,
"type:OSINT" ,
"osint:lifetime=\"perpetual\"" ,
"osint:certainty=\"50\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--f37dea30-31e2-433b-a5a7-496bbc29ac07" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:18:51.000Z" ,
"modified" : "2021-06-19T07:18:51.000Z" ,
"first_observed" : "2021-06-19T07:18:51Z" ,
"last_observed" : "2021-06-19T07:18:51Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--f37dea30-31e2-433b-a5a7-496bbc29ac07"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
2023-04-21 13:25:09 +00:00
"type" : "url" ,
2023-06-14 17:31:25 +00:00
"spec_version" : "2.1" ,
"id" : "url--f37dea30-31e2-433b-a5a7-496bbc29ac07" ,
"value" : "https://docs.google.com/spreadsheets/d/1FYgBmJH8MOli99oIqRsIHJA2XzI3aSdAOb9mZmqj_q0/edit#gid=1028909258"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--01758ee5-c2dc-4efd-be6e-047cfaadbb8a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:19:59.000Z" ,
"modified" : "2021-06-19T07:19:59.000Z" ,
"first_observed" : "2021-06-19T07:19:59Z" ,
"last_observed" : "2021-06-19T07:19:59Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--01758ee5-c2dc-4efd-be6e-047cfaadbb8a"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--01758ee5-c2dc-4efd-be6e-047cfaadbb8a" ,
"value" : "https://twitter.com/struppigel/status/1405483373280235520"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ed183e3e-ac50-4ba7-b340-b7cef8292189" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:47.000Z" ,
"modified" : "2021-06-19T07:15:47.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' a 57e4 e 3 a 3 f a 46 b b d b c 9 d 803283 a f 3479 ' A N D f i l e : h a s h e s . S H A 1 = ' 4 e d e 7 f 0 18 c 317 d d c 6 a 5 f 8 f 935 f 917621668 c b 1 e c ' A N D f i l e : h a s h e s . S H A 256 = ' f 83 c 357106 a 7 d 1 d 0 55 b 5 c b 75 c 8414 a a 3219354 d e b 16 a e 9 e e 7 e f e 8 e e 4 c 8 c 670 c a ' A N D f i l e : h a s h e s . S H A 512 = ' 96 d 6 a f 8643 d f f e 45 a 35 c 367 b 4 e e d 292 d f f e 0 a d 6 c c e 9 d a 197 c 547 d 856 a b 6e77 b 4 b 8 f 85 b d 3375 c 7 d 21194599 a 47 d 956 b 7 c 5 f 448 e a 148 d d 47 e f a d 854 f 0 f e 0 f e f a 27 ' A N D f i l e : h a s h e s . S S D E E P = ' 768 : y 1 Z q C Q K y 8 I Y d f W i U e l R 36 i h R 6 n m R Y s 5 Z j S y r N i 7 f b : y N y q + 4 l R X 6 I H 5 v i 7 T ' A N D f i l e : n a m e = ' f 83 c 357106 a 7 d 1 d 0 55 b 5 c b 75 c 8414 a a 3219354 d e b 16 a e 9 e e 7 e f e 8 e e 4 c 8 c 670 c a ' A N D f i l e : s i z e = ' 57232 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P g 501 L C d Q Z x 8 m Y A A J D f A A A g A B w A Y T U 3 Z T R l M 2 E z Z m E 0 N m J i Z G J j O W Q 4 M D M y O D N h Z j M 0 N z l V V A k A A 6 O Z z W C j m c 1 g d X g L A A E E I Q A A A A Q h A A A A O Z 0 V H s T u S F U 8 u q 8 R c Q f V U T Y K V o h 4 c e T 4 W I I b G D m v N T j 8 / M P 2 / T X d q o O R j G X m b L k V m 74 T 5 i 0 61 f R Z 0 Y / j V U 1 S l 3 u W R N W A F G S e Z q q f p 8 Q 0 s u w A M H Z 4 A q A i x V P 3 q S M V I W k N a t 3 P + f n m S a 9 T g 2 y g O 2 X P p 1 a Y 0e45 Y S c / t c P x L R f a s N Y u w L s u k 0 791 f N r 4 I V q M X P P 2 g B i U A D 7 N t / y c z V 2 w X q I w E u O h 81 W w S s T P J g H I w x 9 g G c C D h E C 4 X a k 1 q + D A M 9 t n t m S V s W + k L z 7 y P h 0 R D t X F / q J f v G T U h B D G U p i D Y 3 b o d o q z C a O 9 m l y h Y I I k X o 8 j 93 H N n L L s A c 4 Q 3 t P b p Z A 9 F 8 O K v 6 a S 4 G S Q 1 Q e q / n u 4 R j p 0 b N X a 5 O x l p g U e / G m b h Y p l K F 7 j 30 r 3 T o + n e V k C t d 6 K q J 2 y B C 7 B y F 8 D x q h v q O b y W p n 7 C U s 5E7 Z t 9 z c C i 0 u L F 7 i y a + c g v b 5 x q U x w x / Q i s E U 5 d / D h G 3 A F Z F T m b E V H c d u T K F v u y e 1 k X o i I T l 80 m H Q 4 c i R 70 G s d R l q 5 R M n 6 L 1 t g h i s s M 0 L Z Z u R g Y Y R 0 l d 9 S b a Z X h P F c C M D C s c P N 0 n 0 0 6 o z 67 l f 4 G b W F N o M 5 h Q d E t x u f / I o c Y u E I M 2 f t S b 9 G F U z h G r x q C T 0 G o t M Y L C D h 9 q 1 K b Y t S C u Q K v W i H K p o P p Z M O P w H a + v y K i X 0 C G M a K e o 2 K k S c c n P M D U 8 L G 6 K D L y Y h V Q v i / a u 8 g D h Q S H g f s g 2 o i n S J g 9 N j b v c Y h d 7 S a N 2 C l q B y E k h 95 F + v L F i a 8 e S + / Z w L d e J S 4 I l E / J s 6 M h s g M m P b y d O P m o b w A y 2 A F p q y W X k F X q x m J G M t H Y 1 m r o 3 E l R 1 e z 3 P M w + W x S J x e s u 8 L M D X G c z j + 2 U G F m w w W P 7 D P 1 b K K O i H J o X 7 e J F x B M W u c U v p O W K / 1 c n d Z / P N 16 D + W + D V 3 R N T G m g H D 4 Z j R e w Q W K 63 f f b + l G J d C 4 j M O F a b R / + y X 2 b 52 s z 3 P k z h o v z D 5 d g X 4 E D l / F p b k g U v a m i B 4 i d A 70 + d z T Y o s q 1 / S n 4 M H t 3 E x C D q z m b y h G 8 a d G B b S y D B E 2 v W P B v 0 k g s I n i b l N K j j q J q G c U A N J H l a U u o Z Z M D n 61 V u n s 4 L Z j f V y K N 9 q 1 S E H 6 y 3 b W H u h S X c z P V n Z 2 V m J x T H m 3 H j V e j T D 0 E J E B R R y 8 I N I 9 c q k h w G / k E P + V Q x E n p N 7 Z q H 504 a G o X u 3 t 0 M 8 q u p o k 54 y 4 i m w 74 z 4 + L z 0 T 9 Z l D k 8 V F U b m 4 G b F f d g 6 C V X W M l n T b t F X G 6 q 5 T r t 9 N C d 31 R 5 g 9 J w N T 1 c u 6 e k D 3 x R b e Y 5 i e z i 5 + B Z v n b 8 y N t 4 m L A C j c H h 4 N 9 O l d J 4 z p X Y u L t y V d Z g A a V j w B t W i l 7 / b G U R N q M r a U I V v G Z b J s S r p M c K y J V T W K b j W 9 d 108 m O C h c W H X w 8 X x m a V P G n F D K V Y 578 B e g C W + b B j b S S 2 l F V p D q / P A z R c 57 M h C E 7 N U 0 J y l s 3 W 3 l + h V 4 W 2 H m 0 a L Z A K F C K k a 8 q S 7 q 2 o G g K R + E G Z / o e e o L m j b w x X b E v 7 f L M e / P t o r 2 S n b Y f k Q Z + b V e M W F g 5 s f 358 s d J o B u M h 9 x t G P l a b 0 E I z L x O v e V G i b T b M 2 a d 55 K t b u B u 4 Q u h g c j c b R d y 5 L 6 H f L o P w 0 J i o F u v J f X T h F d T e k H S 8 o E p a I T O E C T o a G S S 3 v 9 G / b K d D q j m D N B 71 E V G j k m B C w W M 7 i O V P 8 / L v U u o d D Q G 9 Q p z f g x U m P B I e g q b Y d Q b 5 H j l j Z D + X l y / + F y 2 G k U v B R B V 68 x m 9 B 4 b N E d V o 30 S w x C D n x n C e a O 1 K / z q d / Z w T H W H S o A A y U k T G j s G N r s y M n 5 A t q 3 O O d A y P t O U J d 8 a O O Z k 4 T 34 M Q u o 9 Z k P p q O s Q 9 O C f q 0 B / l l O I N A B v y r 4 b b e c 7 U i e l v y 9 t Z O j b u l N 58 p r v S m 3 h e f c w f Q u C Q t 0 E J c a r L w l 3 M f j S n K I e 2 J B S q h J t R D 5 o k 0 / l 3 X U z i x e / i N d 8 e r x 698 f e j 1 t d h a M l R p l 0 b q M 5 N Z w 9 t F C s q a a O I o c O y b I 8 K Z v r 1 U g h L s e L N 6 / F k / d 1 n 3 a D v 0 a L X 4 G T C 9 F r 2 a 1 I Q 7 Z 8 P y K I 73 x 1 x I 5 s M k 2 f j S 1 w E I T u J v k + r + S W 2 W D B Q I 4 f l h v R 4 U V K E g C 65 t r l m g c x J R 0 72 o O i D j 0 h p Y 9 H M C 7 d U 15 e g D a D 6 z N W O J / g U H v G 0 L e z p + 0 Z d s 89 T t G H i v u b K 0 2 V E I Y N C E P s a B w f f w 5 m S H u O r 1 C G 4 L V S l T V 4 f B e j A y / A l 823 P B Y A i m i K l s w y 2 R q q e q e f U G W 8 H H R R 0 7 X 6 m B L N t K Y J V F B X S H n L d E F R 3 m w d u q A o K N 8 i h 7 I x / s v u 0 N Q s E 7 p I P Z c 6 F U z k 7 w U U y g //dT4QvKBfwrUPJM+iwTS9GJvhzH857DMAsjdeiyeNhja2FkPKYhMRKSpf+m49FfSAJT452RUxXpi/MuHKxNvyS1d29lDPZzxLX1mscmA1xHVjIho/ojKMTG/y99mBmb1VPgdyAUUucoeng8jB4lJ8Jcq3ocrIme7hquUK4VnziI89uk0hbuHC2ZEr1mXpQGBDvU105cubjSO6Oi4ICrpqZoIPMsx3Yx4X9ArK1AmJ1OR8d52l9O/d+P0A3cmgA7Nk+fqeaDXBlz74B6Aa8sFharCC8sR5oIwHV7AcVXEw6OjZaTW6DUdrHWyBRx0uZnGigXJO2XIKmw1ElExw/JfCpNtysY2Ac0Np9xRCRe3fqPehX1PZoRDSgxzBaj9HXQl3Et0Q7q4KQs2VvM6xGjhNhZy9RKu4l0vQiEaHadYVWV4r3NMSUa2uejMntJHW9u+p2Im4Mz+cYiR7DnGen+yWYZe/6OYHXTVaU85XigUgxPUoBR/AMvSpamYyi4M852m7HqMCTkXXvE6wHk3iQv+q0fEJhqbLcNov4F5w5Xp2ecKoNmgMwgSQ6RnjjfsHdDbYKUIye/wfYoq8N+qpVfzqvYKYKht/yvunKjRpgcbZEFQX58b1NKiITx/JFvs0HuGC1ZK4U0lXSu3r5NiTmj6OxbBjdH/ZL/1yjclOVYzhTOcum2gpMUXTdOMn+Cm/jgCKOwvAUBSLrMsBhTkGLTVRsqIqdktPMjCLOF21oSDtb/j03v9SHXed/KUro1qbhk9awBlM8K9ZwfVpDgNeD8tg/++2p6jCUMNrlmHXFnHYyV9oPhAYz57ySrq+KZ3VjQiQnmLlXSw+vSlLxBx8HZJ926Gr9NKl/J8xyokOf0CTQmVaQ0VLI17do4yyHja28X9o4y5dPROb+k5PPf8ZrMHf/0nGud0fwm+/AOg5Zi6+ryVna4BBg6RbqQO8ZygEWZK7q49HAZui+YpM/9QJJF8jpPURuAjXHeu51OiiL6+4FBXxhofbrkL3zZ6gIJu6YQghJnKmlDXl5xd8awmy9qDMC8znOnd4m1Jc33J7KADqg5voMN9zohcVtolfUqxldKGDi1kIHCU4RFYK09q2lIIzjterEmBcIvIorM7se+nI
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:47Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--08c1c0b9-3f26-44b5-9181-1bbb71a9b921" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:49.000Z" ,
"modified" : "2021-06-19T07:15:49.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c b 34374 f 1 b 5 f b 771076872 c 6 b 14 b 7501 ' A N D f i l e : h a s h e s . S H A 1 = ' 118 f 688 c 30 a 2 f 6 c 2 d 1 f e b 955 f 53 c e 4 a c f 3086 b 3 b ' A N D f i l e : h a s h e s . S H A 256 = ' e 0 a f b 8 b 937 a 5907 f b e 55 a 1 d 1 c c 7574e9304007 e f 33 f a 80 f f 3896e997 a 1 b e a f 37 ' A N D f i l e : h a s h e s . S H A 512 = ' 6 d 853 b 6 a 191 c 6277e54 f 661 a e 50 f a 7421e8 d d 8 d 9 c 7 b 55 b 928 a a a 320 c c 61 b a e d 57 b 3 d 8 d 9 d 728 d c 9e3 b 0 96 b 0 4 a 3 d e 3 f 9e7914 d 8 b 0 4 a 30 d c 2 c 956 b 3 d 65 b 981 a 0 8 e a ' A N D f i l e : h a s h e s . S S D E E P = ' 768 : 8 W e t Q R P O Q a n i q k p Y 0 O 5 w 8 d B x m T 9 y W U 3 j S P y y i h N f V A R b p n : 8 W X O Q w i 6 w E B x m T S p 3 E p n ' A N D f i l e : n a m e = ' e 0 a f b 8 b 937 a 5907 f b e 55 a 1 d 1 c c 7574e9304007 e f 33 f a 80 f f 3896e997 a 1 b e a f 37 ' A N D f i l e : s i z e = ' 50592 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P g 501 I w A B a t Y V s A A K D F A A A g A B w A Y 2 I z N D M 3 N G Y x Y j V m Y j c 3 M T A 3 N j g 3 M m M 2 Y j E 0 Y j c 1 M D F V V A k A A 6 S Z z W C k m c 1 g d X g L A A E E I Q A A A A Q h A A A A y 2 r L J j S h T c O N k x + 0 B e k 2 D r K j G R G d Y i 3 Y O d w I S P u Z 0 / F / 6 + a N w s W W J 0 R M P H d h + m s s M f N a 69 D O u z C + t 2 V S L l x G Z f x R N X E T A u u V a T E M k r 0 Y j G Z W I a 0 r o r K c b a e 69 p a m a b A I k u P R 0 30 p N t 4 W k F z W z r W / v H 3 + m 8 e u 0 n 3 I t L m w 4 E c s 0 V 1 C 0 T 2 r t 2 r X z o C e N w H U i 1 B n X 6 n q B Q l l 3 d Y j I X Z r P D X Y K V A b Q k Z 9 K e 78 V a 3 Z M A o L s E K Y E D g a q S Q s v l z i D S + C y u U 9 + y A o b t a b 0 C c 80 l B w Q c M 0 8 f 1 F T x g F Z Q n c 6 P W T Y U T D b B a F J 6 + z k 9 F e E 8 u l v E B N 3 V x U z Z 3 G + c J Z l Z f x O k A b x v Y H n r O A A F 5 p J J z A e T A F 41 n j i b 1 m S o e X 8 i f g P P N B S Z 5 J K a U Z K j e 2 y S s H I K x Z 61 J D e a P x H i W T N e 8 q l L p l A L j w l w R X Z a 5 L i l 61 i 0 x w j M i C d l X 5 m f 4 Y 0 F j 8 k C + k h n v 9 u I 0 i u t R w n G Y K 3 l o i J 0 R / 0 1 j d N C F d k f V b e 3 E n N r x t E v U I 3 v 1 q Z L W N q Z B y O 0 N B 8 W S A w 8 k s w V v k m r L S x N F H j i P q m V G j s V m V Y u b p R N s E 0 X E s P 122 J t Z d M 5 C I B Q H n a t E U 8 q o S 3 I l O A 5 u F W 19 Z Q Z D 5 + 37 f L K F v A v s k / z E Z b s S e D z O O i v s U i u O l d X z v e T M h R r 1 v q r v Q Y w X K 5 h + T d T e T g 7 V W W 4 K x i o 5 + X c E q N P W G v 0 p e b t w K p g e q M J P 8 G E Y r a Q d g 0 o m 5 m + Z O n X m 9 e H d p i / c E p c h q 5 M e M l d o h G A d 9 c n b v c G p f O w U 1 j C Q a D 4 y m 6 Z l J 3 h x T i R j 3 K j 7 s f A a 4 Y 3 n I N k M P y 81 Q l i x C G E Z q v r L X O Q j N B n 67 k 9 H n i I r I 6 h J V X M 8 S K 8 L u c X R d M J i F D E 3 W E n Y F F m B Y J 0 N 7 u c B H D Z O w B B V p q C 2 D s d 6 Z E + f j Z G m L l N 7 y L M + 6 A + 2 B W g d u 86 F c Y U c k 61 i 4 K x L L J a 6 K e n C 2 y p o F 3 A c t K A l z h d u e r T t f L H N u r M t 7 K d M N r S D Z V J w r J / G 6 h H 1 l t W w q J 1 R b a 6 X z a A 15 H r 92 N 22 q O m X 8 X / f X 5 A E m b w 543 S G t B J m H s y g O I 61 S K y q X 4 b I 7 A J C u w E j Z R M y s c i o H z 8 h 8 y H 1 z / 3 W H J s 1 y 1 y V M s D J k S C t 19 F h n h + q n 8 q 0 F V k d G P U w 996957 S A o I / w k 29 a D X 6 V 3 N H 0 b 2 t v q w r n X e V m a Q d q 2 p + r L Q l L 8 u m i B W 2 d P K 7 m d r w 28 V M m r W r u a 7 Q D 2 n Q R d l i s r Q 0 p j J c v 1 H M 1 j b i P a W i m 3 u j 31 Q 2 f y Q R q U 1 V x S x b f / e A Z 51 y F O B 6 H W 3 l j E d e T S k Y L H i t U r I X Q s 3 V H A H 5 j v Y f d m g g 9 U V V B w v f N A c s K w 47 c r Q w O B S 6 L z T z p c b S X s d Y 76 A B K H m R r s H n B i 51 e n B Z v C D d L E 25 W d v E r F W 3 N k N F L n q o j O I 8 Z z C b B H 9 f 2 N D n J Q k T e s a 9 + i B i Q y a m V A j i X p U D O S w f F g c f t s p o S U u 2 Z q 1 P H C X h f a r f J H w 2 f A s D b E e B 9 m x 21 g Q M p a L 5 z M F q J 9 q 6 R q V z L X W F T A L z Y B C t V f z d r h p y H A E P H s E F z g a X D y P z 5 G b p 44 / j W D C l f 5 Y n J g b S L o v 7 C T w S v n w t b o M L 4 K / B j b P z 5 L R l b s R D d O 83 f F E T N C H X t U J 1 p 0 D u 7 x c X i 1 v f J 4 x T i y p f 0 p I T 5 v 6 v E e o y F B L s 9 q R 2 q h J 0 6 V z T a e X N C V n w O Z T w Q h B S w 1 I k 9 O 1 Q b 3 j V L w c G i H / n I P A u k w B h f v s m V R f b Y m g Y i k W 6 K b 7 k Z l O Y 5 l n z w 5 q / S Z G Y 230 e k Z J q 0 7 U l u A 13 a B 6 x x 8 y i P s 3 a 7 i W 7 I g v b G C 5 V F G 3 T g I 8 v S E 4 G / Z l b Q M 52 R 7 Q U F r G R P T m Z g z d o V L 1 T v n m K 8 e S 8 a g k B / J h r S F a a B E T 7 i f H 5 D z C p f l K j d B V H P 4 Z u 4 K T G f l v c D z 3 a O C j a g V l U y o 9 K t 9 m t v e g S W Q Y Y S X c Q D R 7 T x L Z 1 X g W j w V a t W J g 8 g t D x E p q a b 53 r g n V g H V Q m P X 8 Z 6 B 5 i d g k 9 J f Q r E z z E O 3 s g B M 0 5 z J 5 S / L Q l u k g 0 N i x i A x i i 2 w 2 F t p 4 u 9 R x b 67 b J h p N H c 5 I a O Q 4 s 48 B G y 2 x 0 y y C A x C p p j v R r 7 q J N 49 t 7 U F Z d G t C o 5 t t y k j t E w i z y t d N f x e V i Q W / s d C V K i j 3 O p G o z m + H J t J O 6 O q r R Y g R 4 W Q w Y U q D P E F q K y W g u Z 4 D i z T N f B k g b d 1 n B a Y K r q X 0 2 L / L Q 88 H R r W P Z Z z v j h H R L a U V J q M 0 z k X j N T 1 B G O J i A G s 53 P t 1 y q r B L u W L 4 F I X D 40 o i h n 10 J X v n C Q M p 3 m / 8 B T T d R h J C B 80 C F U + p E G R / m u Z J 1 + V X C 7 q k I 8 q Q f t n B M W 7 C 3 J 3 c g O Y Z N l 9 t E 0 j I c x A 0 7 / C 56 l Y F G N v 6 r e 5 F q l n b C U f u + 0 r r 8 w 286 R h V Z y G w p 9 T W K Z 8 s 9 G R G H K H h y Q W K c w S v Z B y J 48 t Z I R M 9 V c e 6 x x O 4 O j Q J S i 51 Z v 2 w N S 3 m w m u f X l x T B s 5 H 40 x + i k W p 2 E / U 4 K 8 e X y 191 B A f D H Z Q a R j f L X t 9 E q h p L 1 n J N / R A Z p x m Q i p X R B r Q i L l E w 0 R x u c 6 r Y 8 Q i N b R z C 7 p X z G Q N t s I v C 54 b N a M + w L z k I h X b q k T 4 d G k k m g Z E T 3 I W b V C 0 i C Z / V u 29 b o 7 h I U p V N D r i N Q b k 0 M y O Q r / + v n C 4 c n G 4 t s r w a g E 4 D 6 h R 3 M J x X j w a L j 3 X e S 33 + A 1 p T l o o h 2 q z B x 9 H X l P E b V c X p K Y o M H 0 t 13 t K 8 x n W + 14 f c 8 P a 5 e B P B r v v 9 z H u 6 O l 6 w s 6 z o W S X 3 N 4 p M l S h X M R R p x + C u e f / A i P J v 5 J I q d F 3 / k 47 W k k + u A 9 T B p B q m n I I 0 D R 8 A u 5e1 w n 2 S 80 W 3 m m c Y n 87 U 7 q N q 2 e o k l m W w R r K p Q m R D a o O R F V Q b e Z 8403 s 3 f k k 0 Q W y A b l b Y C 4 o C u j R Q R x j 6 R c b Q T B u 3 W U q 3 o D B 9 S 3 E A w f W 4 i A B 5 o R J t 9 Q I e + U g j R K J c T s O G l 4 d S z O A 4 / + j y 6 s 9 y C 6 w 38 + P u K / e 5 f f d Q b t + c / I r N c K f L X I H g J t x f f G v b z n X u 36 M N D o C 6 y 0 V J 1 f z a 7 K c 4 Y Q x n F S U N 5 c S S 28 o E h t L L V O D 8 T 7 K 9 o w e J W h a 7 b g i 3 G r t + k U n u 6 z v p h q D v d x D s p i C b n / n I x / V p E q L J r P m 5 j 25 o z k W I Z K o N j Q r A I F r V L c P f O F a R 2 T l O V g D W N e t r K l 70 R V d h j x J b 0 w F l e f w Z 1 D N q G 0 / q U O A k 41 F m B 67 S 2 f / N u j q 6 b p v x b a s n Y t A E / K m H 1 l u j + 2 j 5 h 1 U P h K e S 9 W a l i G G X //PNgxRu3NCtUooxRQN2kz3eLGVXP92tLTT3oIIhF/8r99NfeM2yOwAOxl+vyeW0Nabkq+sjb06m4Qf9FPce1z23Nd0ENsYh56PJ3Z9dKA3qv9P4ktkvlZGhEgnbwNTW6xZBE50JMeg9d3guxiKwh0WwcVGaIduUeTD2Rsb+W3VlLUsyG7GDXsV2NZaIgPOYsk/k6c4CJUnJEraodRnCGJSFyeGCWnGbr8nVzoLdUjy4M3x9kc/9b
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--54cced0a-cc7c-41ba-890d-b043db623bab" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:50.000Z" ,
"modified" : "2021-06-19T07:15:50.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 1 c 3 d b 7002523e1 a c d 621 c 90701 c 694 a e ' A N D f i l e : h a s h e s . S H A 1 = ' a e e 0 92 f d 31772 d 33932 a 7 a 0 2 d d 2 d 73 e d e 67 f 7 d b 0 ' A N D f i l e : h a s h e s . S H A 256 = ' d 64 f 906376 f 21677 d 0 585e93 d a e 8 b 36248 f 94 b e 7091 b 0 1 f d 1 d 4381916 a 326 a f e ' A N D f i l e : h a s h e s . S H A 512 = ' e 94 c d 7 f a 788 f a 2 f 828 d d 40 f e 0 96 b 25655 d 7 b 8 f e 9 f d 948 c 5 b 53 f 6 c 30039 c a 0 b 9 c 309 e b f 8619 c 0 d e 6988 e f 5 e f b 4 d b 0 b 0 683 c 9 d d c 63 a d 200 a a 5e88 b 8 f 0 1 a 9294 f 1 b ' A N D f i l e : h a s h e s . S S D E E P = ' 1536 : H L 9 R W X O Q w i 6 w E B x m T S p 3 E p o N y q + 4 l R X 6 I H O S y O V i 77 : r L K O Q w N O T + e F q + 4 l A v O i 7 ' A N D f i l e : n a m e = ' d 64 f 906376 f 21677 d 0 585e93 d a e 8 b 36248 f 94 b e 7091 b 0 1 f d 1 d 4381916 a 326 a f e ' A N D f i l e : s i z e = ' 115712 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P k 501 K v D x / 0 B d A A A A D E A Q A g A B w A M W M z Z G I 3 M D A y N T I z Z T F h Y 2 Q 2 M j F j O T A 3 M D F j N j k 0 Y W V V V A k A A 6 a Z z W C m m c 1 g d X g L A A E E I Q A A A A Q h A A A A D Z J v N F 7 v e R E J W j 0 + 33 d + 3 K F V M I Z I / Z j 1 t j E X G M B u V t w A r O p Q J M V 6 K 60 D R S W H f d x a E 6 Q l X l R K Q H C C 2 b D 2 R o q l 3 s C h 1 d l E t S S h 5 w B q 2 i r W W v x n d h J i x V c w t v + b 7 + + 7 A K 3 y 0 o / e W v o U P 2 s B B v S A n y q J j u o 7 a b f H N j n w 8 d 2 b I w + l Y 55 h 744 B / l j K b D E X G a z a M x C 6 + O N C Y Y M J s q d P a Z q C A S E r b I 0 i d z 4 K 6 x p X c d / E N Y 9 j + 93 B H 54 Q 8 u K M h a u z f F B s o a F c 5 / j 6 H / A W z 5 d P C l Y M h N B 0 Q s s C E l v B L + N j k j B z + N i l 1 U D D g L p b K 2 T E h 5 + p l F 9 H C D H u X 3 k R t j U C 0 z T A C d d q S u v 2 N Z L / 1 V F z s 0 / d I P s S X r T J / a J X B n F t O t + e D y g M n l T p j r f I k T 3 x x E C S E H 4 V Z B G 3 E E l D g P q y d C k V P s 9 I 5 b q h o R 4 + v M A I 6 W r b 4 F o k m U u 5 n s w x b O n Q i T l / a T X c D V Y R 0 k C b B Y G O k g a T V D k v F D 6 M j Y I Q K k l L j D p v q o / o 2 M b s h 7 p B s O l A p I 4 f 3 a A b w I 6 v w l y + 3 P e M 7 m w K A g x 3 k Y I S Z f f a N b b y H Q X 43 F 2 / 9 V Z 7 r o s v O F 0 5 y + w I i J R a K + l L J l E D T 5 R S y 0 P l l l h c 2 q a I M s P y g 554 b F N t f h s d p h x S L p N U h B H D 83 S G 8 A H T v g C U J b 3 O U R s z a / E E 4 Y n g Q m k o H J a I J e 24 i 35 x H l Z F F U V t 4 Y L f S K / G R g c 8 r o W 7 y 9 j I O U 4 Y G G q 0 N n m m q 1 Z u v 9 s y / q N A p A X T S K Z T g T L Y w 4 v B 2 O p b d w Y 8 B P h Z 8 q l b I u a + a + g x E g V G T 9 f i d Q f h F Z M J / s z w 7 o m V y a t l b k y H 9 N J J L X 33 w t 94 D q 3 K N I I K o o V f a i T R g t f Z I U + K P N i q 5 M t B x k H e r r D n b j 63 c F O W B O J x B t X 3 Q y Q H / T a l r x e l q M 0 5 H f G X c e p 3 R y t o 44 d M D k n k i Y g q w I s v 59 r H H s L v 6 P V 6 m Q D o m / a F M z D Z o U m J 34e0 J O g M P v w p s Q G O O 26 d a O c / 51 m 2 / j p X o r H C O z M N P z 8 n f k v L B l w c 6 o C d a 91 K e F t 7 c + g e V E H p M r 78 A Y v 9 W 0 I P a E 9 F m Y P X 4 h A x v Q V l j + / T E N U B s 1 Y y P L N u B F j A 2 n W y J l 2 I K B H Z f A M G f s l T w w B b D w M R E 2 g 7 j h l m / T W j E m X / s g f X p N 6 e D T S 1 V q 3 z 5 e g i n e k 8 R x l C B W O 6 T l Z l 6 H / N g f P g D n o G w L M I e c v 6 U q T o j 2 p 5 M H l D 1 v q v 0 P a x e B 2 j O O g r E I F m u L t L I 3 K u Y K k M S G 9 O g t S K 0 s o H Q i c j 4 K g l + D K E T e Y g 6 M L u x 4 b O f Y q s s A 4 H u q v 82 I w K l n 4 c z 8 f C S G m K D Q 74 K M F n R v m M A p J e m V f 3 B 1 s R A Z 2 Z K A v 0 529 L S X 7 N T / r c L W T O + l v 2 Q D 5 d v e 0e1 J s Z i m y 7 Y J z B 5 R M d L p w 3 d 3 x + u Q P m x C X d v N l I i Y o i z x s T y d U a 57 t U 8 I m c / r V w I R g e z w R 33 a G P n Y w T j l B N N Y I 7 K 5 i a Y D U T j 1 u 3 x Q g b g O 6 B i w D P Y C 7 y 87 U Q 0 M S 7 S U 3 S Y k 7 E T I + T r E J 2 R f K Q Q W k e j y T h D H 9 a m h U m g Q Y 9 w Y O h q w j G j L Y j t z y Q V 6 c k n n d G + r d I C R L F z X S 9 u t f J C y 7 V 0 E c w d 4 Z U r H c q s f g w K g H j P g I 2 n y W R //1AkkM9+LkcuKHOrcHcIqrSa+5bbia9JvUM52hHCvEd/yT8YrhifNvSFmRUFyOP0K0csozF0bvR1/Vc8RBdRq9Enzun5MXHFtFmpgMm1DMqMMRcHCJcMEvyfPTyTYfDdu3rK/0SI+Ba4mzA9A38Vc0JqKLjKhshIiM0VnaKfHE0n/wVtK3h0T0of1iMTnHGy+03vJ7mbV0OOzP/XMNQbAkMBbWVX9sjOtkjQsVfmXogjVvDnyEe+8SUO99pNi1rSZSIuZY1bKvFI9+JmpneBjUiOI/5vUxHu4YJiF+vKBFvGobworAh4f8osDRzZ0huvcBGGmUXM1Pyl6ngGUDqZzIhc3LO3d0Qqcyy8iVKClY26CJVwLW2/NPxQwj+Gukdad4uLR0UJFoudhjYILXtLf6NdK5rDuk4L7E3jtaY4uvev78pIb0OlYmtqhDLmUAlQspZqRG+S5XH8WoRaxQ97rxyMsux6y02F+N3Nepp70ruDBXLSbDb5lYE51N/d6iOxGuXUJY2adLlSpH9m0oUhYqsC820hoWlk32Kna50bZVZkb6Gg6fHn83kU9h9BVPmm9BUxeIjjcKpriCpjC61Y+Rz9SwyBOoBqQxtSMH966A3fnUbJ6DrpFEZsCj5ciglTYOO/aGV/I5XXpLho+YRUlLMeZjJUU79oJTW0INfuRMj+Z6D2JrK1TOMb8plKNqVtgkp8AE5/TAhyBzrJ1Ayi27IcaC3f19sM1OYaGwgt7Z6Ga4SFANjVj2+EEGlPw+Y3ApqNUVjwsUPhmPWgYW8MaR31+hwNW1U9blrBB8KlJSSxZtMsMQID+dTHzzP6M93Se9JgSpxepxWdRqqJ13eHuz2psoICFp56FmkE22bY8B8x5Si+LR1uUCawWY2MZQSIenn0MbPT5PcsAE06Le1Z6eCheqHllB9E8vFJllvWyMZczYyjVEySdDEmj/LBdgfM2tneHRWAGZy5Px4gQsjVgNjOEIEHwDFFEj1VBie2N8iBAHhebMnx6GlJvRPVe4/lnAz5LWAAYijpCR6lA/8STPC1lkMzA84I8z4IDjpOCmgUMeQl8dhCyYLv8m7ZIg9jnTodr22Eip/sv4AALmAqtECa/JnXx/Pwpc71pIdnWz3hntIev52X6A5d87OmPy4kRXom9AzpWbyI/NATEAQcGOzfFy0kuOCRXktdAjKZeB1WlhjlXbcMsdvYZt0u/wNHBJTF4/F2y4xFfCe9Lf/6iTxmV9kB74QU+tDECoPv1uQo2DkGb4nBIefCS4IbTypI4RnH9Z4ySekkDxbtLrtiXBqIenZ6BF43gzc+iY62eMZkHA2MIXtpqZKCjzBFp5BophDVEX1Rg0MmyIHOsZXjyogF+/oqu8Yr3hGzhPkFr921qPIpSgrlaISOIdrMp1EzH52BviAZWAAIOb7yTy6jWPG9Ex7DSOyEcjBZNA+jUTrPihUO3ctVhiEyJNFVLqs1U0h1S9hyWJqs9WeAAfid/XvWcdP7vEvG0nHfC2qxDtMvtvTFQJMVu14TKrN5FWhSXpUhtR3UxwvNGDFiCm+hLtrzfnNu0BsQOz4JarsELhGB0ukeOaJLI1QOxnh1Jnvaps4hrSoBDaZG3RL8Ms8dZM6gCJpffqJmPyLR5A8sfVahSRzBn/EQj7nDJLCrKH9a9W65FSaJGl/qunpqp1L+BWayc/lP6tFXSepsLZATD2DoMJ27zwcTxCsWpekAdoamzBZ1XSkKaS8OGqEKzArDUXliAL9P4ngzyB14KmDIx6GIKC/KLQdnJzUx
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--da79e5e2-3944-4de3-84c3-5a59a16fb3fd" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:51.000Z" ,
"modified" : "2021-06-19T07:15:51.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' d a 6 b 25206 a 29 c 8 a c 9 a 8 c b b 4 b e 5 d 3875 c ' A N D f i l e : h a s h e s . S H A 1 = ' 0e23 c d 5 f 100 a 0 35 b d 5 a d 521 a 6 a d 40454 f d a 0 84 c 7 ' A N D f i l e : h a s h e s . S H A 256 = ' d 0 a 0 3 a 8905 c 4 f 695843 b c 4e9 f 2 d d 0 62 b 8 f d 7 b 0 b 0 0 103236 b 5187 f f 3730750540 ' A N D f i l e : h a s h e s . S H A 512 = ' 22 d a 1 f 71 f 92 a e 3 e c d 81 b d b f f a 81 f 1 d 44 c 4 d 1 b 0 6 c 4533 d 293 c 0 2 b d 159 a 68539015 a 162 f 2 b 1 a 835142 d 0 6 b f 5 f 6 d 3460 a d a c 39643479 d 93 d 5171701866401 a d 9835 ' A N D f i l e : h a s h e s . S S D E E P = ' 384 : r x N t / I u 30 i 3 X 2 G j T J m l g l w P 74 b 14 g H R N 7 a W 0 R 1 l n N f q : r x L I u 3 G I g l N P 749 I l f q ' A N D f i l e : n a m e = ' d 0 a 0 3 a 8905 c 4 f 695843 b c 4e9 f 2 d d 0 62 b 8 f d 7 b 0 b 0 0 103236 b 5187 f f 3730750540 ' A N D f i l e : s i z e = ' 20864 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P o 501 I u D 2 I L S y w A A I B R A A A g A B w A Z G E 2 Y j I 1 M j A 2 Y T I 5 Y z h h Y z l h O G N i Y j R i Z T V k M z g 3 N W N V V A k A A 6 e Z z W C n m c 1 g d X g L A A E E I Q A A A A Q h A A A A H g j X g / j A b 6 N J s 9 X l D A 4 D a r R 390 + O W / b N b D 51 k u Y C m 10 e a / w a V U 4 r 8 u A E G a V G S 8 c S q 43 V D r S R 2 X E f Z x G a Y + X Y j 6 a b q 0 6 + L r C p c p n f k x o S m U 85 h + c + u 3 p w c S u F Q g z F W m p 5 C 3 o Q r K F 86 w R P 5 s Q 6 v n 45 i B i z t K 5 I g n T J W I 7 P / p f x n O 1 j e B q Y / V g n x y 2 A E g M 2 l 8 K l y R F 8 j W t G u z u i / m l k O o 5 e c x E Z E a x 66 i K t D C G C K A X + 4 M F 5 X y C K n F Y s l a r a l E B 45 R 7 F e f x L y W E 5 J + U i D j o t M N F 8 h K l u n G 2 l V E w S P P 4 a w K D e c V 3 N c J k R + b P n 0 z z d W c A E C U Z O e P s z b B g M + 66 T + Y b k Q G V a B L Y n L U K o F S Y G K r k R y L Z G j X g g I U p p 1 a K z 94 Y w u g i Q q Y w j Q N k o g C x a f T J m v r C t X p l u I m 25 D A S E O B n 9 n 69 l U q t X c r g y M T g 9 + n J i n B G j 60 R Q s i i l X d A 7 c X W Q c R G q S / Y E I 570 T O b u 6 W + x / R G r p Y p n 9 y / 0 x F T y J Z 9 N 6 Q P a u B 0 9 e b A Z n e I I J 5 Y S q 7 P E x + a y k p 9 j B t t S w / I 0 I 8 S Q G D c 2 / Y Q 0 N D N u P C Q 7 L a U 8 Z k d E A 2 T N g 9 U X m Q 2 w Q c 3 p T E i / n m p f w A X / 8 j b E s u U I w W E A 0 u K L A E 9 u Y / e w U C Z 30 V U i l H p q 0 G r F T t j z Q o j x p M T o C 9 v 7 Z 0 S 0 q K z J M / d 6 z I M L l 5 r r d / U w / W o W H y c K j 9 U 6 N W z / B 5 L D / w U H 4 m 6 F V / f a / Q f d j 6 T / j 5 g 1 C K g P B c 6 q G P 7 A G W 4 t 9 J h A A n 0 V / d 5 p a Y w L T r T J 7 E i S M a / 0 z J Q i p T i 13 l C w l e v 0 f f 7 + c M j X d y g Q f k s e 2 h Z x 53 p J 1 t B z p / I Y w K L F f i z q c l N t J S R A f e j 28 O r A Y v f F X B g B B 0 3 L O 0 320 X M x b 8 H A P 1 K g l L L w k f u C 8 v v A r 0 L l D v 6 Y / c E v z F n i 5 g C c 0 p T K M u g p n F l h 3 i M t H x Q g k u V R 5 a D t q Z + 2 Y + d I r P F K h v G 5 a m 9 I E u U N h F z H w d A / 0 k K U l Y a k J y n Z + R a Z E M t 0 K 6 D h n n 4 G D Y N 1 h z y f 4 S g V 3 b e H C I Y m Z q 9 K i / e 96 v b f o H M a c E u 1 b m v d M N r v d B x v C 4 g X 7 r i s f N E m h T X G Z C 16 v c Y h W 1 + 4 T Q / + x 2 Y G w 6 y c t S 8 y / B V 7 h B l T + E v Q s a D x 1 x i b m Z T v e l J 7 I e 4 j 316 n y S e O n 2 P T 0 a v G d 0 1 i 0 / K g i 9 Y l 7 E B X D O C p P O D a i e k e S B h R O / 5 p 8 W N R 4 S i O X b g o 0 q X n m J M + e o d p n f S x E + b S c V U 0 S 8 d 3 N h 9 T a n p T V g h w F J / W 8 M N l 0 5 D F Y 0 w U 6 c G l u M H t Q o J + V Q V u w l i H k Y P p c 6 M X M o 1 l J R q U 7 q L 7 l Y s t v H V z m Y w G V t Y 3 / M q 2 V x A 7 J S 35 V M J t a 6 u F t h E h m K a d y J L U I v u Z K h c n H Y J u N 2 y S 6 y j d 22 V E w 1 N q E E j 0 N f k m 3 g x A i V 2 j i P N 3 z I q p c B / 5 b F G O a M K s I m g A c V j h e E N Q v 8 n A s f r A o J P b Z 0 8 O 3 X 8 c Y R n d O u m y R R d w z 6 P y L 1 o y L S R s X O p 7 o p t m G N D b 71 J L C s c v 8364 t E b 6 B z R W J y p w 8 R t h 1 D G Y 1 i k U t P D R s Q + a A q I Q q j o y G g 6 q v 0 V G a / S Z i o J P n z x 5 m 2 s i n + z m T V w j o B 8 L O 0 O s p 3 a 1 z 1 o V O v F / q L m Y e X t V / v / 8 p q i P j 2 v M q D r C D T B X E v i 31 F o F J 7 / l u R 3 A R T 0 Q p L D f x O y D W W l I D C + j O q L 0 d o B Z j n q w n w 3 G P W l O x P 50 T c d A W U n 9 k x v u W q w G v C e + l 5 D s H 0 F U W 8 P F B 8E6 W O t L D y u r W M w + n 8 O 64 r Q w U T E 47 r W e C U t m F F J s M X c q 3 d w p Z D B D H w T F 93 F r S V y R y Y b 1 Z 3 X I w o u 4 q V K A Q x Y u J P B N F B 4 y T B J t L C q r + K H n m C 2 e Y O p q e 6 E G 3 b i D 2 w D r z 88E7 w r v J 18 W D Y o r B H p E 1 o j y k u H I I W R + 1 F c g D W 9 b 9 u B R 9 t e 40 n t d x P 3 g f w Z F m e m 19 i P 1 t r w 4 j l E S j k V l a k p j V I A a U N Z p l T W S / i 90 m 6 I R E 3 E a N p / p n N Q 4 F 3 z u w M 0 Y 7 a Q G 1 h r B m I D H s E 17 z g J Z P E k b c 32 f x 6 h O c Q m U K L I / p a 8 x t A 3 L I K f S L 2 / h S Y g / w w r 6 / 847 H M X e h g J 5 k Y z 3 Q d i P / 3 t t 19 H L C W o e n G p W O o r C D U u k B L f o 1 O C K Q o K 3 r r L N t c C 4 W 9 K + q U d v g X F C 2 F 21 R F e a k l Z p o 8 K C + L W z e y z B z 2 g J h o Q J P P U Y D A r k W U h 2245 L B o y / F g U U 5 N K f b f 8 h u G 4 v a O w 419 v 6 r m e 0 + 5 S D o U 8 q M w 957 M 9 D m d P G A n g / Q H c e p N L 5 q 6 g D W h q I l q 74 H O 3 L 1 g r N M 4 k 2 C N e K g K z l + A b d E V e X R 1 R y / d / H B j h v f u T 5 F U v Z D B i g o Z l N k 70 s b H V 1 v 1 w I / t Y h x 4 q t R C / 74 l / 34 O / z y z M O i 0 P j l 3 d v Z b l F A c l j X X g C A m s h m e m 0 L i 7 i L j W 2 U V a w e 0 S P M N 8 l O 8e8 U S j W D t W x E / R 8 g H h O k 7 g v h 0 s J 7 n w t 3 F G s t D G v 7 M H / s K v x W S Z G I + e 3 D z 8 s d j z e w l C c C u 3 L T 3 B / t 4 M d / y J d p T + C 7 Y I 4 S P I g 5 R e G p n m m F P R n H k F T Y I c B U E G e X M 3 l p e D d D j 8 F w C P b X S Y o k Y W D 8 M O x h P V 88 H V w F C Z w Q G Y Z D L r y G U P j L d o Q u w b b m J a 9 H / R + M H i T V t v v 4 s q U 0 b / 7 y L e b l / h / B K q k C + E + U O e 8 X W a 5 c 5 + G V M U g 3 V V 9 m Z r O j f l 2 N J u F y e R X m F O n v k 7 t q 4 g U I z t 23 O c s 4 C K J N S k K O B 0 8 Q I u d m C B x 84 Z 4 I V W u X E H w j L 7 U 5 A 40 F 6 u M L p o 74 j h i S I t V 1 o u P H y o D q O + F v x O / a 4 B m k x a M 3 Q 0 H x l y d d 6 X R A b 8 d x t c 2 C v H e + W 6 a / 2 g q 8 d c r K I C a I 49 X P V s z U N F T x E e 2 / A 7 B P u 5e9 Q O V 7 t B E V R 72 d Q D 58 o 6 R U K 6 R d F c 52 J Q D 1 m x c j M / s I 30 S m R 2 c 9 m F X b U h h Q y D b 2 A S f j f o n U Q 5 O d p L o u k U e i b O u G 3 u c / O 0 P 0 Q 5 Z b 7 + N Z z j x T N O F E A G H / M i p x j F S x m i r o + J F O b P s U u K 1 g l n x 6 i D c g T 7 f 5 R X B I n l o K / I f c e X x 6 t s 4 A B B p Q O 4 O V y S y 1 x U h W b e / r B n 5 j 3 i G t E i J 9 b F X I p x Z O g A H h t z J 2 F m L s / L v W p Y 3 k Y x D H j z x 4 r T h J g h h e x n L c 5 d e w D b + g D b e s p F H R I i r t h E E d O I P p M n E F 3 g w h W 4 g 9 C 0 S 97 H 4 U 2 H 1 q O i k w W f V 1 X q W e U T 3 n E o d l 73 W A 0 c A P N e v X J G Z e T 30 c g x 1 O R 7 n T t T 7 i y l s h N t v Z 7 c z u z F w 3 M u 3 Q C d N N X M + 2 o X U z l k 9 k + A k V 1 B M 8 d z T K 6 r o I D h K r E 75 a z x T a X + F y Y S o o t M z D X G Q d K R 0 9 v 8 Q + y K u e c u Z C O q P u H Z I Z c J j A G K B q I c q 4 r E B c r o r a g d h 9 S 1 h B 881 Z U E w C q U 1 z U Q 6 y O I f q 6 l / h q R X z j 3 K b 69 G L 0 M 3 U w n S o p h 1 V r Z r r e V u x S M K o B k 9 j d 6 X X z t v r h T L 8 L 1 f l G 8 Q t h g T j R C + Z 2 L x S i s 77 G N t L / P 38 K U K n r t 8
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e1a1253-df3d-4d7c-aaa2-36db9ed411f1" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:52.000Z" ,
"modified" : "2021-06-19T07:15:52.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 400 c 1 c 6312 f 99e4640077994 b b f a e d d e ' A N D f i l e : h a s h e s . S H A 1 = ' 657 a 875554 b 0 75 e b 7 f 2 d 314 b b b e 967 c 789624 b 30 ' A N D f i l e : h a s h e s . S H A 256 = ' c b 8e536680732 b 474 a 5 c 26970 a c e 2087667622 c a a 3 d d 82 c 1 c 56731 a 7 c 5 a 1 c 8 c e ' A N D f i l e : h a s h e s . S H A 512 = ' 0 0 b 0 5036757e558 c 3 d 210 f 838 d c e 3 c 8 b 2 b 4808655263 c c 1 d 69 b f 21 a 78e93 f 6 a d 52 b 6 a 20 a 4 d 68 a c 0 33 f d f 0 6 e e c c 334690190 f 38e8435 d c 64 f a b 3 d 64 b 7 f c 1 d 5 c 96 ' A N D f i l e : h a s h e s . S S D E E P = ' 3072 : Y 3 J l g g n 749 T g x S G Z x u 7 y b 6 B G C K K M A / 2 p u Q Y d y f 5 z 6 Q m t J V t 7 : U y s 49 k H I y b 4 K K M f p u Q Y G A n t 7 ' A N D f i l e : n a m e = ' c b 8e536680732 b 474 a 5 c 26970 a c e 2087667622 c a a 3 d d 82 c 1 c 56731 a 7 c 5 a 1 c 8 c e ' A N D f i l e : s i z e = ' 117168 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P o 501 I D L 4 i X x A I B A L D J A Q A g A B w A N D A w Y z F j N j M x M m Y 5 O W U 0 N j Q w M D c 3 O T k 0 Y m J m Y W V k Z G V V V A k A A 6 i Z z W C o m c 1 g d X g L A A E E I Q A A A A Q h A A A A C H r l y 9 e a W s 9 S i I k E W 5 v X P V Z L p c W / w h x N J v M F K Y i B l w X 9 R P S 0 f b M 8 H Z d I a 3 t T v Q p 2 n r F V J p c u / z X 1 E k F T O y y Y 2 / 9 C G Y x o q M 8 J a q T b R T 2 w Q O P a W E 314 z e I q 3 o m 1 t V s z 6 v U d t H k 5 b 7 O j o G u n Y q a I z 0 f x Y g g c L Y X 35 F l k + D Y N I r b 2 Q L u s V x v v C 4 c n D f 47 B o k u b 5 S d B 8 c 2 G T V u r z a L B u C J I L c 1 H 3 b x / R Z U j 6 / l z X J b A 3 w 3 R d 3 u b 85 c U Z w / A 5 R C r y H 2 U Q y w A F g 0 B C d 6 I 7 V H q + 8 w g f / M t B 2 r j c f C 7 L Q / 5 V d J K a o 0 Y o r m B r V e K q O V 2 L i P G A p 3 u c I 3 z L a C h b R O i l s m 9 q l H y T s s M C h m A 308 z A P Q F I m g y n 7 d 0 r u 8 Y q p r 0 k V / 4 X p 8 f s o D k a c p U k F m W s K s 7 h j c 6 g 807 z q S k g Y 8 Z z L e U D U N d R O v + F 1 D m 7 v 0 i 9 i s X L z 3 H W e i o B l C N J Y 2 O j b 1 S w C n w r E z c E R + x q 3 X c 8 T e t x 4 Y D m 0 l 8 d + 0 e d g J C T n T w B z o + J 2 N g n K o 5 n v S a H E V / p V B I K 0 W 2 D x e 6 p I P S x f v Z M Z e t b K w O a l F u W K w J 2 J r y 2 R j n 5 G F L o a B u s C C d P a e 4 A 5 m I e / L r A d v e w a E K F J g x M m q Y F W X j V / R j F y W w / a + Y R v m i H D N R p + F i E q s w C C a V D 4 n O a G u + 3 j L i n M u O j U W v M u s / p 99 D e e 29 A X Y 6 O Y r i D 3 p j v e f T 1 O W H + Q W t O 9 v y B 300 R y J 2 c X u 9 s W E U a v T u n X T z 1 y / C I X Y W L n 9 x q t t w 3 v D F I + n y 12 y 8 T z g 2 + 1 v O S V 0 c o D Z x k e I 2 m x q m Z j i o n 8 o z 2 a N C q / T D e l C e R Z P 6 p 3 + 9 H / i R P u Y 8 P r e B 9 Q Y N 34 r A i K 7 m 9 P o 6 A K y j u S N n v 3 o 3 d u 5 o 3 i s r 1 I 6 e t 2 Q o R i j q 4 x e N j J O u w h Q 3 q R u q 0 6 h H D a + 8 U 3 K u 1 j u + p 7 v K S 5 B x 5 c L M w 20 c + g b I 2 u 9 v w / 7 Y S E a P x k x S d u W K n a q R d b + H v D x n y 82 O z f q q l y T u a 92 P L f 0 u f s 4 u H t Z i D v Z g b b e o 6 c w K 2 k C C H a B E g C U u I l S D l 7 h w 3 x m M a o Q 9 c h g I C E i 5 d 0 V 6 j e H e T 18 U D H z 9 S 4 A 5 G / r q G s 5 c E I g j b c G M J 3 U L T B j v n T U S V C N K U y F z 5 N o v d H 8 t O 6 V y p q h 6 Y z Z s 8 O w N h R i P A T H K o j B M h V H y X p V 22 R m J Q 9 Z E s V s q g y B o e G 0 H w F B H B B c v I g J g a c R K k g 83 j D Z E J 3 d U e F t 3 p V h G / q f c o 3 u h w l z t Z k m a 8 c u o D E W s + w z b 98 U l E f e C 7 H m W L V g J i o a a w w U 8 V y d H K J n + W h e U + z z G J c A s n q I 9 s I 6 R c n F Q + N Z p o e f e U J Q k Y j a 7 F 7 L 26 z n e l G T 4 j + 7 p 4 q v p 3 F 9 R C W I R m C t O q p p r N p Y y d 4 l L O c R 53 + k a 1 G W 7 j X q b N L z j 8 G s / I k 10 W T N Q / q r Z H P 46 K d x q R 8 P Z N k u 1 D q q z H 6 s U O 8 + Y x G u q f e z Q V J Y Q R X D f g 3 Y Z s s + b O s l j / 7 V Q y L W E M E D b P U s 0 D X S s 4 X h 8 d h + D h Q X 0 s s t e S r G t r X L Q F 6 T 9 X W q d q Y k u d V O E z N K d 3 l 3 S j i t Q b A l E 7 t e A 3 p x 7 K g H a S Z j G f W A A e G + i G V x u b 0 D P + 8 K i q 2 Z X 1 b x 0 o R M Z a 3 k V f z Y + w H H R v Y p 2 t j K K Q p o i N u D F k v W u I y b L T j + q K K + z 8 u g w 1 p 46 F 8 J e N f E T v T 6 S p v D m l + 3 Y 1 K L z 4 B T + p h j X t v + a D p a N I P w x + 2 e + U L E L n H u x n 4 X J u x e F i W E g x Z o / 11 W G Q N d A U 72 s 2451 f d J + h b J + a A i 6 Y d N R O b Q r F n 77 F A 1 y h U x g W H 253 + D g 5 d j Z g x 79 U X 2 + 3 N E o + D N Y / W w N T z 5 M y F 83 i / J J c L Q V d c H Y J l v T P U g H + O Y c Q x a a P 2 f 6 Q p R C E 0 V / h 6 G / L r a w u N s k F X R P P t s 8 o / 1 o 0 O D H D g 4 i P e B O V n Z J 63 F o z y 4 U n t B K y X o f 6 F Y g M I W F J 2 + b O x v g o f z Z 0 f W A e Y Y o I A X v Z X 4 B G L H c O X Q 8 q 83 U 46 m 3 C e f B m d v A / 3 K x m d I V L N s k s M M r 8 l m G K s b 0 K w f 3 y x N d g p b g U w F a u R N v E F + w M K M w Y 5 X B h j m E / 9 u C + 32 H G 99 Q r c N a o M a 3 B h E j A o y u 1 a v d 8 c P t g 7 D n F 2 N B v T t r y C M m m u / 50 / o Y W K n w Q v 0 H R a 7 F l Q 8 B X X d Z v f Q A m J Q p U w X B q G I 0 o u y 1 o L 9 q y S x T w 80 t N 6 x P p d 2 z F Y w P 22 T N c j r G V c d 8 i Z W h Q 26 h e f s 0 a W n i H 4 O I 6 / w v 5 C i r k z C 7 + P V W r e F r h U S p t g Q y 1 N W s O p L L b t I q 4 E H g c V J 9 y D / m L 8 k 8 K c f X A u m c 3 v C 4 m 2 r Q Q t K f l X i S + 7 j + B U 0 u g 7 h o M r N x h K A z B o D a / V 4 b v f x d + o E u H k F Q K e A 2 H H a n X 9 s c F + 1 x N Y E v i j 6 I b o Y d n F A m L W U h 6 Z N X A M S r n o k E J y a h Y l u 6 a M L S D U g K + C C X E E V K d r m W N c X H C V o h T i Q r 4 I L s f b l 2 F H 1 x Q Z u 6 L I S Z T 4 E z / 8 z 4 c x y y D 3 v h v w K X F i 97 y f 0 Q h M u D d w a M B 4 F m x E I B f U J E p x R K s A R 8 T H m y 7 g S e K W k V p u B s A 6 X 2 C F p / H p 5 b i j 49 m y w Z K s z 93 K 44 y 39 r t P 30 b r q S r 2 I U 4 o 1 A P A p 2 t / d E 1 x M W W 7 a 5 k 6208 q r M B G r c d J M p o V E 3 g z 5 M L y E x k / 3 G w N I k Y i J D 5 d s + h p A E q w 1 p N p P I h 3 k T C C l d 64 E S d 6 F K Z U x N S B g g 5 J Q u R u Z T a + 5 D J 1 v V P S C k 6 N 3 v H B t o I 8 i Q y L 0 P 7 Y q / K p 1 R D f H z 57 b 3 u O v 5 M z H W N z n a h M R 47 Y h i O C t n I t k C 1 x R S 1 X l t z r d z j e v L E l p j z Z / d H 2 V H A B K X 35 w B 7 D a V S p H B s 2 e x 0 47 Y M L g t 2 c h P j x w F G P N r d 8 + e u L N N N Z A X l t F U h L I q f 3 N V 5 x i x Q e c J Q 3 X X U w Q U R 2 c s E 4270 E L o o g f g 1 M w l 17 J O n 0 M 0 K H + b j i G n E 3 c P 68 f E M t R c X W a J D 0 G p H G Q 7 X w T Y v g 7 C d + o N z 9 a Z L n C t 0 8 r m A a k x h l I f U 7 B Z 5 V Y y 5 P 13 z Z h 78 G U M a 1 u e 3 S x r 3 B 77 t Q p K y k Q j r m K r D 6 y 26 C I b e o 4 i 2 r u k g u V G O t Z y W n + x m 5 B M s w 7 l E 36 S P 6 V a 5 U q s m D T s H l c H 48 y T Y c V Z E s f S t E h 3 g / x B R T e 6 / l I Z 6 j t P k I u R i Z x V W z z O D 7 a X B Y U o y t L M T 1 z J + t K 4 f h b d O B E X J l g U m 6 v o V K G J t N v B R + x S 2 S y C E k U w k Z k t w d 8 f p 7 Y 8 d i 0 W u t i n 8 p 55 C B q X V G v a M y C c i 6 q 5 j V / O M R y p + c V 7 L P m o 8 j R H Y j f 6 Q P z i 8 F q + z / g w N f 6 Z L Y 7 i i L I N B i Y 38 s k L M V s N 0 R X f h g j p K f Q L g Y w x 67 A E p D C + Q T y Y 7 U p t s j N T o L D Y z Q h l h O 5 H 6 w X 9 P V J a z u e B m f A j U j m L r u 69 o K U F D X 0 X d c W h U G j Q D A Y A a s M g N 63 Q + G N N S s B Z 2 U Y E t 6 q j m O e 0 X D d e Q 7 v a q D 7 N z N C W Q c v l p + F 5 d z f S 1 r A A l r s B 9 + B e + o b a w e C U D A S F V r 6 c E H 3 O g a f P G X / I U g
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--48bba73b-ad9f-47d4-8c75-b4f0dfa77c22" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:53.000Z" ,
"modified" : "2021-06-19T07:15:53.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' a a 0 43913e02 f 124 a 4e7171 f a 40 d f c 9 a 2 ' A N D f i l e : h a s h e s . S H A 1 = ' 73338 b 8931 a 3 c 265e8 b 544 f a 17 d e 3056 a 3e56 b 59 ' A N D f i l e : h a s h e s . S H A 256 = ' b f f 9 b 75 a e 2 e e a 49 a 765 f 79 d 9 c 67 c 997 e d b 6 c 67 a 2 c c 720 c 6187 d d 2 f 67980 a c a b 7 ' A N D f i l e : h a s h e s . S H A 512 = ' 3 a 16091 d 8066245 f 2 c d 79 d f 83 a f 1 a 93 a a 2 c 8 d c 94 d 3 c 0 a 4e52 f c 52 f d 2 c 0 f d d c 754 c b 4 b 30 d 868 e b b 0 211803 c 71414 b 7 a 141 a 1595667 a 12 d 479 a 61 f c 2 c b e 33 a 1 d a c ' A N D f i l e : h a s h e s . S S D E E P = ' 1536 : H L + 3 W X O Q w i 6 w E B x m T 33 U / a N y q + 4 l R X 6 I H n s O V i 7 s : r O K O Q w N O T H 47 q + 4 l A e z i 7 ' A N D f i l e : n a m e = ' b f f 9 b 75 a e 2 e e a 49 a 765 f 79 d 9 c 67 c 997 e d b 6 c 67 a 2 c c 720 c 6187 d d 2 f 67980 a c a b 7 ' A N D f i l e : s i z e = ' 115712 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P s 501 I 5 h / A O 2 c 8 A A A D E A Q A g A B w A Y W E w N D M 5 M T N l M D J m M T I 0 Y T R l N z E 3 M W Z h N D B k Z m M 5 Y T J V V A k A A 6 m Z z W C p m c 1 g d X g L A A E E I Q A A A A Q h A A A A T e D E B T 17 y b G J x D 8 p Y y L D / I L + e l Y D 4 B 2 + k k H o g F 8 x a l V W O t 1 a f V b j W x a 6 K P f Z Q / 1 F E x q 27 Y V N 9 y 8 w e y T H c 9 V 6 Z t Q y 2 q Q R v g 0 / 99 D d 3 q 5 q O G l 63 + S E 5 k w I i W H B N R W e / 7 y c S H M t i 2 Z r E o R e u W J g F R / M z p t J B s q A q P 5 K U o O 2 G 3 p 0 R I q v Q a i T / j 3 S A F w b C t a d 5 u k l M F + q G R u y N Q n 6 J Y l u + x U M Y e 71 m Y V s 1 L D + u w I A c + i l O W R 5 u r U A f d 9 e x B 3 d o D Q C g h N i Y E n n 1 N b q m c 3 Y n M A f y x y U H f o k h R L n F 0 b Q w 6 n A p X J 8 g E e w 78 j R D h 4 G j r E S E o E C r M 5 V O j b t M N H 15 W H K Y r V v o q c U B j / u W 2 M 77 Q v H C I f l 4 c O j J U R Z A G Q W Q 7 l v W t I G L p m l A r T F C F 2 J Z W b + U 5 J I L Y O K 8 / 2 Z e A J z J Y P M O Z u o b W X P 8 d 6 H l c g R o R F F O p Q Q A G / w P e E V V o j V r H 9 C O H 5 a a K R H 12 P B j 9 L m / T h Q 2 / R 85 o e 93 s o v M B 7 b x 2 p G u e X 3 G w s e a I P o b 0 r Q a d E e n e y 48 o d s I A s o 2E6 J O N 7 M y X s 6 c H l 9 r y k q 6 Q J F H 0 6 w w O U s d D d + T R + K K p k Q K k M P 2 H V k i a 8 t L z 9 G 3 d a n i j V 0 L d j k 21 K t / o B s T v f A q H Z W 7 G F t p A j 4 y J 2 b x c + 8 F o o w l o b B E j D i Q 4 I L p G p B M Q L g O D H + r Z L w g n B a T x Q V W W H + d / R T W d h 3 i 6 a 22 m F S S + s A Y i D g O y x M k e k G c W L I A E Z N m w 2 P m d n E f N A T S q 6 H c A N Y X o K H m R S 4 S m f k A x 7 a f s B r F 9 B a s G 65 l I S 8 c 6 P 38 v X D 0 f c 43 N m s v J 2 Q W g M u Z / o 6 g V J U J Q K K + 5 E l 0 t k D Y t y U 1 B S K 4 G e 6 W z a Q R p a S G I S 21 K J Q l 7 X N M 0 Z v f x s 6 o 27 C o r 25 O f b Z 21 S 3 z 5 Z R 1 / v T x x f V k d F i 2E81 M 7 D / q X d D U D g s 1 I E y I J j c S L B v 9 U C + Y k F Q K 3 z 7 f Q i z 7 g b m Z / P M D B o q 7 l a 1 H / Y P D j N h z s L 49 p C X Q 0 s I 8 V P H 170 G L l W X 0 R x 4 E W Z O X 2 v y v f 0 t s N F D u 5 e S n s Z S V / 9 f W y B n e s y I p T w x 9 Q + h j h 2 v 2 K T l l z y w D A 7 K I 20 Z 7 R C V x r D Z L 3 F C o P V e W 1 A q I p u / 0 O P 5 v a C F z R X 4 b J a Y f 1 T 0 q h J S w y S 0 8 i / 8 / R C v P U O 3 W V 6 R J C w Y Q L y p u J G F 5 Q Q 3 h P p J E h s 0 q 4 C k C U j P W G F C v z a o S 4 h v 8 b Q w Z 856 / R j I t n J 9 D S t I v U D / n 6 C z s b e Y l M F 0 R K + W I a z r 9 k c E g + E F H q / 10 E z Q R D b 8 F 4 z d H X 0 J 8 b q P z Y m m L Z R e N X L a w C Y t a 8 W c p U t o 5 z g 4 G Y m f 80 W v V n T 8 I k 44 K h g y u t l C q u B c S 8 b Y o d A 1 o 4 j V o Z X a S H 95 y J + L k s 0 L n p 1 n I V X 7 / M 1 z A U Z B E 5 T 22 e v q N B x 7 L B 7 J Q 1 U 1 h z M 1 S b x Z l 0 E O C S / H / Y t u g s / s h 2 n l 1 p P R / d d S F r V l l R Q n S K R A D w i u T D Z F C K f T + X j t U D U K I Y x w X L h e z U 2 B 1 w z g u u 6 q S X 5 G i O 0 1 h R e d A u 9 C G z h V J I g j g 0 3 q / p W 2 t Q v 8 N i U 6 m s I u 10 t y 1 y B d C z r 6 O 1 Y U L F 0 q a 52 p j k 2 w J z t K 3 U U L e m R u b 7 i O P H 48 R b S 3 F K z T Y s / g O O f s i z i U 5 a l A K c d 7 S 7 g f t 0 w T b F i 0 T i b p t 7 G p R w q 3 x k 7 l Z d x D q X A R 2 P y K 0 a 2 G 1 D 8 G E Y I Y / j O d N F / A W d Z 1 S s O M n u z u + N X r m / 8 J Y w O G r l C t L j M H k + X 8 p E x 0 7 X x G I H S A l U 2 a H Z H 9 p n H t 1 R Y x L M k m k S 9 C x 50 / 4 / S 3 G I l 5 U p z v 2 R Y i l v / R C U k Y 73 T s d W d v r I I 3 j d D n O O P R R n U 3 X B E r m L 0 9 n 0 L U o P B 8 y R Z v G i 7 U e I U 0 + E w R H 2 O 0 9 v a 4 u + M T X w / e f E 5 t U l Q 2 I s 3 M B b O G 0 v / R 49 G l A r t Q x S / B l j B z 81 E N P e 28 z 7 S d h N r O K L C z 6 U 0 r K M d 8 m n y I H l p b q a 8 t g Y b L l J w p 4 E j 1 C 7 S T p 8 C 4 M M S L B k K N y T V A g K a u m i e W F E j J A P v L C m c E w E 1 y g V j B v w X U a 10 f W p r 8 H x R m B O 6 d Z H l e 2 X N 2 e c 6 u v V y M R g L f D Z f n h x + w / E U T m 8 C q P J L v 3 K l G A r y Y U + V t t 6 + 5 B 6 / J x e 0 0 E C a R r P t b c W Z N 2 d / q 5 w e l O K T B F 1 z 72 P / c N S 8 / + s 8 X a X z k T n 5 w C o m K + 6 o n u v s Q N M H 64 V A n X J D m U t O + L P W J j 94 I s u H i i Z A H D r M Y o T E j s a i F t / e F n m P g h S 3 / a a A M f t W I N q G k o A 69 Z G Y K Z d K l a H / R N q K w r f I n + Z S M / 2 l S A u E M 4e1 z q j J C 8 T 4 b B u j j x x E F s 9 N j d b / G l + E l u h T C e m Y W R E A z 0 J 9 b a 3 s 5 J 0 h F o 6 o M b 6 y A x r R 7 p h 3 I P 93 J C 5 Q r 7 P U G k P U H E R 71 X K W B L n r Z R R J M f Q 2 / I b q V w R U p 77 X j N h e y p Z v V L l U r k U 2 g 0 W F d J S x U + / Q A f x 90 h h v B y 3 z 3 s l w 3 e i W g 9 P 0 0 V 2 I R 2 U 5 C x m M 0 P 4 V H o j E V / B 3 N n J S J O K L j l 6 j I u x g m T c p Z J O r d n o R K 8 q V a F 8 e g T e Z F g d g f x x Y r 59 O i k k Y 97 j N F 7 r 1 L V e T H 4 r W O q 3 K I l a 9 r 1 O o M D N c Q R j k e N N x Y j J L V d g q y 33 W o t w 8 r B n 6 t W d D N s B J b l w r K d p u y r n Z l d p O R H / d 0 e q L 4 D I b J C S f 7 C w h r r V F 5 J Q m 8 G K t R o a O I D A t g a n O t V u z I T 3 y W M k V u 8 Y 2 o s Q t w S g K S a b k L S p r d p l + m L R m u + u K p K Q n / z 7 v d 16 Z w i d p 6 v Z H V a / 9 a o 0 W 1 K X k T t 3 / z t o O J 46 o C P A H 611 g k G n M H V 9 a 8761 c f g X R f h I v Y o j Y D F b M w S X 6 U H Q D U V W D g T t F K I h V h x B 3 W m f F T c d o u f I F //x6EBumZYBH/NCn/UioeHvrdoxJUFGdiBxOGyacpz7b+Dhn7K0ZEIOmMltKGilpVM15gsc5dwF7t8+2Mdtvkzj8V/C5wLfyahLwBIg0WtHIQIrvXlqCbSpF+s3i1Dj4udP9u3IOL0U8ie8WA4RIdFnRuOlB8W0pPeAB45dd0f2WQ4hLKTjvQcgylWAUH9FDMIEl1FeDG0WpQJKTRT7CkRtXNlcOn6GqG7ZURr+HF3s9Ib4mKaWX4tnDt5sQbjezLEg1EZTV1Doa0NXq6FATvN6mOs1mg4zatrJ4rIxjpS2r7+AK1z5lcWjfyd7X0DhjqUxq9F2GgW/Z2Tf/uqIsFHDWx1Z95ApPgw0ixDxqslQc1fvE8PwnMzgSbHIiBB1A2k09fnCn0SyVdpGdORzirt9qw9mZO3wcKDEcfAIttZa3VIZUiLPejspWjRhcRBMLU9TuoBLBMFLgYy7ghQQNKOZsm2XqivzUZJczLKCklRTcZGbI7mvDlJNEQcmZtK69fIUwP2UwuFAfc8FZS1m4jxA4kAHxSaWS/j9fMFEZrlRjRkXZ7mXKcreiVvzGT+ohhnshyXWfLm1JWSMHf4Vc4bFWxUtnseq9C5nxJ681wstCW3mkViGbH0L
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--9c23f0ba-8a41-464a-9bab-60fe4ec0034d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:55.000Z" ,
"modified" : "2021-06-19T07:15:55.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 530 f 12 f 8058199964 d 0 b 41 f 1856185 e c ' A N D f i l e : h a s h e s . S H A 1 = ' 8 b 0 4023990 d 18 d c d 5 c c 4 c 5538 b 332 b 0 17 f 3962 f c ' A N D f i l e : h a s h e s . S H A 256 = ' b b c 58 f d 69 c e 5 f e d 6691 d d 8 d 2084e9 b 728 a d d 808 f f d 5 e a 8 b 42 a c 284 b 686 f 77 d 9 a ' A N D f i l e : h a s h e s . S H A 512 = ' 790 a 9 a 6e77 a c 0 65 b 53 c b 719092076 c 9 d 4 b f f a 0 3082 d f f 79 e a 86949 e d 0 3 a 8 e b 13 d 23 c 44e41 e 2 b c c f 98 d 49 a f b 12 f 1 a 44914 f f 7 b e 5 f d 0e43 b b 51 f 9340011 b 1e404 d ' A N D f i l e : h a s h e s . S S D E E P = ' 768 : 0 1 Z q C Q K y 8 I Y d f W i U e l R 36 i h R 6 n m R Y s n 5 j S / O P N i 7 S b p G : 0 N y q + 4 l R X 6 I H n s O V i 7 s o ' A N D f i l e : n a m e = ' b b c 58 f d 69 c e 5 f e d 6691 d d 8 d 2084e9 b 728 a d d 808 f f d 5 e a 8 b 42 a c 284 b 686 f 77 d 9 a ' A N D f i l e : s i z e = ' 57216 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P s 501 I 0 n / T P 5 W Y A A I D f A A A g A B w A N T M w Z j E y Z j g w N T g x O T k 5 N j R k M G I 0 M W Y x O D U 2 M T g 1 Z W N V V A k A A 6 q Z z W C q m c 1 g d X g L A A E E I Q A A A A Q h A A A A 9 g C U O o p 8 Q / V E H L e y V x 2 f y z B S w H O 0 j z i p Q 5 d 4 c C o + X K G Y 1 r m + j T i 7 i 3 Q q y / H a z G e w n b m g q e C s w t K a Z t W p p S S W W z a R Z O O S k i / x s t d z R G T H P d Y + n U 2 s l R 9 S j 3 R Y b o N k e w q N R z 5 K P F P j R U L u V X B K o / T L V e E t 5 L l 6 T F T 7 K e J H K g k M Y F m c s x t 81 J r m p l s l r 0 T + + y k I W L / Y i Y B X B o e 5 m z v 0 I i u 5 M j C r b Y n u N 4 Z o 1 z G 19 a N + 4 G U K + 5 I 4 s c K i K v O q l y z N F M I 56 I P G T 1 Y J l T 4 J Z l 0 B o c K S I G X 2 v N f f 8 x 5 U W 0 I 3 Y H T 6 x o C B g a R z z t + f V N 3 O M V U f M Y 8 g P R g X f V o + e u y p 7 Q + N h Y K V n 8 q x s D 5 j Y E K L O L J F L y i f D 9 u W T I / P c 6 i d a 1 Y D L 9 k 0 w a b l h R e R 3 B M L 7 S e I f d 8 / x N b 691 f a r A O Z 0 h K O X 6 w S t Q z o h W p C B m p Z n H D J b j x U F I + n 9 a F f 59 D 3 g 7 p P 1 o L 1 w D S Y t 7 u X 4 E Q g z Y p 23 M 2 k 5 R H D L z i n X a s R P s K w 0 B / N v o R D 1 i r c H z n b w y e g k V Y F 7 J j A L 9 j z 9 P y D E e B B X L n 6 f B Z T o j 8 J 8 + M j a A G C R M d R n G L S o u + g i + C e e P p K e 7 t a m u h e X w l r B Q b 8 q 8 N C A l 6 C 2 + a h z x P C n D H a K l + i 9 Q 1 r n f Y R h s k j g Z S L y T 3 e b s L M T 1 F t I d h o Q 8 i 6 W y / o f 5 S 4 W 3 b o N s 9 n q s D 3 p T A a H Q G X b P A v Z 9 F V 9 a W G A u / G v O y Y J t T w F Z Z H u / T v f Z 4 / q 2 g B H p 0 z j F v g I w I y D 1 y 1 C B R a O j g J 4 H 1 X S Z S 0 0 W 1 v y K Z f V f l d R O e b 0 a f 7 g q J r 2 q 5 a E C K P W m d H h 2 j B u l L q X k W t P L y t l 98 E y o L q T u U H 98 a L H H i H 0 Z d W w v I O M q 6 J Z w m C j N b F u s u G b x 3 e E 68 v f H A f l 3 o j M n / B H G g p H q X f J Z Q 2 a L O 4 T x + g o w K F H w 0 o u F c Y y T H x M z R Y u v D X 7 H 7 Y W q R 3 U i O / h t g W H t m 2 n w S a E L r 3 h X X S i 98 S K g 7 D v I a m x 6 i R O 3 / m B a j U / J r z + u 5 G d j M 2 M 5 I k w e a x I Y h C o 6 / J 4 R d p L i V r n 8 p D g v 434 B q q U d 9 W d A m l b I E V n V i p 6 D C M 7 m 9 H X m C f z m 5 X F 8 Z O q g 6 i S P x N + X J T t a q Y J y Q q H C c 6 n 3 b B C N V a K t H q Q H P Z z K 913 j 3E2 J v N X X p a K 8 g c 2 / N d H 1 R o B Z U p e e F + 7 l U y T i E v 0 B o m E 0 J 3 r 8 d Z 37 B i G K I G u r 74 J v Z U e R s b G V G o s q h B S D E 6 / q I 224 l H C D 8 C 210 g 5 n / 8 S Q T Q M q B 6 D e v C H 75 r W Q 3 f z M W V 1 f M i o N 8 b Z 4 w d O m N J A W H F L 10 l H Q 4 f C b S 0 n b 1 r + 7 Q C T W R F H / p e d W S 1 p r B w Z A M H f D n 7 M P S t 3 C Y C I 0 R T Z Z G Q F b r K B a v G t T F l Q 9 Y 77 u Y 30 M l f 3 x 5 P p 6 f k z u B H E K t k / S q 0 w t m A 9 j S / r C / K j 0 / w u u x g x R //ScYAXKuUXnYYR4IRvy6xVMnI+Oq5pgdYNckAap/SLBgi1IB10WFdw5XT17FknAAR014UkX7Ur/ZaNsZRsS8ik1flGj3/6+i4eFb7kf4jBYoiytfx4iSGP4Wrc2AbnGW4EDK2F22qGyPIuZ3gWCyyWZevEJ7JBDtpUWWNeYCXy6EEYZpOniLIbJzyMWww6vmERx8NfM2ylxUbFX2lp2TIJva6j4eceTlMwMxNAhGP2RQ8vP2puDublFadY5sgck5tEhz7DokvE0AzesRtYE9bfIconEXz/fPhShLV+Cnl7r19VBhsEJUr9uGGFTUwF1/wHsZwKY+ZhPNls5eTEH+MyeCe2neAPjxpT83c83fhi3VNusPd8X0knzNRZSuGB36Z5MXGePMCCePQVGIeHRKG5NhAjcWSW3biDosBWWSpW1BntP+WV/UE3R3zHl5CBuD0enE1K5qRigCTfvWmB5SUhBHZcFtg+oodG36VTphLFam0Qi7i8zyRmgP+7C1AJHgRjew5CaibZpfZcg+wt5HN6Is2qdih3pu8RyysEqgh6ldGbc6V131z3jzaMJfN0nR6r+tB8PCPiBxi9Os+o0XALGImr1eS2pav2+WiMWqN81eSvIXnM+1udfiuTwB51hLVUysvvCrauhuzJaIxHB//Ukn9SChvtxt6KTHA0reECIfiYOBLJvgADYrbjd5jv2xZMirTob4efWD6QZpiO7s7gcbZz0J0I27cdebgs9oGVgymoAk4JHT1TU6DpuI/UOkIhXl2xO44Dv0zBJbT9kgUbD7dTSIX62mdUwFo0tY0nsyXI1I7SIlxlqHF+dNqZfeyrB5Umdv00+1aoZjMKdYDA1mL3LNwvTjO0M2jIM/Tmku6UApJTrEFDuIPUPbsIIYnkMnW0uIlErOv483CL6yzlHNCPcY6GrxrU7Op5FDxN0qUtw552maJK6IOKllbNKrwLFeK3vdKyEIqC8h5cOZvkZeiNaKzbHoM3cRf1vGmX1ueouDRAn9T5r8CNy5hFwbbsgWTa1EA4BGISHO/mWfoziUec9uRRaq+e8O6J/Gi9+mkE8u9OhWW//QlzyS6ce9eGo762/xhyt3267tKY0uNCfu4sBj6e/88KsAXlC9aX8LQxNsI3BdocpIsoqNrh5Cb5g/NXMmjEiV7clX/T8Y+5YvbiLexHb4LG7yzLCZR0JNhqZlW54BkG9GgxqxiuSmIpWXVpDQ8+SqZLLNQcBENn3cAfVVL4Z6BdCAV6qhpuX5inh6TGdZrg0DEPjAtHtHV/YlxaGLGqIyqgqwCIW8kFK72BSpAUrzAjRdni7+9gUH7LzYQrJ0g2l2D7ZtoJ4c8EtCz/MPnD4GJA/rI+yldFBrXtMYRiSpPVvYCWHqpNu3cqeYvT5aC8j5oJQi+p/emdOE9ejdliJKhdVgvY5wtx110waaxW2pKj4LiYkssbcbFnaXE0Qg6lI80/FXjB2ZpsJRPuddDomBejLr0dCkeU6lgN3YDWFPp5SW+B7NxRnXAaAVcY/RMCmdxAeRQVqCfvmUDrs735f4Y5UAya1UPYthsQbmDcxwq9usQ3h9FeAAEIO3ZNK3P3Yg4Vl3AvS/eQdgvPS3gGoe1JNfm902QoUT5mk4W2IrTWO3YmXEss7kbCHe406Z0Z9C7xiIWbMxAF2bCBw1zNRVLKj8Cd9KGHaZgvAHZVOi7wAFNTK9pPG8S7kTkIppJ32x7h5ofgwBKK2ifUD6Kp4R5PsTkRrbgU/gNj1aDZflInswMe/DaS0nKXCZVtwxFxpq8Lvw6SJOHgTJVKX2SPhNdeJkoYW4A0ShfSaI+ndD2lrUt5Fj+EO0oHjyEliY5sFyV98LB7izEzDoI/XWmsqyRHOJpUKBr+yGxgb9EZPFc/mrr/1gvXAS3bnQZ5wlDMJQqPCkan+9sdA47EZbWnHAd1AvtCZPVjgag6T06LsGiu4VHUzu3Ruf0WmBBTa
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--7bbad130-f1f4-4b17-bb04-3d4d7d6bfc37" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:56.000Z" ,
"modified" : "2021-06-19T07:15:56.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 31 d 3 f 0 a e 33 c 72 b e f f 48 c 9459 b 132 d 24 d ' A N D f i l e : h a s h e s . S H A 1 = ' f 5 b f 9 d 483e0 a 204e7 f f 59 f c 0 92 b 4e580951802 c a ' A N D f i l e : h a s h e s . S H A 256 = ' b 16 c 3 e d 44 c d 0 4 b 0 33621 a d a 7 f 9 a b 89 d 830949 b 3 c 9 d c 26999 d 862 d d b e b 7 c c 5 a 86 ' A N D f i l e : h a s h e s . S H A 512 = ' e 58997 d 351914 a 9 c b 8 f a 15672 a e 7 e e 195 d 131 a 9 b c 4 f f 991 d c 508869626 c 95e8514 b 75100 a e 12 e b c 4 b 0 8578e843863 a 18 b 248711862e183 e 50 c 5e81 d a 29e42 e 0 7 ' A N D f i l e : h a s h e s . S S D E E P = ' 192 : C 4 t e C o c a G 3 G O / p T B g 30 i 3 B c P b + N C 2 b J U I S P N g l w P v 2 K 4 : C e N t / x O 30 i 3 B c j a T J m l g l w P 74 ' A N D f i l e : n a m e = ' b 16 c 3 e d 44 c d 0 4 b 0 33621 a d a 7 f 9 a b 89 d 830949 b 3 c 9 d c 26999 d 862 d d b e b 7 c c 5 a 86 ' A N D f i l e : s i z e = ' 11776 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P w 501 K 94 c c 47 h Q A A A A u A A A g A B w A M z F k M 2 Y w Y W U z M 2 M 3 M m J l Z m Y 0 O G M 5 N D U 5 Y j E z M m Q y N G R V V A k A A 6 u Z z W C r m c 1 g d X g L A A E E I Q A A A A Q h A A A A O X v 99 s 0 o / 4 t i n t A Q p 3 V e z Q a 2 Z 8 c Q O u s 6 o V 653 C / U M M 2 F h M b r 72 k + b L M w u a g X d m f u 5 A u k I 1 w w o K K w / u R 2 J X t g s p u e o B t E e y o V g U f c 4 e N y S g w 5 m n v V e z I g S T Y G D g J + F q W t 8 D h X x Z p x 1 M e w s j 5 U n 9 G t v j H Z w + E w V e T 5 X 5 o t 8 O E m 2 X a e F K Y 83 l X r Q s f D D 2 J U W a / I 1 f g v / O r p a L t L z e z N F m l L i Y o W E W T s h n e A U 5 U S I B + H Z y a a d X B O Q V n D 5 / f j I y f P J i r i + D g + B 7 N z W E g X R D d Q E 5 Y i 7 V X v 2 S 4 c z Y C + D d u r T V X d 1 g C w q B W I E 60 b J i P Q 5 q K 8 q B F e M U 2 Q J m b c z u 2 O 7 / z L j P L T F H S k / + J 8 u 3 r d M h 6 v H c H M 1 W k e J 8 B + J l m h 5 p F U 6358 M t Z s 44 E E a k C W h l J D F Q A n h Q g T S + b f k w 7 f w 71 P b A x T s K W L a J P + N p S A X M b T 8 i v Z r p m n r y T H I C V 0 b 30 p R B k Y R z 18 j y 4 K j J W L W Y Y Z P 4 J J 1 c w q A 8 y r p 8 X A p o f w V 0 q A r 0 z Z N Q b M V t T w 0 R 3 h r 3 k Z B H 5 r r Y 2 x w i I M d D n d p X 7981958 l D x A Q o R e 8 K Q h P F V K i V W H V j 4 g D 9 M g p T C k 50 s f 4 F V T L 6 T C V N 2 s l 2 l g g + I / 3 v s t G Q R k o L m 7 j F b 56 s q z L p T E g A C C 2 u L y q r c Z u 5 K j d b 6 k u X W H o Y 6 W d 5 K C Q M A l z p U d T 82 H B W v 7 t o 0 B x v h j y 3 s q 6 t W 3 I t t r N Q j + 7 m l 61 H q y 70 x V h j p V 5 p f 0 7 q V L K i z V G M I T V w 5 G t p D 1 a H B z S l h l G z X O Q I g 1 v 1 Z a 5 G n E 8 D 3 J D m a 86 W b w + 21 b i e F w C k 26 z i V r h B d R i Z R c P I D z 9 m / s e 0 n x R S p M B 4 D L E S B v l L r 7 e l j K e C 3 / S 2 o k K F g i t p I 5 R T S 5 o b a c d 4 v A v / e i z 1 v 0 y 92 N 0 O 3 U 9 z i k c F w C Z 2 e A 71 i N 5 n C o m T U Y 978 V b e Y P L i 2 w m 9 T H H M r q q e 3 D Y F O E w / 0 P X n 7 Q W i 36 X S V l Q 5 D D / M n T L / G X l i h p J H W E F a p M A p G x G C H E e a n w I e a + s y 8 h q R o X S F u y 6 o o 0 S n + 0 o N + d N 2 + l j 6 D O F i m Z 1 m L r B W G O a m z F c d 6 c b O / L v P 6 l C 1 h g F Z T Y x U Z 9 b H k e K M n b 1 h K E t g 6 g l / h f c a D s o W X 3 L B h c u r w l I s Q T / k c Y 4 e Z B y S l I J 36 W g W o W + N r 9 b t 0 h N h E N c 2 M m W b 1 D 0 C Y O T M B b U m n p Q x T O g O z y v A a X y e b T 9 P w w + n h c d + / P q a A W z u w 8 U S o s Z j R d k O n n q s 8 G e 3 H y I 2 J m 5 a m U n S M k m k B 9 k l R M U e 61 B o n Y X 8 U / v c R l R h c H Y w S C Z u a v o G R d v 3 V s L q O V v a U e g + m Y L K Q 2 m V g 7 K 0 G t Z R e 6 a Q G W O 4E8 w 6 a y G W Z u w 0 c P y w F R G q M m r X z l u 0 j 1 o 6 i Z y y L w g a c 9 R 28 e j a V 8 w 2 D V r O m 8 b Y S R U G c R / f y c h M j g K 0 I 3 K P t Z 6 + z S d + V 4 V 3 n o T 4 j t c L 1 / o C g B n W 8 h Q h + 6 W f G h 4 h T 6 u z T u W l Q J E W h g + 1 h Z N 4 r x q Z h + o Z 7 q A i x V X 93 y z / G g l Y L 6 e A F w f D a y + r t v r t s W U 8 I r / q n R K m T 1 G t t 1 v 4 C g 7 f I C 5 t h 6 P S V L x + 9 l z 0 O q k b r B e 7 d I 4 i + Y m U l Q x 24 T X 3 u y B C 6 t h 7 W p B 9 n w 4 O r D F Y h / k S Z / S D E C 1 I 9 R L Q e v o Z X G t W W E W b / I 4 / R r n M + D N / H c R i 2 M f N m 6 L q J 7 d r l E S 1 k t i J Q N 3 e v e E 2 V Y u b M K p L V 0 G J o 6 y x P k c 9 h c 8 h v 3 E D Q N n 4 e A s j + F H 382 W H c z U A / m C q J m N R R l c T + g t e Y A 6 p M P L z Z k q I 83 z x n b c m d P v J g f E Y C n L Y 4 W a d F A J S e O Y m w f 1 E H j C o I O L n Y J q C n r 2 d q L k 36 z f d I J K 6 w o h d s 3 A J d u z V o q O a J M N G 7 H z u M Y i O Q L F Q E z 1 R D P j L E S V a X J a O E T q / K 2 q D b D Y l D a N N J 1 Q E 1 u b z 6 P P l g g J 80 D y s r J L I X Q l F / Z s M E N C 9 r c w O C r 8 A D d r L c 66 u 5 o S c w h v u U s E J R 3 b X h g M w C t y g A z F L / H 2 a u e 9 R i w W n H g x W a 8 F q k n R 2e2 Z c 5 g S l c j o n 33 Y V M L q w 3 h K U z n Y 4 k i e b m 2 N P 0 / P h h x F s y M t U c I G f 6 P k C R G T D x z s l V 1e0 Q o h U 3 J n 1 I D g 7 f C z / u G B m N S 32 h m v D A i 2 m x 9 n U M 1 A N S K J m p K s l B d V p + B v 7 Q O O S Q v O 3 i F 7 j l z P D V C 0 J R / 4 s Z M P z 7 K 2 f f w a n / m v 3 N I D W Y E t f P h h 85 Y I V l K M f Q C s g M 4 i F 7 Z Q Y Z k O / 0 j M 3E9 E w G r A j C A d x Z u h T K + U n U U j A o l n 5 I B v O 3 f V Q o y N 9 r x V U S 5 h q u w h O l X E M + z F r H i m p o t g o j Y X A 8 v t Q l N C i B G E F p S 8 a V e m i E w B 6 Z g W N K p 7 C N M L n F W R w Q j z e + 64 S D Q v r 914 B J 1 d 8 / P 6 j g + G I q 944 L U F Q c G n S u j + t 8 D k n A N v 5 I Z f l v j / D b A Q b 10 K h t U A A O f A x d X 58 Q d k a F l Z 6 V 8 I + r q G j b k K o W 20 P y R K R C S a Z 5 W w s O M J 7 U Q m t M Y l C 0 43 P 6 U E V u j H N 0 l Y h g 9 y G X j m b K u f + N z 883 B T x L w u 7 u k y a q 6 S B D e p 595 b j H t v + H 5 + f T 7 k 7 + a W V H P I v / q O q W d 9 G X g d E 9 / o F N q j N 1 F b F D q O q g t W 6 j u l J Y o t q i 4 D M 0 g u L e d W 9 H / C Q g O y c i K S 7 + R V r K k G D P m Y + o S o S 0 o S Y 12 T z N X C q O i 7 f 5 V Y 73 M p + 7417 U s H 6 J 4 o b 2 s d 8 B L P 0 i v + 2 q 3 T Q + V X D V 0 O q s 8 b 70 h x I i G i T U 7 c Z J B D C A H e l A + l C Z A / q F L / G I U 4 j L 1 b X h p n 0 J 97 E W p f j B T y L r q O f b 9 x d z a I 9 n a v q + R X v 8 x O U h V H 1 N L S D U z y E S o N A V y 0 q 6 x 2 K I d o x j Z s J 4 e x 0 b a 7 k Y b R c g T B 4 O m n N / 9 L c Q i X i 4 Z 22 G c 7 e E + B j Q Z r q S Z g G E x J 2 Y 8 i 9 y T Q 3 L I Y A s K K F v L 50 b f R 15 o Z + / U + k U Z 1 y m G z 6 u 0 M c q r H C R 2 w 746 k V u l r 8 / M F 8 I t 2 f o A Y o S c Y N C n W 0 Y Z T 0 c 9 + s R E I n o x a K w p 1 V m I p i 0 X + p 8 D D D i i x B 4 j J 3 J W o F D 0 A h i x H U H y F B 6 N Y 5 / 5 j T + e 0 X n t e W B P U Z 2 E W S V p Q D I 74 V F R p X i 9 V N 6 m r V C A W 98 p 4 P r C / 3 j c l 3 e E X r I Q / v m i W R W L V + z K D g m n 53 B A + 3 K P 6 O Z H 1 f u K 7 E J r J E Q 4 s D o Q i 6 S f 5 i P M v b y Z 0 g 7 b x l Y r 4 H L 8 V f f q m a O t Z U O x j C c P f M R v a 3 B 2 X b f i K o I f S T O R F a V H 1 j v o x l f 4 M s H r f x h m n C G 7 Y v R + T w U x 4 n T X 4 j a I w X U h t Y 3 z 8 p q t n d l A B r T 2 B D r k z s j p V J S s h f F P v y r g C S w + c s c t j 0 K i Q x 135 H L l + l j h o C H g Z T J R s d t K D K W Y P o L 7 e p u T + v 6 p m R X U D 2 O H P j F V X L n l P y z n 5 p g U o 5 c t g z 9 g o u r R 3 C G j v p b 2 d J D V 6 i o 2 z j c q 47 H d E n s N Z k L P i T L q O U w O P B w 9 c b F 4 p D r v 0 w L 82 V J a 2 j 8 e q C X K n / t T 7 z + r E 8 w v + 69 P n s W v l G g b n d h M d 7 V 0
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--66cc5e31-e702-41bc-ad3d-c7d4e6f363df" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:57.000Z" ,
"modified" : "2021-06-19T07:15:57.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 8 b f 0 0 e f 4 d d 6 b b 308 c 76849901 b 0 3 c c b d ' A N D f i l e : h a s h e s . S H A 1 = ' 0 4e8 a 8 d 30869 c f 60 a d 42825667224 d 5 c d 0 1 a d e 15 ' A N D f i l e : h a s h e s . S H A 256 = ' a 5 c 873085 f 36 f 69 f 29 b b 8895 e b 199 d 42 c e 86 b 16 d a 62 c 56680917149 b 97e6 d a c 4 ' A N D f i l e : h a s h e s . S H A 512 = ' 551365e55 d b e 599 a 156 d 1 d e 1e59 e 388878e13 d 3 a 491 e f e 963 f d a 241 e c 58 c 1 c 38 a a f 2 d 46775 c 4e1 d 3 c 46760 d 0 81561 f 9 a b 5 b e 9468974e4693 a 9 b 3 c 60 a 4478 b 454 ' A N D f i l e : h a s h e s . S S D E E P = ' 192 : o C a Q 3 q a G 3 G O / p f g 9 m 3 C J 3 M c + Y e Z B k v m K I 7 H : o 5 N t / V g 9 m 3 C J 3 q Z 0 j I 7 ' A N D f i l e : n a m e = ' a 5 c 873085 f 36 f 69 f 29 b b 8895 e b 199 d 42 c e 86 b 16 d a 62 c 56680917149 b 97e6 d a c 4 ' A N D f i l e : s i z e = ' 9728 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P w 501 J + 3 / k O H R A A A A A m A A A g A B w A O G J m M D B l Z j R k Z D Z i Y j M w O G M 3 N j g 0 O T k w M W I w M 2 N j Y m R V V A k A A 6 y Z z W C s m c 1 g d X g L A A E E I Q A A A A Q h A A A A m q / o T H 52 E e e A b 6 s G m t + s X a v J f n z B z q / X 4 K Q F p C W r m e d X Y S e 9 L z S p P G M + V R 8 v t Y 1 k W H Q 3 C q + z / G o D V Z w 2 a A L M M c U O x W n z l E Z F S i + K p J D v Y G x A m C q e F V y q f 7 V w 586 c 3 W m p 9 t c o C F J t M L M 0 k 176 n o k k D J h 1 l p Z h c k c 97 L / B L 0 9 z k p L W j g b a B X B q 3 A F B l Z M V U S F x T N O 3 w P 79 R C d z 8 u P J 9 S Y F 9 S r p t t Z b v 41 x 4 W n G z Z T 43 N L I X L d x q d U B 1 O l A u e t y T o O T Z K 52 P H u F N 3 z j S N a P X S N g E u M j N 8 P 2017 t g x x f 1 N X d g j P B 256 k w 3 u H G j O v T y p / U A 1 O y 53 n S i s k H b j 3 a G g I C z p g r 4 J b d c o 6 B X V x D s W P r Q Y K p 33 H 9 A G b N 1 d R 0 b d 1 K B e M a 72 i B J Q d e + m 2 X 8 Z m s c K J 3 q K Y q q S + 9 T N S D W k u y H p v h w L 8 G Y T 9 / Y e 4 J g y B R Y + H W j Q F q d M P C c 5 R y X 2 D u g c f o L l e z z n Y q H o k m 0 7 l a S j p h u 8 S E R r u 3 o D D U W 0 J Q T A i x 0 L 8 v R 29 I l v m S 6 C j B 6 O N + s 0 D N r v P e G S r u h h U R 82 r 9 H J 5 e p U p Q / X Y E g f 0 j M 91 P 5 H K 6 V L K T M f 0 0 t u G O c 1 Z 7 U / k q A w E d v T D 0 b z O v t w D g J P s / R c S J D o + i q 5 q 39 + M t 6 U I F R C m F e o M v o Y F s d Y o h v M h j P V u I 21 L D q 3 S 4 I b 8 Q 0 Q B v r H f o j F j b o l X + P / x 3 O g e t / C 6 v A u B o R + q L j O P P k 9 V E d q C 2 m N B 7 Y S k v / P E 8 p a z K u V u Y T Z 1 m X M 3 L K f 8 C B N / w E f C 65 + H u A T E N o H + E 1 F 6 j Q 7 P Y M w o w x + k z 7 D A 0 + Q o w 4 A X x y 9 o j L M U g 3 Z Q H V I 8 F Q 3 J U E u H c y X Y a b 5 s t h B d N N A j / s r 5 K U K h N g V R K K t w d L l C Z c G D H k I K A u s A b D Q 0 2 Z M W q n O V w B e Q Z 77 t B g D 0 E L L N 5 W L 2 o S n 8 B K S + t 6 X 17 V 0 v 0 v N + d K H q w 3 k 0 5 Y Q z 2 m H k m i S J J i j 6 f q P v 0 M n K S j Z M A 9 Q H n 4 V 9 Q 0 J d 8 X u + p o O Y k h 34 B w L 2 P T R 18 j + 7 K I z l C E A Z l H z k m Y k Q z B n x y p x H G D x / O b p N a z w X 6 r R I 4 k g R H z C b F 8 h Y L r D P b A g K 5 v Z F 0 X F k P h b y E + M Q 36 G 47 y V a Y P O j x r 4 G k 9 i m q U / I C b C 7 Z a i 4 + E S + t p h 5 B W l H N f G d H r V q E V M q n x 0 N M E G j Z S i E R K U s c o Y 6 l 79 l w U u + A R d F p D J T p I W 9 A J q Z 1 H W 8 v Z / Y M K Q 9 X y q M b P l 5 X a 2 t A X V 4 J q y 8 z 4 O q J 0 1 K F i D 0 K t z 8 b d S 9 E Z y c z v 7 Y i 7 H F G Z o O Y D C S 6 S V v p Z W q 4 T H / k v a w A t Y d B 8 s a 9 b O N J T E 0 r o R r f a Q V H 68 u q Q F H m r / M T J z y G H o F S u X p E C L K N x q O H k d 9 b n R g o y a S M F w + 3 j p y + S o O l D P S O O 4 j A 6 m d G l y t F 6 i d Z 2 / u D 5 X S g t v 8 j j K / 80 K U 2 h E V d 5 G y A o L 7 L t z / M Z d x 8 p M V e J 1 D p J W u n G W G E P P M q n D z 5 w K k 9e6 l k s l k 3 r V N c s 5 A x q q Y L t s R m Z R A z 92 i A N G q A 5 M 6 e A / F k V M k N w Z e Z H O R T s 2 L 8 f g u 7 w a I n J G 1 Q E G 60 A W N W G M 49 v F O H b D s J F b N 7 + m N O z 9 a i M T O 7 D V 57 i I u e Z T y o l + j t O P S M 9 d M H W s V K o b 5 c x u y 3 X H i S 4 C w F q d H E G u d B L O J 4 c w G M k S 5 B + T N R T W f t I a D 6 A P L o i S 4 / u L Y H V E U U o y F h Q m o g 0 t Z h 3 a 4 u 8 B e F H s e P v W G u j h W S Q j 6 M T h O V V D 8 l 34 u U O / c 2 D S u j q x X E / G m v l i J 0 k y a t 6 F j f c G N K v B E 62 n o Z d 0 z D n 4 s O G v F z 1 Y Q N Y 1 a 7 l 2 p S 8 V 9 y d 2 p W h s U + T 6 K z N 3 i L R i K E O k U H C X c / 1 N x y E B v 62 j m c T 2 J N I M d S v O G 366 e h P w D B t U d V 6 O 9 f z + M H U b 2 + H m s 8 e t 8 N g G 6 j A 8 c l h S w w V O j D V q 9 a U D p c f c 60 s H 4 l I J j r l G K f + y u f q a C x 9 K l V / S Y o b c v 8 a h e z I O / E p e j m P 5 D x t F b v g + 5 I O c R d t 1 n M R N / r g j z S t d G H s 5 x Q 0 0 + e 3 T g / e O t G z E 0 Y w a e 6 D F p H s Z v I p k i a W T M 3 L 0 W U N B / X v Y 7 F J h 6 s H b 4 D c h w B G f l Z u N O M P o i 5 z r l h 0 n y y K Z g T B t 1 F f y m n u I G 3 Z l w V W p q Q J o s q i Z i N 7 Q H G C I W / U o P q 8 U l n / 1 T l c s s E 8 S 6 q C 6 r b 3 A h S d 5 v c o B C q k m Y q + E M w R W Q o y l 3 c o 1 s e / r e c M K i K P 9 V t r Y D H O 80 Y f m 3 r 9 j u J L t W 4 t 7 J C 42 h E 7 w / t O 20 D y R z H 9 O / j z p I l 2 r i i / f V 9 i T q T 2 j g w s G 42 z 4 K e k Z h m a 5 G r 4 R 2 b / V I d B l 8 o u C L 70908 E t 0 g t D 53 U H / x + B G r 29 c 4 H a D S 6 O B Y 5 F x p 1 y Z m T h 8 V l p 2 R 1 Y 5 x i E 4 x x Q w Z d c K S o + 9 Y + s x j i q m x p 7 F N m m 8 z f I G x Q W X 7 t q R P 3 S f U V 0 D e u 1 A M Q 9 q O / E m H g q o q G F 0 I A 5 w A l + Y E H 9 j X M 0 V i V x 2 P K i E 7 g z Z 0 w 4 b j n 0 k 5 o 7 m K w y L 4 j Q x D T k l E + 1 f i A H Z y 8 O z 5 b i 8 y N x u Z T U I q r w j p U s Y 0 P O P w S M Y 3 K R y x o p o 0 v R b M S j y 4 G u q M g 8 + R p f Y w A 9 G r j q d Y r m G 7 w e G M r Z h T h p p f S k a m x E b y S q D Q + Z s 554 D Y N n Y W g d p w x Y 5 y y G 3 k / p y 5 / j 0 p 4 E Y Z Q a n h x 3 K R V z H o g B M u t x F M q x F U U P R 2 O + k w 15 / i X O N M O u O 2 N k U 9 f v a P 0 8 Y w C a H W h h b + b e p g M 3 n 1 F 2 H e b q r L E M m n b g m p N x W G X 8 a X H U E L L F u s H 4 K U 9 l F 5 L 2 H G U D e F K t x 6 A Q A / u o S f O m Y E k 8 R 2 d Z S 6 W T a G 5 p l g V 5 J z X t Y o e X m f e + Z O p R J w g B S F T / g D w u m G p 2 R c c 5 o Y g o c N s v C E z K 9 z 5 T y A U t + m p D r c H d K T D I f T m T K C M M h b N 1 J c / H 9 + E E R j e f 8 D s d 26 j 9 G f k b j / F 5 g s P 8155 m n H x j D u t T 4 g 7 Q g v 2 z H D M x U x Y o 6 U A i h 6 p M 5 y B s K 1 / Z R 3 V 5 N + t M 44 g N i T q y V O V m a l v / y C m 6 E a J G r U a E t p m x u V c 49 p h v / J G z S o T 6 q A u x j Z i B m L n 6 W 8 U I T a M D t r 10 V Y E 9 P w a L d w Q 533 h 0 z 4 + / K T 5 E H M / b 7 b V x s 3 u 56 h Y m z 3 U y h I w U a v P c i J / h F Z u S m Y Y Q R X 26 g E r 54 o S a u h c 2 y I y T g R k 21 w f o b r 305 d 0 I h t 8 U U 1 P Z M k c T s d t v / x f k j 7 n 8 U q O f B Q r a Y T a N 2 S y f x 2 f V + 68 Q C 1 v A t h H N r 3 + I C L U f x B 2 e J 19 u f 0 E h S D 236 Y i k w A b M q g Z 0 w l 6 B w o T D b F D y 7 F F 0 U w G s C r U t d q J 2 G D k x q K g 5 T 6 O J A S N K 1 I g A p 0 C J S O M K z M 8 o w s 1 q E L 6 q e 1E38 //toRqJWTUcMTzy/ojdDExEi5yJcKe1FZuxuCA2oMK/W8qTpW0CCDHRDE05hA1ViBP4jX9LSW52OK5OozDwBnZlKUj6y/2WAB5xIJXAXCh2TnImpnIisETBKf/3WhQD+j1CX023w8tqgCkt2cHcjOgxvkjla8g0WlfPcsbjY1kuGd
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--17464b7e-b2f4-4c40-b4a7-acde8e505e20" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:57.000Z" ,
"modified" : "2021-06-19T07:15:57.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 491 a 38 f 52692 a 88 f 5e97 a 1107 c 0 6 a 9 f 5 ' A N D f i l e : h a s h e s . S H A 1 = ' 4 a 4609839 b 846 f 384 f 1 b 6 f 3 a 9 a 945 b f 3119 d 2 f 9 c ' A N D f i l e : h a s h e s . S H A 256 = ' a 3e8 e a 5e593176 f 9e66 c 17 f 6 a 200 f a 665 c 7 e f 409 c 97 f 49 a a d f 5 a 55 a d 6 b 0 b e 97 e ' A N D f i l e : h a s h e s . S H A 512 = ' a 27 d d 60e06263 a 32955 b d b d c 1823 c 1 d 0 185 a e 88 d 0 7 f 39098 a a c 1506e78 a 22 e a 39 d 6 a a e 6 d d a a d 0 f d e 31 f a c b 0e2140752904 e 68079 f 9 d b e 66 a 22 b 4 f c 0 c 9 b 7e3 a 88 ' A N D f i l e : h a s h e s . S S D E E P = ' 384 : L x N t / I W 30 i 3 y i w T J m l g l w X 74 b 14 g H R N 7 a W 0 R 1 l n N f q : L x L I W 3 S x g l N X 749 I l f q ' A N D f i l e : n a m e = ' a 3e8 e a 5e593176 f 9e66 c 17 f 6 a 200 f a 665 c 7 e f 409 c 97 f 49 a a d f 5 a 55 a d 6 b 0 b e 97 e ' A N D f i l e : s i z e = ' 20864 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P 0 501 L f R m C S T y w A A I B R A A A g A B w A N D k x Y T M 4 Z j U y N j k y Y T g 4 Z j V l O T d h M T E w N 2 M w N m E 5 Z j V V V A k A A 62 Z z W C t m c 1 g d X g L A A E E I Q A A A A Q h A A A A D I V f v a J Q k C d f n z 1 D 2 X V f 3 x k p j 7 c L a k k f h R L P y A g R g y j B P 6 u b F x a v L A Q W A G + 67 U z j 2 j R X 14 P O w 3 l v J R o l 2 g N G X q R D C H H q j e g L m V B X G F j B i p U z G w D p Q 42 r D 4 S K k m L x m 63 + I D 8 + z S a S u o 3 K j b w H x E Y v w K + o C l y T X v p o w / M w Y t X f N 9 K Q z m I F o N p I q V d G A Z N s X E 41 z H Q L 5 B C t 1 K U P c Y p t A W 33 r C a u W I / z G 1 e F I l w g s x i 3 u 1 m F s F 6 W f 4 Q h R O f 8 R o y p 7 X 8 e p I M T 3 c X N h M O G 3 H k y J 8 o E W r R R X X + o I Q n l o O Y t b V W X F 30 L U g U v h m g 45 b i C V z x Y / M 8 m l x 66 l C d r y e 6 h 6 g O 6 p J j W Y y 2 K a i 3 W S s R 1 q s B O 67 I J F Y 7 Z 7 T N a 3 m u n 51 P 1 L e P g n U 8 R S 9 S h Q U q c U X 0 h a R T 8 k 6 P c Z P X B b p 8 p o z 7 a y T u C v f q j g J + / G 3 M E j P F 5 q R L q 3 f O f a 278 v A 8 U z R Z B q W J W Y r j / 7 x h K c Y B 7 I m b H o b T E 33 w o P H 8 / Y c H I s g r N R n O f E F z O v Q I F z y o T O Q 8 I V k Z + K N q O G K t G Q n h x Y F y G 7 j M M i V O b 1 S Q M K K i 6 T i M p 4 A 7 j 2 / q y L D k V w a m G I W j 0 12 t r / y m S r y X R S 2 d l S Q r 8 i s z V 6 t L k h 9 Z e A h a h a F n s 4 k h 4 V c 909 X 6 D / R / w P r 8 Z S 9 K Z D S R e 8 t j x U R 9 t h o M W X K 52 L M Q 32 J K g L p q r Y F o m H e I w 1 Y 8 T r O O 2 J B a 0 S H A H 0 r 14 t k I y 0 55 x V E Q Z 1 t O t Q g Y 9 J v s M 7 + T 7 w F v a D 4 t p G F o A S f 92 e O 3 v O I 7 b r D i Q j Q 24 w k B P Z C r u Z 0 F K j y p E v 71 P O + T 6 y k x C x u V g Q y 2 X K N G l R x y A C 7 X 5 Y J V E d 9 y l A l u S l K T L u Q u 8 B E r r M q E m m v O n e L R r W r x 8 z P o y z U O q p i D C W p H B 7 C b x F 4 w + x W 988 S v x + a G t W s P l 0 9 d Z Y S 3 g / k L t n 14 O M z N L B W j p x P O d Q W K s T r p Y 9 H t Q i c g u y T s s 7 h M v + V 4 t 2 h D z j h H g C A Q g Q 6 o E B K a S p d h 0 L + A i O z T w v p t + f P k R a M Q v v W g M G E m t O m R r w q j N c r w Q E N q f C E F L C U I 8 O U l 4 + j s N k D f 7 p N b e m S e 6 g 79 G e E m l f 85 h J F L g l d 67 p m P 0 0 q c k U i q r 22 w n 1 Z p B R j b p 0 h V 7 D 1 X / Q Q g 8 w 6 V v S T Y Z R 58 B M i 3 r r 7 Y k j s H b w V 0 Z 1 h 6E114 K h g E w L y W 0 / c N q e V 5 V v x l m d l 4 V o Q 3 d g c w G S N B J K t / B U f v r L G s l w F c j H H 1 M / R o / I + N v j w r U z r w i T n z l h h q Z O K W U u U H D y k b b n S H D x M S V f j o G Q 1 T l q F v e U c H d k 6 K M j 4 h w 80 N H O i y S 301 T F k B 2 j t t Z w j l 9 P D a Z E O 50 t l m 4 K j L N 2 t N M E g C T x J W r O 5 f K e d F o D S 7 Q 1 J q Q Y q I P b b h E l d Y S v X r z n w / 0 X Q D t c P a b Z F o R W f v X s s / o 55 a / c O j w x y F A A 5 p D q u b q M U 3 x S R 8 o f f n 5 D S 2 g z 5 h b 8 c / g D Q 4 i V 5 S R 4 P s A E T U e y Q N F A V m i n E f i x G r T D b e F h B b y s c 2 D b 93 q R v O J p x L u k T I T 1 B + X n y H 3 j n R j N W d v C u 8 X h r u x N U A X U k t W a j D M 5 o T + N 2 a I n H Q u w 8 Y g G N 0 C O j r t m A b 5 a v G A i f C p y W n + G 9 N V A A G v F W B L z u Q D u M W n f j H n L G R d A 9 I P z z S j Z N Y F k 5 o + R M q P 4 F 2 f h 7 s C q A r K l i I x h e I 7 w w H r a k p q w U v I T Q J v g r F i d / J H f D q I T 8 F t X S h t 5 X T P N s o C h M u T w b g M v c u H I O l d V 0 1 M 5 w o 4 y T r C 5 f g M l S 0 c p c K q m i 3 t 3 c e k 3 s 2 v P E X K 9 L L + U M R x W 9 Z / u q k N Z D 4 a 99 A T q K 7 S t v h T H K v 7 x h N B + h H l T U G 6 D 5 a r M i x B H w L h r y 1 W A z 0 f d I / L Z U S X 9 k W r + Q Q y V 0 t 5 T X 9 + / e 3 E u 7 D O U z N 6 I I d n 0 Y a s c a X D B 2 q 8 v I g d / B c Q I T 7 L M S 2 n w 8 / B Z c S Z E h 9 G u h m U C Y a / R x f q o T d X K + q o B B o V k 6 T Z / p 3 s 8 Q 28 x 0 I 6 + H K C I / H i 5 L l D 9 z i j m H w e R H + p q k + H F / C g D q G B C 9 b r V I P 9 P O 3 z k J O 6 C p N u 6 d o 6 p d p H m U p / L x H 0 O u 8 j V Z W 747 r t u w 9 z 0 5 H L e i 2 r 9 S M h S y y 4 l M w 2 l 1 z s W P b 6 W P N Z S o y u w T H 2 z j k O D J r 39 L 0 Q B M 1 m d R 5 I u v k Z l C S b H F R 2 S o 9 M W 5 r Z 8 r o O u P P 5 i h U T 9 J 6 N m Q 16 f u M z e Q W V + 9 U W x B F 8 k 2 f e o 5 w R 7 w R 4 p 0 w P p u I L x Y H N p p Y 9 h k 5 m C l e n + l A A C f v M a v C a N 4 g t Q 5 U W y 6 p F s E r r g p H Q P x x + X y P I 1 Z d k Q h Z V k e K K P E w n Z D H L Q n Q n p Q z r u g F d f s K G I H 9 L k f D 6 E V b Q R A J I L o J M q r Y X 0 R 8 X 3 J r 4 t g M e m Q H x L L + T y o q C Z I u J X o G B s f A I s s t S H Y z P V e I q 8 y V F L N J 6 E o i 6 / Q V j m O + 72 S i N D d G / o r D k 7 Z q g I y / T P V G 5 R 4 V Z a C 1 F m K o x k L / z K u S x N e X a 67 s P 9 R s I G T w K i W P Z j J d L + j Q k v y + Y + A X P + m v t Q E J k K q y d n B s S O v B N k a D b e / d k M V 6 m T u m 7 z D O E f D 3 z D F A f W h d S N Z V 1 A 4 W j M v g Z W d J Q T w 0 2 X V 3 d Y P j r k F n w P v 8 V 0 V 3 a Z F Y k p B 4532 + h 7 J r l R r 3 G 2 h 84 o 2 l E e C 3 / T u b J b 1 L 7 i n d i 5 J b v R e L B B 1 Q Q m B b g N y b l 3 j a h w a H a V p Z x Q r Q f l O r Y T M b T j C U N o 6 x / m G S U 8 m r w e R e O / Q / E R P L o N / s w X G N z 9 d 0 977 w B + V P c G p 4 / S v 86 P N p h y 2 P l O x u Y X R 9 Y p m i a s m E I e V s o B O Y 3 U 5 W 7 W Z O I D 8 K Z i C 4 U I 18 K f t 7 K M 5 a 9 l z G E n Z G p S S + S 1 h L 1 l n J u f f H g 7 B f b T L Z t w C / L W j V 7 G m e P J d W 4 b u r 7 j x t O V e r / U T H f H 61 u 6 s c I H i x y 9 m B / X v a Q S d T h E t M g / X f B Q E E Q u c 8 R + v J V P 0 R M L p p Z N i 5 F U O s + 4 T R n a F L b Z n 9 k J k L D z c Y V q W n 0 + C H 7 Q Z P r l U 8 n w i V 7 R n Z 4 U 0 3 J 4 F B Q T 0 Z c e v b e y p q A 3 D F G Y 9 k W A o 9 F + 49 + H j b A o Y w 9 x J y 1 P Y f j V m a g K G r K b r t v 5 g S l f U r y h l J 5 s y X b J y 8 w G 8 t q L / Q a L 9 O c 4 F t 4 C m B t 6 / 0 z c o c 434 / y m Z 7 M H 3 e q s Q 3 / 4 Y M w b U G X G T m q T i r u q K Q s n t v Y y s K X Q 8 D d 7 b x 1 k D 2 G i u V K h w L Q Z T 1 l r 4 W N R X 3 s B b a + I 8 Y c x Z 914 f V O a M T l / X v w f / J v Y N z J A p C 3 Q 1 h x b 2 N c K y + T g 3 n g Y V O a p b B 8 t 6 f O W 8 G x 4 x k h b v q Z s g e L 6 N e + + u P F K Z A M 2 / + G u H 8 t x i 920 u j 9 l 7 t R s k A K r Y L a p 28 p k f Z 0 t E k w a O o R x 1 Z T h m a L o W t H 2 D d 9 T Y c L l C X T g Y B l Q O E L 52 K i R B e X //kKtWT587RctS4ouGgpG6Udqt+ELWafcMEAAsgu533b2fsXUfN2B3SnldLKARHYx0zhm1eXIuJH+4WsrzgMBLK9WjRZJkegxmxepb5IbdbZxKa2TbYgu4maVQGk2rkS8
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--8182373a-9d26-4be4-a029-209b05806b3e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:59.000Z" ,
"modified" : "2021-06-19T07:15:59.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 145e3 c 224e4 e c a f 26 d 4638 e f b 9 d 622 a 7 ' A N D f i l e : h a s h e s . S H A 1 = ' 70 d 5 b 0 b e 6 e d 51e43 c 0 a 19 b 773 c e a d 8793257 b b c 1 ' A N D f i l e : h a s h e s . S H A 256 = ' 9804787 b 31e0025 d d 2 a e 9344 c a 1 b e a e 2e701 c d f 8 f d 77 a 60 f 424295 d c 9280 d c 89 ' A N D f i l e : h a s h e s . S H A 512 = ' f 6 a 45167238 b f f 44410 c 528 f d e a f 417 c b 6 f d 5 a 563 b b 61 f b 6 f e b d 76 a 26 f 427657 f 4 f 93175 c a c 25 a 0 9784029818190645 f b 9 d 40 f 7 c e 781329 a 2 e d a 7 a e 669 f 3 d 822 ' A N D f i l e : h a s h e s . S S D E E P = ' 6144 : + z h R w a G l f 2 o f b R u N P M x J Z W W X R 6 U V U m x T O d b R n v e I k s 9 H R i z W t l J V v : + z L E 3 T R u N P 8 c U 0 U V U C I N W n s 9 Q W / J V v ' A N D f i l e : n a m e = ' 9804787 b 31e0025 d d 2 a e 9344 c a 1 b e a e 2e701 c d f 8 f d 77 a 60 f 424295 d c 9280 d c 89 ' A N D f i l e : s i z e = ' 577968 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A A 601 J P o l C S R t g D A L D R C A A g A B w A M T Q 1 Z T N j M j I 0 Z T R l Y 2 F m M j Z k N D Y z O G V m Y j l k N j I y Y T d V V A k A A 6 + Z z W C v m c 1 g d X g L A A E E I Q A A A A Q h A A A A c P 97 j X K g m + m I W w D g g U t u S n V Q o u B P w 0 r d w 93 / d g k 19 J b C / + o q g b l P o R F g y I X T W 707 X 3 K z u v L B f J v A x S x Q j d S c k Q u q I a S 9 e t P T M C R Q H b x u H o i K 5 W h h c a 3 T F 2 m b w s N U X 7 r b 7 e w E K s A Z f y q g d J O X Q 8 A N u E a V U D o K W b S z 7 c 7 V w 8 I e P v K s r u S m q U f e e 0 / d G Q g T c p P v r E u Q / d a B v Y C H 6 a P J J i 6 V F Y y Q h W L g 27 L / 4 F P n r r f F d b N w 4 V a g B D Y F J 9 q I o F P v / u h 5 z M i R X W 5 M B 0 S o 9 H c X X w G j b 50 i G 6 c 5 H 1 U 2 l q a 3 C e 5 F A a S I T W q E O q U r E a e W j k L 2 G z o e w i A a N 2 d 67 z 5 b T P K c 5 b Z N k M W X d t 7 g m D W w 7 e T t i m N N + s 0 o o n K J y p n p V V c H U S d / t g z E 0 X S U R R k T 3 w H y V L H p k 0 b G l c N V y w 8 G 7 v D L R 7 R d G 4 h B T 9 R S H / b w G U Q C z J p x d P p 8 w S O w L N t x E K u 6 W 0 X i R C / 7 X m / N v 2 R P t i p O A Q N W w / u Z d X n V f l N 3 W M i T P O q 84 / L A Z 8 q o x M p i v o B R B Y p Q 2 i o l e c A p 2 s K o 9 L f T Z Q P j 4 p Q S n E 7 J 8 h Y 5 b b 1 o x U Y u p U Q X a d M G I K B q y r S C q f z h G J 6 b Y K F S R y + K G S q b s 8 G G E D x 1 d s Z d s e C 8 + / p d v Y y T m y J B t w N g A y 2 X s N 82 X W 4 U l v X m L e S H 9 B D I f X M N Q m T E r 1 y I k K 81 R Y g U F h T x I 1 E q 2 w 0 v X 596 z i Z v O S v I / q 9 w F F K Y + V U v s n H R h j Q j m r b u g a H j i b m j v 4 + N B s M t 2 q + 6 b x s X R 0 n i 4 / b R r T j W r z x h e 4 U 5 f e R M k 1 K T C 43 U g 8 F g G I t f 2 s J H b 4 A + d + a 2 C 6 + z Z c r h W a b D D T K + D F U 9 D D E z T H O J g n n u v B a e s V 958 o e d u i Y M L c T k c r m v t 5 R L U j y g a W u w K h 0 z W T m d M 4 f t H 0 o o o p R d x b n S X A B z C i K t d + 0 t 9 a j S n a q g d K 16 A Z v 4 c f a 1 I 0E57 I J w 10 H s N n E 4 B 7 j z / n 3 z R 6 t H z U 1 B S p Y Y B R n w V d g p 7 A b q W K w J R 5 b c x s 5 Y i F J c i L k O R 0 V 3 i K X e G U r l h j m A 0 c 3 i E A r M x 1 E X m 21 X u T a m t D J W N l K / s w h L L S h 2 h 9 D O Z 329 l V p E 2 u p T B O K B 9 W M 7 I L L b E H j i 7 Z m Y h v s A w J j + n l O G s P k m x p f p W N m + u y k F S 2 t B b M b U P f W 5 d L V E o c K 1 s W p E o Z z 98 / m 8 W U 4 v j R u c D p T v / f f r O k y w E u K S q P x u o I T / x Q c U z e c 5 y d 9 C 25 I V F / Q h z V L Y y k n e y 2 U h Y F s 0 h o T 7 f l 4 D n Q N + t O K p 7 / m v x t 861 u e F r K 4 w i i B B j d + Q 3 q c L w h b 6 q G r O G N + X L 1 L N t r n 5 E r 3 K T W q z f o h 0 c S A 6 W S s j h r L w a 9 K q i P 8 P r K s D q W r C D o b z V M 8 M i l 7 n Z p H B K 0 Y X d m Z s w h G B 5 E K I i r T Z f S o e 4 U Q 3 n e q O 3 r 7 A i + v s f M N 5 Q 8 s E P L R Y i c m B I e h A R S q w k G O 0 X i t 4 U b q 1 E E q Q H z o A i Y M r 0 i + I R h + S + / S p 3 v 8 U Q o f H B c 9 x b x 97 E l 6 e N l Y Y A v k n Z O C 3 P P J F b v 46 H D B G S E m / s s J 7 S K W s U l g F 5 f Y w f C t s H U y W L F c I 2 M O Y C O o 1 M d a Y y 2 C p F W i Y i 4 c g q 2 F M a N E y Q 0 X D k 0 z H e o p E G x w W P y + G N p Z r V 3 v o A + t B J f i f E G q 0 U E J i s G Z o p W k 1 n O + U m x 4 s K y V y r g v D k o K M J r K D b E R n H C o v q l t / y s S M o u T x Z q c e v 9 t e E r Y 3 J B l K 5 p J z p + R b q 8 e j 4 d d W s G 54 F R Y R X I p S v A G L / O a q A J s i z L T a h N e D m D O F 9 z 8 O j I 0 Z u + G 7 N e / t e / k / L V r J S U 71 + j T i n d V 5 g 0 m b j l h 8 e x 9 s D H R k 14 w E b E o b n l r A 6 o W C t g c N l j y V 28 R E V I R M z H 1 + D R G Q 3 k y 2 f p y D m V L B a I h K 3 Z m 4 Q T w C o b X m q f D K t F 2 a u O 0 R H g N U n s o u C z K G A M A 5 s t I K 1 d 6 a N R p v t h d q O Q 4 M g 8 R Y 59 V k v l c I y P A X R K Z W R U j c O N q Z / 1 m h 7 m F F E / 3 c r d o 3 S O L U W P y 7 J j i l / 0 d 14 E p + G N t L O B j 0 1 l O n n f z v y t C B V z w 9 w + H D f T i n 50 j x N q A 6 y H E 6 o 6 q T M / 77 W r r Z E w q 91 C c P 1 L A h Q B C W A / k c r / l 3 h T v 15 H x B 4 o Z f D K J 6 v F 2 j A y P s s o L T U V F C G 4 y F Z t A L 86 b / G i i 8 C 4 O N U N V C x d l A e B D q O m i z b i A N 7 P u 4 / u L j L h E M S Z f u 33 C T l y Q n 8 A c 1 M e E h V D p 5327 O O E G e o g H + 8 a l g G G 2 g k / Y V 56 J 9 y E U L 3e7 W 9 o Y 12 x z N m V D c V 8 / d 1 A s G a Z 9 / J V n 6 l Z X + 33 C T c T S T P u Q e l 3 z I E I Z C o 2 V 6 L 3 e S S q Y O v q I l 240 B B M d 7 W e K Z I c F 8 T B 7 w R r X Y a l q E u S Q K / E t W f C q r 0 n n O / V O + A k Z t A W 2 T 5 r h 9 A r F Z g c e x r y V A C n b t 9 x i i N A U n Y k r q m / 7 r a 4 U u e n Y 5 p D C A 0 G I / D I A 69 G j + 6 n l T R p N R o c J v X T D E F C Z g U M x a / E e S B D M U H Q p o v M g g W R m C U 7 I 8 v W Z C 9 + i L J R Q j r k x M s + s N U X z y 4 y 1 f h v f 7 I i S T Q i 2 W S J b W o b f u 4 a j p h y h q o P b r e / r l m F S E K m c A Z + H V a 6 x r V 8 T H s 7 k 4 G W J h m w E q 7 u d Z A z A Z Q d m N 9 K j g Y m i Q A E n G 2 e / i C E + H k v h s f I g d C f 87 y C X k i n r 0 b l W v r a e N b r w R H u L + o 6 E P i E P q S H 3 i p u M C I M Q T g x r U D J R i q p k V z 4 p l T N 3 h R n / M Z z h A t T W 6 Z y 382 x f e 8 u N 3 L m U t a P g N z r I R r w J j R S 2 p V s 4 J Z s X H e v + 7 E F / + T I i 9 P N C U G l D v y o o p k I u y c 0 R + e N n Y e R 8 z V O K o a Q b O N L w z 4 G z 0 b u Z q P 0 y 6 Q + o B W b o + F Q f Q 9 c v i 0 m W b l 6 Q Q / r V 5 U d l + f + H a L 6 l A 2 u Z 2 D G Y X 4 S R 8 y X A j p f P U 7 V Q j B U I s 2 U s 1 + 8 w v s k 6 J 900 R i K o b W K Z X b n w U L W 5 E g S H N t U M M S t S I W 4 U s 2 i T q i 9 N E x J 0 3 T o y Y J 3 u X o t y o C i Q F i D V Q s p M Y c M 3 a J o Y U 68 W f I f r x 5 G o 7 T T P Q x / s S I + u w j H M u i w m W 8 l z z N a x h 9 r B a z D x Q c S A P 9 r z P Z K U F w J w Z X h e s b y a D 446 b G Y F V M Y o d j D 6 s 2 q 47 M C c u I R x e k d x L c X 8 Q j N + C R 7 y H K z o f S i E m K V 2 I p s E r k p e v M E n L a Q p R C O K / E E G A t t G 5 G I l 77 L j s g l l c G 8 B l n / T E U v E + D p x R Z s Z 182 n g E H B d J A e q v x R R u x 6 / H q E m K d j a Y f x m / Y N R j b x M 5 l b k 1 U k f N B O F 93 Y O V Q P X 8 m a j z S w e c W I E D 7 y Z n Z W 36 O 6 w k 3 o W B 4 h g u a l x T l R / o 7 K C Y C i 3 P l F s 8 E G L X U + j s D k 3 E s 1 L k d M h y + B I 79 D T k f U i W j c m 4 M r I P 3 D j C y o K l b i R I 4 b G Q f 1 l b o Z o k 73 p + / Q 9 / Q e G 9 C / g S k w H k Y r x s 1 t g 6 n 42 K c 7 f 8 q O + c o Y b 8 u e w r n A 9 D B s l L O f q K e R h l C B w w b i m w K h M d 7 x S x N + n 3 I I M 0 L J j r
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:15:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--67c2f5e9-cb76-4e8a-b758-f5b944e1cebf" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:00.000Z" ,
"modified" : "2021-06-19T07:16:00.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 0e2 d 4679 f 68796e9 d d 0 d 663137 c b 9e12 ' A N D f i l e : h a s h e s . S H A 1 = ' 7 c b 3 e a 53660 d b c 1 b 4 f e 12e0 c 0 3 c 7 b f e a 0 a 3 c 92 a 2 ' A N D f i l e : h a s h e s . S H A 256 = ' 8249e9 c 0 a c 0 840 a 36 d 9 a 5 b 9 f f 3e217198 a 2 f 533159 a c d 4 b f 3 d 9 b 0 132 c c 0 79870 ' A N D f i l e : h a s h e s . S H A 512 = ' d 6 d 72172408 f 4 e a e 8 d c 6 d 7453 f 3e1 d 6878 a 45 e d a 1 f e d e 6417 a 188 f 776142 b 10 f a 3 d 3 c f 5727e66 f 6 d e c a e 2 d d 25 b b c c 3 f 1 d 4 f c 337 c c f 0 39 c a f c b 47 b 4 b 704285 c a 2 ' A N D f i l e : h a s h e s . S S D E E P = ' 768 : 2 W e t Q R P O Q a n i q k p Y 0 O 5 w 8 d B x m T 9 y 2 / j S P y y i h N f V A B b / J : 2 W X O Q w i 6 w E B x m T 33 U / J ' A N D f i l e : n a m e = ' 8249e9 c 0 a c 0 840 a 36 d 9 a 5 b 9 f f 3e217198 a 2 f 533159 a c d 4 b f 3 d 9 b 0 132 c c 0 79870 ' A N D f i l e : s i z e = ' 50560 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A A 601 I G X A k e T V s A A I D F A A A g A B w A M G U y Z D Q 2 N z l m N j g 3 O T Z l O W R k M G Q 2 N j M x M z d j Y j l l M T J V V A k A A 7 C Z z W C w m c 1 g d X g L A A E E I Q A A A A Q h A A A A 6 g X g 6 w T h 5 x W 8 m R j 8 w n L f p V 3 d S c a + 1 F Z w H d 1 M Q C m p Y N 2 R 7 b r f f G o 4 q x y g K R f f B J U 1 K B G B T o M Z f a 90 m E e 0 Z E e b Y J D L B S H D 3 Y B X H Z Z M 8 T T J h a h j C u D z j l U 7 z B L 1 r y A z 9 R k 7 o I R E a C 9 b D 1 j a c V g v T Y Q G O R 9 g / i 93 T S L V E o T f 5 w a v l i X w v O m 8 h e C P U l 1 / U i J Z M 63 b w C v c / l y S W S V M A M D T Q t X g 29 W p J i E 3 / 0 F W v o s w I Q M L B t 5 j a + K x U G 4 e T 2 m K 5 h z x c b u l 13 p o 8 r j J y Y 5 c 8 t L Q h z S q p C b t f c E r g z u 48 J c t / l 7 T e i 0 K z 19 Z M b n w 9 Y u v j W T x q J h P v o a v O / 2 h D L m r m b D b A i b D 6 + s / m l k y P v 9 i u W s s L T n Z C D 6 m Q N l m V h n 6 p l i n x T D 4 j B 5 B 0 v O E + J N m L n x n i w H b + K U Y a b I f H W 8 P + L 33 U h z D z z 4 S 7 d 66 J 4 x S + D o 4 d J U j u I K y d K O 3 R z K 2 w i H f X R J C I Z X V s F P c s K e F C v n P a t F u 8 X f C 6 Y M L 2 c W / V R f 2 x 0 9 j + S o 0 L 6 X Y 9 N l I l s 4 i 7 d F u x g l a A b t D 2 H G t F Y r w g d H 0 Y q i I 572 V s o r t p N G f e X c 7 z f z M E x M d a e / r b W p Y p R / y o m 9 X y B 2 / p d r A m T H L n z y v 6 c 0 1E8 + Y I F s a K D v X 9 j O 1 T l G p h r Q B I 6 I S X x H 93 t u D z q z k F K c F p v N l s 23 r p 4 + K v 9 x 8 K 30 q D Z k o S Q T X q m b V K s R D r 1 + s / 2 c r L t n R p 5 V r G 8 p k S b Q G q i e Y x 68 n p r j f L c G C u R N a O N a 3 H k E V p p L 6 A 3 V n K m H M H y U a C T Q j G j R n b J D e J w A w Z 1 W f I l d L S / B A 8 T b s Z G l g e k x R q J H T 0 G Q R M C / a 1 D 9 F N 1 D S z W n 95 q 7 I S 7 e c L W 4 z r p x 57 w / z c 7 f Z r v I 2 l B b C 0 M A p 5 E W o + n z f / u L 2 t U B 8 f n r D U p I x 8 k q D 7 a 0 u 0 h 8 I E G m J a 33 U a + 5 l f 5 Q C r A x p f P N d t k H J D n Z o N Z f n W k V g c / l w s v s Z + 8 H s o 1 j 8 K J S W f g 6 b + Y 3 D T W Y U A 687 q 4 U 0 M X F Q N u 6 r c C W n z e O s U O u 7 o H 6 A 0 z 7 m C q 62 T h e Z 4 O B i 4 Y e 0 I 0 W p b v S 0 1 N s W Q j 5 X t s r U F F X + y Z B G O D Z m O w 7 X K q a + R F a N k D a 1 T L i O M K J C 694 b m M I Q G t i e u i l m r 4 X c P m V J E b 8 z X W C U i / A f r c G g b 6 k G a 8 B A 3 q x v Z 8 o 1 u u X X F z a a h s C u a j F m X x e S N 7 A 74 i k X b 5 R l D p 62 X 0 f 8 F G Q t 0 49 w g X o W q S 3 t e E f k l Z b W y I C h I N H l + x 8 i n j O 2 p Z p 1 L b Y d 6 A / X q l Z + d s b J i u M E 3 a N X R / a S l Z 5 L E a + m F F b d + x V o F e Z o n q 2 u q w z g 1 C 6 J C / l P Z 1 c d E o W 3 k t 9 q q D 5 k T o m H G O Q c R b a N V S 1 i G A 8 O n Q i P 7 K E K 867 M 7 r h s d J E v X h G k O h 3 I j W T H f C p 6 S x r h s l 0 w 2 o l 9 J / 5 p M U W X A M X P 2 m g f S G + d T H J g l G L D 3 b O v g 5 F u o B W 7 I Z B i D o P O g v 7 J i t b g j D Q E d t r T K N k y r U B i 4 Q u B E 9 Z 4 o w H H y N I v s x X U X t s d a u z a P + K h r k T W j 6 q B 6 i i d r k w N G f X m X c C t O X k 1 L J c w 4 P s A B 4 V T Y P 9 P S a 9 U 4 t C G 0 / c C 4 + k 9 B 86 o k m Q C h f 7 s q S L H B B d w + 9 F 2 z 6 u o i L Q a d X J 1 K 6 q B L s I 2 S g 8 X B U R M j t T l L B v C z j + G D 0 8 v v m 1 I F M 8 Y g r l / u y R C o X d n k j L t 3 N r r G 6 B S + 0 O 9 W Y y 1 D O M e q N 1 p J p P J v z Y s E S 5 o k Q u t S Y M r 7 z U y x 5 f c B R L S B C 0 y 1 w l v E d 81 F E E b G j c U a 4 q k a D b V A x m P C U M r N g k f a B 7 T U r N c i F b 8 u 52 l l U b u e 3 g y Q a P w k k a F / 4 d r 55 d w H n H X d r g i A D U n S r q j g y v p w 7 G O 52 w f 8 + P 5 i l F f J B s j 6 L q / M u N K Z L C h j o B b / u k B q 1 G 6 o 8 v 1 j D 1 u H Q i 4 M x 34 z G l + B x L L e c X 5 y N H / A 3 N d Y B C M 1 / z i h M C E C 7 J l g a C M b d k d 204 Q o M r W 4 A L c u F P F s X v J H 3 y d y 5 n 8 o 9 V R F v 1 t m c 9 y a y 15 h 6 c 1 L S o 45 F 6 p a 3 e P 8 O c B z 8 V p r I f 0 b r r e q e Q H V c 5 O 5 j R o X m B 1 s 5 O U A h R Y A + 8 y 0 17 y v Y m T 0 c 6 D m w 0 r H 9 k + G y C G l i / A W 8 w h b C G s I C H Q 9 w I l 1 l 1 a q i h C 1 x o Q E g W Q x 3 k v R / 6 L + K f L Y 7 d R e l 9 J d E Q u N z c v 0 s H B z m z J N U 4 + N G Y w / M n l k X l W Q / D 9 T z f U R G 9 U q L l z + C l o K / N k 9 q B C B Q G G w n n 9 k A n i U G N L 7 y h P M F + b C q 8 f m B F E P w q 1 q 6 h A 0 y B d 6 z N o Q 2 l c j y n o b g 5 n M Q U I A Y h x b O L 3 G T y u F P 34 / W K B b k u P 9 p o O q o N G 9 O k k V / 1 r p m e f L Q e A U G t 1 o Q J g M x S H N H u v X g U g A m P 5 e W q g m m B t D y I M 7 e i q o 6 o J M e / G v 6 T k G Q 227 h j d x O J d n g n x 6 E f O f k m X x x t A k p U e H R B O v 5 a L 67 l O s C a S 5 P A r v 0 M k N s u m 8 I E / 0 S t a D u e / p 8 P w h U M 0 h B z 8 Y d U q L i Y q 3 F F A p o E 2 / l m H 2 N G Q a c Q l f b c u a k W G z j r B E h / 2 v / J q t v U 5 y 7 m 7 Y Z / q 3 s I d H H t s f o q b 8 m Q 0 V A k 7 N w 3 K J Y c V / v f N Y B E 6 Q o n 0 F 26 w x Y g P o p b L c i g 9 P n u 3 B j M m e o 4226 w Q B v U k f L W T 6 l O + C w p 4 g + w U D P t x h S h w B E g O B p S Q M B S n 9 x u y B v p i l B J 8 c 36 V D B A / 2 h N X c 4 i T L G E + + W h w s H j J j e q z 5 Z y x i S 7 w V h 6 H W x L Q b P J d b 43 U B Y c v T Z 0 p h e u / o + o Z N R u b A P e 58 a v c q s 3 E q m 84 o a x S o T + G m v 3 s U y M L X z P i P + R 7 P m l p 6 k c g E T 4 C t y l k H 7 Z 42 U a Z c C x d P V v T 2 Y F C b y T q W 9 u D 5 F Z W G I / n y e A 0 j Z 6 j M K k V c K i K B u 8 n c c Z 7 N r t w L n 4 x z N Z R + m F V Y 4 h D o D A G H J Q x u C M B R h x T S z K 1 N a P y F e C v q U 2 / E n X I v B g v q x V + Z 4 K S G N y 4 k 2 h f a w 98 C T 0 H X P t S E V 3 Q c t D I m B 53 z 3 F b 5 m Q o k S 9 x g B q c G 2 k Y R d i W j Z v G I M v P g a / e O I M n d q 9 b D q b 4 v j S E 6 m Z Q Y M F y P f I 0 A n f / J A h d w Z 4 S d G r A K m I 1 s c / Q F I 2 I p a 8 P B 97 Z 1 r n V B b F 6 A r u 1 l I 0 5 j b O 6 S z N 0 v + Z 7 F P 0 K F X f I 60 u 9 i e K / K L h n I t T E m L D e S D 9 y d e a e 52 M n z x l F H u q w P X d g l i K l P 8 d 3 W J o n g u G T G b e j a e c M s 4 Y 1 s T t O w U 4 / r B Q 92 D I U F + i C 7 i 75 a g 1 S H 1 m 2 L V u b Z w x i D n w G q c o N r J N P u 4 b O q l f s 2 P h v X U t E 5 A 0 o P W T 1 Y r Q d 7 F f u 8 J N V B q 923 k / M K N E y i k n v H c m Y S H s x f X H h l E I a J l e 1 J C R D I x y 4 Y s 8 F z C / v q r g U G 8 p 2 E X t q k / v m Q a m w l d S w u H S t 9 B 4 m 0 I 49 T 2 w 7 H k 6 r l / V x / l u z F + n A V H B b D r E A E W S l q y r X 5 P r d O C s n o S Y r R k 5 a t E 1 h S 2 F f i x p F g k R B O Z i C m B l Q C 6 / p K U h P Z 3 p e o b V R i f 1 Q a i Q v C 5 o O 8 M 12 j n g + X 49 Q / p
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:16:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4c53521f-ba6a-4919-a7f5-1a486177bce3" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:02.000Z" ,
"modified" : "2021-06-19T07:16:02.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 5 b f 9 f 601188 a 4 b 11 a 8 b a f 9 b 2 a b b d 18 f a ' A N D f i l e : h a s h e s . S H A 1 = ' 125 e a 0 78 b c 3 c c 79 b 34 b e c 8141391 a c a f 2 d 69 f f e 2 ' A N D f i l e : h a s h e s . S H A 256 = ' 6 c 856 c 3 c 315 c 0 f 213684045 d a 3203692 c 0 7 c 3 d a 5 d f 755155 f d 8 b 128 f b 447 c 437 ' A N D f i l e : h a s h e s . S H A 512 = ' 98 a 53163 b f 8 f a 255 a 82931829e2 e 79 f c c 8 d d 73 a 0 b 5 a d f e e c 0 510 a 20 d 2 b 188 c 27 e c f 519131465489 a 4 e b 1 d f 46 a e d 6 a 6289e560 c 740 d 4705297 b 1 a 0 8 a 549 c f 0 c 53 ' A N D f i l e : h a s h e s . S S D E E P = ' 12288 : E 3 y o M a y F r Z 6 j 7 C N W Y E 3 E Y 3 y W G n J m F 92 U O 3 J r 7 v 3 t 306 z G o 6 A N T 7 o c : //aUQ3EiEUF92UO3JrxnGuTUc' AND file:name = '6c856c3c315c0f213684045da3203692c07c3da5df755155fd8b128fb447c437' AND file:size = '612032' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAE601JzNB1kCx4FAMBWCQAgABwANWJmOWY2MDExODhhNGIxMWE4YmFmOWIyYWJiZDE4ZmFVVAkAA7KZzWCymc1gdXgLAAEEIQAAAAQhAAAAqw3qSYC6VmxazIR5EYMtlCKqnZ4bL6M4j2L+YBtdzcU7gutu7lWlr/Ywz2ywT/peWd4x8VCjfojIo35cu8SUGQaqtbKtBQ/d3t+ni+AZPimMfcQl+nqhenQ712+++RCws7SqJK4aWqWFyqgVEBNjz6owgewV7pEw7rtf9C+DJeRuDtArTj8gn+3Sw0Jvx0py+z7rDf6kZ69wExTsF8zR+XMOMJSUKBNhT+29Rj5lcHRYd09UrS43JCZP31A0mnbPckZ2pkdUz6uvaRWpLObNDchFloR0Ny005mV+NtVhf8xvwUBFpBDcF7l3Nke80eGakVjsGMX+uWLOs9nBoI4hYfHJXoet3d+MreQGudEUaB+qhjkbhCVG1KWjXIYZs6gP/YpMDTCgqmky5PlniK1Z14nvW52fB7qb4Cf66XmC+4koo5B8D1rfP4ren9UHdu60gKNfiFOWa5BrA7H92l0LlAeTJUktn3yQKf7dj8B/hbqrnbkdyTIlDzWP8Ik08wBe9C4zSKHTw29yyvrFXtMAPq15lR1tq/wgVl26DSg3gM8gpZDu5y3A+Ur+upTHf7nJyHN8dK+vbDrphnzvCxUp1DD2gUOi3IGRjTDpWTQstx0tTbkPqhTyLQcTmn7CBvHa6f7jUBc2xSvFEViwrWKz4CIirLjZpJT6OojSnwEtcwQGPBHCTIKfWKhucCbh4aNuPdJ+DlRCRFo1oL67pUhJ/Sa7ibmCR+PIHFKZYO4EQK3PBFmiABGrr4wjRwPybWo1cZqPMIXyVVmjtIA+wNhOW4Sj34nC56tvGleAxQ9gRdmHBHpW+KiPdpdBVGqdyo2dosWJzzzQzh+mSCLqnHpJ29BYv1a+oGB4z0NNzlSryuUyi8HPp6Yf6DvsERqpI5sF5O4tMSYfUuJyanV4idnBNH0R+6ZxTfw2nVTD3PBkrQ1N0p8JuKHf7pdJb9Y+VEkXgWf7GHB9WtpXZqwt2uzsMHB6GP+mFS2zx8mBbuiPDuKsxoPjh0ZQxg2sXbhGxznAkzuX87MiIXHYtR+xQMei0ejvx7jmCKDxg8v0R7pFptaGgNC+6Hom1pfDM2SPGB9Lg8ThtijqiY3FfGm2UizrPHJvjULatE8AIBsRrUi4iR3yf1CIbzmgXMp3O3VXx0S97v8GsWgGVbTiaYgH+6Lsqh9j5NXwJGqUWdh6WbTQQ6kECWJafB372ZGGOBfM1Wolp6lHrZVGretSYyFxCIZ02uPLhnZryiw5NlgqOa+cbUsSsw49EEIcDjhPguz8sBfz+FEL0wYdQxehyjKdgm0mgjWjg0VQgNT0CIdLvS5l/wrDlyp7eLa0NqExDVzexCgkRFMd5vSk+nB1YkwVsh8ubFgFt5BEq/wHl+Dt6VFumaGALRcC4ES1HWug8ktT2/SPBlwbrgNlsIe4g/2zVu4Itaw6gH7Lr4W+XGJ5Z2hj3s08N1zKz7nGGmjKdurErckY4JZOx/Y2X14ZmJYENd0D3uk5NW9abNorkZDQmAu5C0AsrI+38sTa7d0YxE795Pu9mFs9IsYDmtrWjWSgmfX9BZnFSctodyYl+pFhItW+LyEjvtcFCKiLuXAH/Zx68r5Q2+7p1JDHQpwGk0cKhyuphxNFACs3aMPkt8PXAFV751aOqeG3hpGdruS5fU8XyJGefiL0ASt1/2CZur38wj2SmIjy6+2kq1eflfqDpACNKq3S5RF+Piftf+a1DvWUZNxv2nUzmjBkvIIZk/lyLsBp8M3pfy/wVDI5JQOKhzZzYc9K43goUC24+WMasxq0xiuCmpOzh+wrP+HNYGnPDA9fsA1zUcOHRGDDalK1vVP0+CcnWS3tUVwijVQVK8kMLYuqWhIs7z7n4zCa02Z60TkTVLvQ7EwMd7Zg3SlOkLlXffytQBcqk5e82hrCzy9lD1pC9OdAi3nPe7oOf80abD1vbfo2nSBbpX7jShxczNu/kdYV0p9xNOgKhjOZqSzkeSGUAUJhLr0wiClMniquh197h5+yXgnIvu14nKy8MBSSZOfl5myYHAXNzFPCehwqcsOH/t3RcGwUizZsqxA6v3WknEFrrWmPYW+q9LznbuugT8Wo49MFwF92gXmCsoNq71Iqi+IzQ60cUARXfa5WrVysg9tq0Ev12qV388dLdubENzOofohR22Yv7Ggi8cFyWO0RLiwpPRtjps9xFjE59kTCISl3pY0/u4sgD0e335hHc56JyNpWVSH+iw1mjfr0uxk/R0xCI7xNygAcoCecPUPTNcMPEEq/AuRxcXBjzt4tiCBpi4r6FgGnmaBWCDFwhsHH/H8TJa7+l9WbLcZ3FHxptWtfT4dJsh3Ei7WXAl0QjsTqqsTFHx5eSYoW2XzGZkXCmrTrHmXuAPrxgu3AYb1rZmvtGYRDTC0tAUAhKRxYD+J1dKMys0SRZlI9cmIX0mL/bLgl2F9nVGEZgKg1W6roQASIJ+2YH0UZFrfmMd+RFnJXiy2JY6esUenRaIVQhBH4OgQIp5v5tvzajzGXAvQAzVhk2svPOZDAZDUUKO7JyZ5ibdtEpxm3IwgEwY2ey00u3Lu5GMHxYGkWSIKJJZTMIbMdJ3ufHYLGdruYyEu8kFdkgxMXEKeYGEiCIEIMqwwu2S9xxxj35wtWk8AsCv3EpJc18mP2hVcOuB81/Zs55U+ehGg9qT38cgWEFXmFD62HWCSeZJ1tWcqJM66E2XsAXemtmybTLBXJfVUyjHnjtCJRpiIZCR9UNqvdZ90BYozxi5EswlPpBp0IXtSWuVmHqL8r+CpcbsfJQFeo88nSycKRVzSrsC6Oyjr92gTjtoaY1z2G4tOZl3gUy6f7JPWvB9prlHQ42mFLLfCgptip+cUD1tmP5oqGKkBjssrmAsfBmIF65cKUFUNKGqsQi//FhiMzpAYcrrN5aDHp/inUHb4znuiDJJV5wpiEELNh0rzviEumjpKrngJGKucFYIDr+Yk2bnE0GEm0Uk+lqqa14/gEvEEmxn7X9rHg3Dnv78qFSd/NF/7vpaB3oyDCTozr78tHkA0xe99SyS8ExdAIRfWR8KXmdEplF0qV8jc2vIgPqzs0ZkJrOAjx78U2LlSQDXPt+KKRUcqlnXBHEIhlExVeZ0zvRfPgkShW+BSjl1l0Edw1HtlisDRFWu/5P3W5dofHSlb8Tj72OUHfNSxeu9qHo5ElgI7pTktgoss4emjCtM/k0w9Nh/OUme/n0m7cA6VbP9NJhh7LJZou+ppesMDYu86RpeQK+mrGy6QK4lYdvZXQZW2k2rGHfp05fFQVywl80daH1LJa3oQr7YJPSlVvQh/8lBvnizxW0IYWH
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:16:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--110ba31a-bcfb-4b6d-b365-3bea15e6bc6f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:03.000Z" ,
"modified" : "2021-06-19T07:16:03.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 83720e64 a a 1388 d 55324 a 22536 b d 39 c d ' A N D f i l e : h a s h e s . S H A 1 = ' 8 f a 3636 a 7697 f 953 d 7 d a a 0 2 a 313981 b 9e3 b c 98e4 ' A N D f i l e : h a s h e s . S H A 256 = ' 659e0 d 1 b 2405 c a d f a 560 f e 648 c b f 6866720 d d 40 b b 6 f 4081 d 3 d c e 2 d f f e 20595 d 9 ' A N D f i l e : h a s h e s . S H A 512 = ' 0 a b 402911 c d e f c e b 9 a 6 a d e 0 b 968 b 10 c 628 f e d 6 d a 17097 b 8 c d 943 f 76527078 a 597425 c 8 d 0 845 b b 86 f 0 318 e e 1967 d d 3 f 43 a a 951 f 822 b 79933 d a 475 e b 1 a c e 70922 d ' A N D f i l e : h a s h e s . S S D E E P = ' 192 : V 0 6 w X I N a G 3 G O / p / g q E Q 3 U C p 3 s y X O Y W m v m K I 7 H : V n N t / 1 g G 3 H p 3 T o U j I 7 ' A N D f i l e : n a m e = ' 659e0 d 1 b 2405 c a d f a 560 f e 648 c b f 6866720 d d 40 b b 6 f 4081 d 3 d c e 2 d f f e 20595 d 9 ' A N D f i l e : s i z e = ' 9728 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A I 601 I 26 o j m E B A A A A A m A A A g A B w A O D M 3 M j B l N j R h Y T E z O D h k N T U z M j R h M j I 1 M z Z i Z D M 5 Y 2 R V V A k A A 7 O Z z W C z m c 1 g d X g L A A E E I Q A A A A Q h A A A A X 9 H w c C z O M j d H O A h X c A X 0 g E R 62 J l K J o G U J D + Y B w X l a r X I T e L / 8 G H U t + 5 J m d F W W I I b W 4 J Y i f 3 D / I S t n U 1 h / t R p N n c 8 i G H I E G 2 / I 2 f G q 9 a 1 W r z d k P s 4 g Y J 1 C x 4 A z 3 K 2 z M 8 z o 3 A y i g K X 2 e S w 0 O F 6 h y n m 42 t x p K 6 F t X f 2 B 5 Y b e m / i v L R F w 9 J S M F R b Y D G + m l J K h P J u B o 6 I a b Q a q M F H A 4 j J Z T p 0 s V m 6 m i 5 O E T f J 5 f A 3 R i 6 B i T j I t h G + O x K F s M m P X Q T W c y P q r N R t g L y N A d s E o k x E s z 4 Q F a 3 + w / w A L 6 J x 0 P 6 T x r v 9 I 5 J F c / k E M R c W n v F 6 i + 6 P v 2 A l l 9 + a J 9 i N H C Y N + 315 X 40 m 8 y y + d f z / k x s e 9 L J g 15 + J L M w Q V 2 Q i 7 B k Z 7 U W t N 3 X + 5 s p w O w K 52 o u R D m c p H s T R W r s U e e 1 r M C K i k 0 m G I Q U m 7 j A 9 c y P + d k i 8 + g o O M 7 F v + k 9 W a I 9 H G z x 4 t R h W L a w Q u h L J 3 j B K 0 w Q O Y / b h w J n U V 5 A j g Y D U U + p w R F F v e L 0 / A / x R E y d Q g W K y y / t y Y i 76 B q 0 j 6 s H F x e n 6 j 1 T L / h z l z A D t 2 T S v e I Y z y L 4 C 9 m / V A l 0 N 6 + y 5 l d H I P d 3 R 5 d E M G / N r P Y e 6 A i + + l 3 u 3 A o 7 U Y G K 3E5 g v / A W U B U + / P p s t T D M A d 316 S H h 0 Q 6 C 5 U s y j D q w C Y + I x 249 P b I W R f i I 62 a W v C q 5 O 0 O 7 h q n K U Z V Q x Z X t Z j e 5 y y 5 U p x S r 0 t 4 A + Q C Y 0 j s E 67 U j 9 Q k S g q s C l K A c K 0 K j y 879 s O g l L a Z 2 Z w T R l + h I F 150 j o D Z K y I X n V x s d H h 6 / E q Q V a j I 6 R m W w Q f q a Q K o U o W k + G 7 Y 2 f 7 v f z h O f U i h 2 s 1 + i y g Y Y h Y i a 0 x A I R c w c w V V w Z h o 1 a s / p o o s Q C p v n p 7 G T j 2 o B H x 9 + + 31 N Y o j 2 U 5 l u k 8 g m G R s a r X H U 2 Z h N M + I v a 0 d h q E L h u r S 4 f V Y M o m T L 97 P U c 8 z q 0 J S w L A 3 x w b V E s 4 J Q m V 7 O e E r 4 B m / A a y 851 B W E I C q + 6 c 1 I d e D n h s V V m + o L 2 Y f M j N W s K p d j j 8 D V A H y w d b y D O q s X + 6 P x / H 9 X y N 9 z V O o k n g c k 3 g l h j t n G q 35 V e t V C 81 E M 6 o A G v l g p X m U k v 5 v 8 V E j y x s 8 m q T O o s 0 49 D + 4 + R 8 x N v s L L M 9 X 68 a G X p j Q f 4 u M J o c S P j k + h V Q S Q y h U X d E t j b 8 S I i y H Z 2 X k x u W O B L B K o f s e q c G V 7 i h S 3 J t A / s t v Q y 20 Z T q N I X o i 6 D m M T f 4 Y u a p Q K p L O G a d u s A C r D r i e 0 C O S a e a z D n J y l 7 a 23 + 8 o s X b S 2 n 7 B L F l Z w m q 1 K p a o N i g I y H 9 M / Q Q T X q 4 d P Y n 3 D u / 4 K / v k 2 o Z z d b K P S w Q Y r g T R N m o s 0 0 c Q V I U Q j P 8 f Z B t U F 8 n 8 E Y u C s N m 0 q 36 X 6 H 4 j f S G b E f d j b 5 N Q B 7 + P 7 / Y 1 A S 5 L r i H l h y S R J f 1 t o K d a 34 v l g a 41 b l v w t B j G b 3 y W k A l G 9 / f h M A S d P Y B X i P R v t b a x L T 85 n w O o W P m F y s v s P S p 8 w N + N 4 v j x Y X q 0 N H G Y M S B D j t o p I d P y G w J W k D S V U + r U r D K c l z K u H k 8 A W B g 2 J / W j d p n e P 4 Z J b y 5 e v p l s X N b K z q v K 2 W s n k V / t 7 x j 1E1 G u Q Y f e Y Y s O K K S n X M a 1 H W c / + S 466 D + L C P 9 m j 2 s y f q q M 3 q 3 Y 0 q C B U d k D j c q I 1963 N F b R y O c b m v y 0 J C m L v e k Q b F 9 q 0 s i + Q 6 z L X 3 z h 16 X v 5 C J p C R H a X + 4 b 5 b F 2 G 17 c c h m k 0 a z f o S N f 7 M A x 4 R t H y L 2 C C b F T f U 8 l i H M 2 T 2 a F + a y x 3 v f M k J 1 N + u Q 4 M d o I t I m 4 f A c d s l C 1 y U P H N r 79 D n 0 8 L v u d T O F M c n h U s R + K o p H Q t D H v R 1 R i e a O P s 5 R L 27 R K + j A n / p s Z z o I P o E t K s q q 6 K W Z W 3 F m o T g F t c 5 L P p V r 90 y V H 0 t d w D a q u g R / a u D D E L 6 r g u 5 j B / A + b B N i f r f 6 A Y 5 H m j N w E C + 8 J j p Q Y u q z I r r x s u 0 6 p K 5 Y F K q v / 9 f T Y 4 o g I A Q e J 1 S v 1 H d 0 S M c I 7 V G h F w u 9 j J Q 7 E K y p s U 1167 I 8 Z i P C d Z f T g s l k q t 5 m s I E i H Z I 7 i J E e f m P Y 5 x s c o x X K C F 2 w u N d b I t W r i N y X 5 x 8 L w 2 X m X 78 M v s V w T 7 X y W F z n c 4 k s t 0 c 9 r 710 n 0 a F M w 2 + o 9 F f s K L A L l W G q 3 n I 9 q 68 F w w F 6 G k F G f d w o p l q h v f i X x q A N b 9 F o Y 493 / v R h A r 92 I g V j 7 a M a H k 7 Q l O H v u A Q o g g 3 e F C E b 4 m F 24 U W R t o n C k n V 9 M b g 8 C d s n L V b a W Y b 4 K J L B Y W y H q i Q 8 + 73 O Q G L t b p v c 9 p I n I q v + X L U t Z z 5 n d Z 5 e k O v j R 7 b p O U Z s G R I b z x d A a Z s M Y 4 j 8 I r Y 3 L g r 9 L F I J 4 u Q w T Y / p G o d s E w j t F K 7 p z X G e U Q e X p h S K g j q n j Z I G O z 6 u p / i O 1 Z v d D h a B o X z r + I i D D D C P C S f k P l 2 L K w B 6 n j u J O w R C L d W A T x G X h g m h M 5 a s u o E x 6 f y E 13 Y t e x D i 5 c D i Z M 12 B p c / z s S Z t X X A z v d N F G c B N B h 55 K t t c E K v K 1 D Y 91 m 8 y 8 C C M t Y s O V P 5 W 7 p 9 + A B p r v r + D o + S c q 5 D k l x B + r R b m U F u K T R 442 U O P M l E k S d 8 C Y s 3 L u O g L x e U 2 + + 1 A O / O 8 E i a X p Z I C b h d n 0 6 s a 7 C 7 Y J Y 7 U j z 9 d c v b W q B a z m 1 D z D g W 6 r 1 X 0 3 Y M s j n C L W 3 F n e R z S v o d 7 F t 60 m w C z Q v j n z u m g f I F G 5 W d 70 V 8 Y K B n p a 9 d T N 0 k j u u 715 g K t j C s V 2 a x n j L Q v Z k Z k L L v 2 o t c t z Q q a E I N D h F + E g H l p J U t f e L P S s 1 x w b K 1 k W B q W q L h o v m x 2 A B O J I e B C g N C R Y b o c t 3 C v I 2 Y 7 F F A Y I 5 A b w l w l x 2 Y a / Z y k G f c l E x r D 1 Y 63 s / E Q 0 / e g c L 6 e Z + x y y B d 2 N b B l 1 o 4 s K L n t R q Y X 5 z w n p + u g b S V F C c U g E P x 9 Q E 3 l z 6 p i f 2 L x X Y K O T G j 7 u d T S R Y a r h J m u y O v o D P 5 a w x / r N a 4 d y X n F B z S 9 h Y x g P S Q l C 2 f o B M D c u j h J I x m 3E6 S E 2 y 7 v B u S W o g k q Y H 8 e o W A j 1 d y r J 2 z X h F u V X m 2 O l I e u 3 e L N m B o x l t m b M y c 1 x j 1 b E w T U p 8 X u j l Y 4 y D z T 3 A 8 A s K E b r Q J 4 t J u Y l a 8 j J w y y D 0 M F 1 m X h E g v s K B I u H O O / 7 k z L t F 96 I H 9 Z 1 L s W s S A n 7 f s A K Y F I P U Z L H 3 C C 8 z K 8 r F r j i b O o x 1 M + l y l P + L F / 8 u X L F L G J 0 m z F g s S i b Y u 8 b + f D k r b 2 A L q r 2 I 3 L P v 5 m D G 5 f 1 m q O B k t l D g M W V 7 s u J C k S o 48 K H E l k L 0 T E J 7 e V X 6 I I I s 1 / + O c 5 Q d n 4 C / 999 X F V / L H e 7 x G O k B w M n h a l 5 Y g C U b S k 2 Y q q x 7 U X y y 9 i f O t l m K N p p 4 L k D E 3 B b l 839 m 4 D U J L X k C z K V O e l Q p v h V 2 m W r q W X O v / i z i 5 E z W Q c t l i v J i S D q w p D s W l C z T g 1 p O u G x P L d + 9 s T P Y U D R 1 Q T A + J 5 a m Q s 7 i 8 x G m g u D b a P 485 O f 3 r h A 8 e v N J y 0 C j W g O r p f M p G 8 V 9 x Q K k e S M J s v
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:16:03Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--28b4a43e-ed8b-435a-9e3b-d7fb6b69ebd7" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:04.000Z" ,
"modified" : "2021-06-19T07:16:04.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 0 b d 3 b 9 f 55 a 2 d 3 a 13 f 506 d 9 d 8 b 970e0 d e ' A N D f i l e : h a s h e s . S H A 1 = ' f 0 23177 a c a 17 f 6 d c 90 f d d 9588240 c b 16 c 70 a 9 f e 2 ' A N D f i l e : h a s h e s . S H A 256 = ' 63 d 61549030 f c f 46 f f 1 d c 138122580 b 4364 f 0 f e 99e6 b 0 68 b c 6 a 3 d 6903656 a f f 0 ' A N D f i l e : h a s h e s . S H A 512 = ' 3 c c 2 d 527725 a 7 c 5 d 5 a d d 412 b 6145 a 141 a 3368388 d 9957864 b 308886 b a 6 a d 376 b 552 e b e a 6272e4291581 e c c d 0 a 6 b c 71 b e d d 9813 c 28983 d d b 2 f 3 a 31e06 e 607 a 8e5 ' A N D f i l e : h a s h e s . S S D E E P = ' 768 : o 1 Z q C Q K y 8 I Y d f W i U e l R 36 i h R 6 n m R Y s O S H j S / O P N i 7 H b B : o N y q + 4 l R X 6 I H O S y O V i 77 ' A N D f i l e : n a m e = ' 63 d 61549030 f c f 46 f f 1 d c 138122580 b 4364 f 0 f e 99e6 b 0 68 b c 6 a 3 d 6903656 a f f 0 ' A N D f i l e : s i z e = ' 57248 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A I 601 L k R G A 69 G Y A A K D f A A A g A B w A M G J k M 2 I 5 Z j U 1 Y T J k M 2 E x M 2 Y 1 M D Z k O W Q 4 Y j k 3 M G U w Z G V V V A k A A 7 S Z z W C 0 m c 1 g d X g L A A E E I Q A A A A Q h A A A A h w / f m + g d 8 Y K / P 32 M g k 2 i r D i J w 72 w 1 O Z w d s p S U b + 6 I 3 e H 6 H Y g 79820 Q n 1 E L Y 8 I t Q + m T t K f O 7 G p A 0 T a C Y p 0 o / 6 M Z 1 x v p M d t y x 19 P X N C F Q b D 1 E j J U Q 3 t r e 8 f y 1 T M k n 7 + R C L k a 1 J V n j U M V E i a I J I m H x C O N x f I i b 5 p 7 N 9 + + l x B v 0 L K u k 0 P 3 K z i o w H V S n S w f 1 T h c m 7 X 3 Z l n V r u D p G Y H V v T s Y D L r w 0 N 4 o C b R m T j 1 G 6 S 7 m a m o v V l t u L u R 808 I K 1 k G 7 R x Z Z u f e q Q y 8 s B 7 x Y a n A q B u B y H F E 8 n U l i m A q M k N V R q j Z 9 Z R s o D g c k u Q H k 68 Q 9 J c h W X H 4 h G y F q i f 15 e r g Z G 1 N N a K Z U R s p G E S u R / H B g O w Q h B n z Q B W 6 v h E U K I / 90 v r N L R l I H g U 9 t i w K C S e o O Q 33 K d I + t o i I Q n u I i A 3 N r K l D I m q u 7 N U X 6 d M V G C h g x W U F y h y L e R 2 U A 4 s V z J o w v s a L V 2 k v H 0 n c 8 q v s E Y / 5 v I w v h 2 o A Q X P 4 B u H / K S g + K 1 i n k / e + N H v b 0 N r L 1 c a Y q u 3 S x 9 p Z g b w r o c s Y Q j O a p S m / W J L r K B a Z R 9 R b I 8 Z e 9 s 15 P + g O 6 e N V Y h H S P g Z V s R 4 K Z Z D x D B 9 o V n x y D u O 1 Y r 7 b u 0 n z H z I 93 P 1 T M 6 Y w b P 78 S d b Q D u 2 T j u I p t n G b 9 X S 7 G Y u j 6 w 20 o v z p J q 501 K b A 6 a d v y s S o 8 o K i T 3 a 9 B R D I u n x T x b D p + Z g v 5 S 5 N P 2 V + / p 42 y o p 8 S i u 2 p D i H e A Y l E I x + D B f z 7 v U S 1 E g 4 g 7 c c y e t 2 o b 3 h m r S k I m H Y A A d 42 B r 7 w l b M d 4 v v 4 a x P m i c O D e l o T h V f Q k n B 38 y 610 q w d I X R 0 g N f U E D B + 99 b e v a M Z 2 b U 2 h j h c S 2 j 8 a d Y E / k G H F X m 8e4 i U L t 16 A a 37 o q F J P 6 Y D K 0 5 t U L r H r N S P x z X X J c V y Y y i d F i f 65e5 E + P X k X q 9 O 9 C C n b 35 z + h t / L W u G I M + l e t j 2 W C I N x D + f T O B z z N 0 w I u Y O 4 Z W 0 t 8 G N x J K w E Z J 87 G s y w i J G H 6 q l M R d f G F N B x t l G S H m f O I F 4 D D C f 0 g C b 88 b c s 2 T j h o v O v A a Q u a M M 2 r H p 9 o y G / k H M D K D C 3 z m n K 7 G Q n c F a P l 3 X j / 12 g V d g l A M j p z f o v h v J 6 c W I W h X A y 9 W v 0 W j h i 6 p O 1 y F c q v Q / O D G E c W + L I a g m V O U R J m e f 0 + n 4 n 8 j E i v O 9 n K c M r a 59 i H p J 0 C V X l 43 W S J c S K S N K b o Z s A T 5 g j Q + H l k 5 A a i b y R 93 E C e n 4 a j S c N H k W 8 k a 4 i s 2 i 9 h R / O Y c m k V o A Z 2 n K i 5 G E z q R 3 Y M e J 9 P V o G u 0 8 B X 8 K z p n a B 1 D I n J J s i T V z 88 d W 1 x x U g L o 2 f Y F o S k B 2 y G t 7207 i q c l k y V 9 d d e j G v H L n u 8 a p l e P A a R C / g F c b f X P l z s t g 1 B 0 N p W n V + g O g f O W K v i r / P Q U e d 1 u S r y S 9 + L T b Z z H I w e E + O Y y D G W S H g 3 C 8 v f q Z R y n K Y K C r N u C Q 6 E y E m l 8 f y r / T L D F X y s 5 c j v + M v 8 + f 1 H e R V c d N U 4 K w z Q h 6 W S A x j m Y B z b C V P o C T e I I s Y j + b P w D g v y D o C d z / F / D B v F Z y m l + B N 5 K n v L J C o 0 z I F e W n z s x Z P O N K l K i t Q H 9 S Y 9 E i Z P N y + p g D L s X Q o S 3 S d x u O Q H C I z O J U n o Q 9 f 0 n j S R 9 I 54 Y u 8 b v f g k 28 b k i Q d V O e N u E Z K B 5 / Q c z P 4 H T D + w 76 Q W 8 P 8 H 3 b k d P l 16 d W W + o L P w 2 X S V 3 d 3 u t I 1 E Z J E S X Q v q 6 x B P f J V 0 o 8 c D m H P B i y t j 5 c d 3 L j Y 9 Q B H F E 6 S 4 s u 5 K A 3 d f C P N k v G m F 3 O c f U M j E l u f O 9 + Y B 8 h p 6 C r c H a M 76 s 2 u v f G G N V N 8 i z A X 3 y d + n 2 q W G h i 0 e U c K R n n B 8 l v J n n c H 3 k Z n I 3 y U 7 B 7 / q 8E3 T L q P B B J G O g N 9 r 2 H 3 b e G b 9 m f 4 L T 6 Q q E 7 m 5 b l w T x v 8 T H w 6 z G x t D T p O Q m G l d 3 H X L f z P + A i L d a e 5 p + q J q Q d k i Q i K M s b t R R W n o 0 g m I j V h X z b G u Q y J Y m M l M X K Q X A Q Q 1 z C P F z Z y E O g Y Q f F d M a L 9 x T O Q Y A t a R r d d g U 13 q W q T z k O c 3 / f a i 6 p X G k k / 6 E V S w d W 1 p Y n S k k t V 5 r S d P Y p d j s m o O B r M 8 D p K A Z t V O E G o T p q g I 2 o 4 G V A 6 S l l 9 m K W Z R i 87 W x + 2 U Y z Z W D C W o 6 p t J K X 1 T y Q + e L q X 3 a T i y 6 e G Z q H X 30 H 21 v N t t O 4 R Y A N C 2 V D / o N 5 c g 1 o 3 / N U 8 l 4 O N 5 c g p x H D a E 3 R y 8 v V L T g j s B 2 J v w r V h k A K V J l M D 6 k 0 j O / a P R 53 A f Q X V X / a m a 866 y E M 7 e F U w / t O w A v o w J Z X a F M b 1 n L K v o 6 s p a 4 a F q q 652 J h R N 0 u u E t H D X + p 5 m q t i 1 Z s v C s H D M k w R p d x Q 9 E a l B N G o V X n i Q 8 r 5 I s l 20 n q 4 A + d x d j r E C X o c h X H C P V X B W q n y h c L 8 j 0 9 F W 3 Z E W O o 7 t 7 P x x g o U 0 D l S J 2 V j + m 4 i Z V N t 5 P H K E o T / T M + q J l W h B l N P g m S / t Z i N T J A n b V p U 75 K x 68 w 5 o W 45 / 55 M I b S W / t E 2 b j F 4 L / 2 C W U 3 t Q 4 Y 0 n w z y d t A N U 4 J W L M 3 y + i y I D x z H k Y v X L S W q v 8 F w 1 H e m o x S b F x C r C j H u i Q + W O a M / r Z y E L A B A f i g D 7 V D Q l t u + 2 T m L n f + m Q h w B I B G 69 z i j D F c q Z a P c B G p v b b 9 S m r m G g v 3 Z 3 K N v x L / m T e 6 g k N b 6 l G W A 3 c T L 319 F H E 0 6 h N 8 a z e j h k g Z a S R t q v y r F 8 M 4 C A A 4 v k X R u M J 6 c 3 d I h S I I s P / H 1 / Q M e z 4 S s 7 F 44 p 3 Q Z 26 M Z C j P i v 1 K 9 S 1 U s T F c e n C w q W 7 L Q P X k l I B g q 4 / P 26 j M 2 c y u R 7 t p 9 L 0 x H S D 3 + b P d L o E p 393 e X y M N Z 3 n i m v B a o c T L B 3 W 2 z Q S d D H 5 L i T r p q z q D x b + Y P a G 6 d b Z f e t U 3 L 1 t w m M q W d E W Q 2 q S b t f a X C r J K l / y e E 77 M H I h T r S W R L c q 2 v B G s l Y r t a b v c 5 b U a p 5 e z d O p g m l t 1 Z I d d L Q a 5 V J a T J n 22 K t 9 c d q t 6 v k h N b U Z V O z A 7 R 7 L B 4 Y I T D K g Z o U G s T v n D k p O M W P V D b Y k u P E k 274 l K 4 u 1 b 16 f u g 2 i n d y o 33 c 3 g 80 T s u r U A g g 6 u 5 l R / T S l Y s f J a c p Y x V D r 9 j v B M 1 U 7 w v n 83 I N N z 7 M E u M M N M m p d 5 Z 4 r V n J 5 p y M L 8 g B + G i t x l N R J w W g 30 b L t B m / A 8 k l E T S 3 t w B G 0 t Y U 7 I O 3 d 5 x C M Y q f f 0 Z J r L E 6 k w 6 z K i 64 B r 5 g P y 4 + Z 1 d I V 9 I i 25 l b j n f 0 7 J G t a m q h x 2 j P 5 n X 1 E w 1 Q s M d d e L f J m K u B 5 g q + h c z w x p v 7 s 80 h B O r L Q H l f g u G Y 8 e B + U M A e w o 6 O A s t K 0 Z U g t 6 d K q s p q A T 29 f H o 4 H O s 2 B F H + q 7 K G i F I 3 Z h x P P j r W N 5 D I q 469 C n 5 k I H D K Z g / K C n X O n J n g I L I L G p D 9 A Y 2 p d A m C s I d P u H J R C / s E N r e l 20 o I M Z v O f f / P y B a r a 15 + c M d e P 0 8 x N a M v j d m V 4 q F b 8 N u K a o Y d B h O v Z L q o I 0 F 5 L N d z t C j c 46 R n n m H z W Y k G s t
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:16:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--7d7df2f7-091a-44b2-a91b-4ea03d806a22" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:05.000Z" ,
"modified" : "2021-06-19T07:16:05.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' f d 969 b 0 3 b 439284 f f 7 a 31 c 39 c d 336 f 25 ' A N D f i l e : h a s h e s . S H A 1 = ' 6 a 8 c 0 0 b 703 a 5 d 6 b 8 c 82878628978 d b 9 b f 282 d 6 a e ' A N D f i l e : h a s h e s . S H A 256 = ' 4 a 229 a b 274e364 d f 92 c c 46 e c b c 9 f a a b 32 f 7 b 0 955 d a b 982658313 f 2 f a f 9410863 ' A N D f i l e : h a s h e s . S H A 512 = ' 3 b d 433 a 6488 c 0 284 c 3 a 1 a b 22 a 8 d d f d 60 f 433488e216 d 6323 c 9658 f d 4 a f f 61 c 5 a b c c 6 b 728 f b 13 f e 218436 f 60 a c b 2 b 311 c a d 7 c f 0 29 a b f f 5 f 589 c 143 c 9193643 f 90 ' A N D f i l e : h a s h e s . S S D E E P = ' 96 : w l n X D 23 C m 0 I S h l U r C W H V w s M M e j 2 T Q u 20 p 0 5 Z P U c N V G 7 l E q h Z R i 2 w o t 6 x M v a z l s : w l j 3 I O U B V I u Q u e 567 l v h Z T H t d c l s ' A N D f i l e : n a m e = ' 4 a 229 a b 274e364 d f 92 c c 46 e c b c 9 f a a b 32 f 7 b 0 955 d a b 982658313 f 2 f a f 9410863 ' A N D f i l e : s i z e = ' 6144 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A M 601 I q v y Q K G h Q A A A A Y A A A g A B w A Z m Q 5 N j l i M D N i N D M 5 M j g 0 Z m Y 3 Y T M x Y z M 5 Y 2 Q z M z Z m M j V V V A k A A 7 W Z z W C 1 m c 1 g d X g L A A E E I Q A A A A Q h A A A A N Q / n 57 h Q B h P 8 R H w m o H n L U G 3 c J J J e M v l k P N + c B F m I l L G f b M W G N T r 2 E B u y u / 14 W k 9 O P r c z C T k L I p v q 9 K 90 R K H v E 9 f Y d M R h A J x p A y c i I w C v u E 0 i R z E W O o X J u 5 n B s 1 d 9 W e A f j a s X W a j J / v A G Y F I R 23 Q c T U N f K 0 2 K S q D N E 417 N X w u z m D R i k i N e t n r d 4 u v K A d X L g S X Z T c F T / B T w G q + m p I I c x L 9 M Y y d i C 6 L N L I i D D V I K + 4 + C A r 9 S Q x n m 3 W s P x 2 q m p m z J H a K H H x a o M Y A x M Z + t 7 N d j G V 2 S x q p + d o + F H + A O h v V V Z n M C 2 g K z 3 U + + X e N 833 v f s c p P T 9 s M t B O l R 284 R F 63 y J i u 2 q v C Z f y V 5 q P h J i F q + 8 y 3 K w o g 60e3 u K D C s Z S s M 7 u o u s 7 h 9 C q L Q V T E J n T Q c x k v a P v K 1 S P 3 T s c 2 F 7 U Z 0 d j A t T 4 a + y o s m 7 c 5 F i A c q Y P W z M Z S G Q D h z p X P b G G M 4 H p P K W E H v m C S x 7 c P q D 189 o + s W i i q / M L q b v 3 a q r z 3 x f U T z P S + 7 D z A 1 j m T 3 n s B x m G X R y h j 76 x 86 u 3 E v o 87 r U l 3 v j 3 q 4 E f u 5 I b N K y 0 r I T Q l t h t C I u 0 j 7 O v T u b 28 S S J S 6 L r h t E D 2 w Q B b I I V H q W V s M t I D M G 1 R P m 3 I Z d B 9 a 9 g L J P b H C w 93 O 658 C N 8 r l 4 G O / j C D i C Q s L 3 y G V P B J a a e 81 r Z f + / s H S I / s Q 2 o 3 U 3 h d M Y R E O l d 70 w x g W H B D c 2 Y m n Y 0 b E S W + f O 22 x 6 b O E 9 b M C 3 G 2 K o N Q O 4 D m i Q j U H Q c n 5 m 7 H f M 1 W J O x s 1 E k X H m + r n Y V K I / Q t r G m U M / 4 / H T m c o 3 P 63 U f k M a I s s 5 l x + b r 5 S + T e 0 X x q k u M x T O S A S W 6 / g u y 5 + T G M T t 4 F 6 m E V s l z o s 6 Z F 6 Y 0 a Y Y P P 3 o w p l i U N n / A V 1 G 2 y s h m H 9 l 3 F x U F C L B Q w W A u P n 9 P X 0 1 D N 2 N o n 7911 N u p + 0 N t j m 1 t / s + w X S A 6 H H j L q v o t X 0 s O K e m u N x m Y l p s d y h M Z x W I o l t 8 f 8 h b Z p + 6 A d 0 5 Z 2 C 0 k 1 L 1 e a W A C 7 O N r o 6 z M f D 2 e Z F S S g j V S M d D k K H D 0 G k 5 q O b r i i r S R n e E 0 Z l U P Y E l 4 / P 7 + l L s d 5 A G o J s m 3 S 3 r 217 u n s q e W 6 X A 8 A E d H j C Z z n W N 4 W k N t S e l c P i 4 L z 8 M G I h b t 7 c B 9e4 z 5 M 5 J 8 t 92 o T I G W 9 Y X 338 H Q L I 5 + D 21 q M z S m H X f K a 9 x T + v f 0 c K 5 t Z L e O c C f r F z I m M l E R R m U Z 8 w L a S J K u 101 Z y s g n N j 4 M Q s l w 6 R 10 S r X L 4 m 9 w y P E L r w D x E k 1 G F x 3 u L v b W v 4 G I W 1 g x K s q H e S / I t X 672 S J + U 7 d O d b f i L 6 W g A y Q 8 o L L o T l Z Q K k i R 4 q R H w / M / B U t S m I G M s Z L 4 K R S p n K r T 5 Z q H O A C U Z / 6 H 2 D / P w 8 t u c U U i z k D 4 N P j 6 U w V x 7 M 3 A 5 Q e l D v a a Z r M N K 6 N X 4 A O 8 e S v / h 8 u h s 0 U g W 5 H l a A Z Y c h K 6 r o I l h 1 M F 2 O L L Q 4 Z t u t 9 k K g g K y s H P u F W K S r / n F H H 3 s S n A p T 0 2 b Y R s Y J J h h 9 g 9 L V 8 a / k z C 1 l D 4 H c + s i w D P u Y I 7 h T b i M l j i O E U H I S T K Q / V z S e h U 0 t b D F 4 Y 5 G F A 9 Y z J q K J U l q A j M k D r / a P I s c Z J e s s M G / o b K m g d D X T R + K K d d a 41 I / z d L S D g J h y 9 P V s M 0 k f P L i a m o E p v M 0 m O I 4 X 0 6 F 63659 o y 2 o N C X m 9 J 5 U G 7 N n d U p s X P f 6 V e z b 6 N 1 n 9 l j 5 V h t O N G q 4 k t G w w B 6 q / d g Y I U / b i 9 z g v + L k e + P A i T 6 k z b 7 H t q l l 6 + / x f 0 Y i 8 i e B / O L K F T l r 2 g V f 3 a 0 f w f u x O G e h 0 w 9 c r K h i p x W 4 o c Y j 68 f l y X 19 t + F B L P U / S t N R T 9 + E W O 9 u j P T y 72 D r r i n O K c q W n q W o 7 M i B l L H o 2 d a e s f y 0 I i k S 9 H Q a v / C r l v U e B / 1 / Z 2 B Z r c i S 6 C R O W M e W a l 0 3 z 8 u O g r 2 D T F / t Q f j 2 V c 1 q Q M i f c 1 l I z c a I w A a T Q P 8 G s R E J V 4 V E L i b e X R V p E A E R 5 d j n C t W G 84 U f 98 S 5 K c W d P i T v 2 c + E 7 C v M e S 1 a 16 y e 9 B F i Q p 4 U q C 69 j I Z c P z b w T P Z j 9 n C 2 Q p T Y K l w V R r 7 M s W A 9 k g M X t H / m a e c v K s q a I a S t f n 2 N U M 56 F 5 J R 7 Y j b V Q t m E k Z T r m m k I p A t 0 b w Q w w v I h j 4 v G 2 v w U Y T P 5 S J M J w u Y H W v / q E D p T S w D 0 j P W o F / P E z y f E b A K X + W N v S X J + H F i T M J W X 8 Q k v O N o v G m o 8 V r w b 6 g U e a l K k f r s 4 O 1 T S P J l w n O D 1 N E L z E D J k X s 7 F p 1 B / y k / K w B r s + C v k 5 r K 9 i i g w + T / k r x J h X J f j Z i / a D p L 0 1 p G + z L M j Y Q 73 + K L C c M u U k c d N V o P K H r z 3 a s 2 m j 8 a s k K M 2 r 4 a 3 X 1 S I 3 e K P 31 f 1 l U 7 c u / y 7 l 9 Q P Y q v M 9 C F s e p 3 m W M L Z F S p V f b c j N v u v W 9 q d Q d E h 1 S w 928 O d u T O o q A Y c / 3 / C N B r h 0 s Q k u g g J c c S 9 m e 6 b + O W o u M C t m B h D X T 7 Q r 2 B p i m y x K + L O U 2 W u h 5 G I 3 a s 5 c Y r K B L E X 0 W x m g p r W G N Q N 5 K h V j 5 O e T Z H q f x B 9 j M Z S n l a I N t Y R i i J y o r S a b v L Y h u / 61 N h N 7 b U p 5 o e F m K e K Z P R 9 o Z n M I b q M p m 6 h h 6 b V G Z n c h J G f C y t w K H w w Y e T 3 f H Y q h 2 D R A b x H / 171 Z o 0 R 9 N / J F h C B F F 7 y J u s r O i U 9 V F b / I f M Z + 17160 C A Z E / Y 1 p P K C U n 1 g T g u M f 5 A G / b d c x L V p K R N B C F i e r o 0 k Z j u S / Y e Y A n P O H w n 9 v o + q Q r x / i K u W 1693 / w Q X E y Y 3 U K y c x w E q K 6 V / H z p O Y k A i O R x k O M l P S A c Y 62E3 U 9 + B 9 G w T w F 1 D g 5 j Q f X v Z C L k w 2 V b G 0 1 m M i 6 I x l r Y P l M 0 0 B 9 b U 1 b 9 l 8 n W N H T a E C 9 x O W D z r P N I 8 L W A S 9 O c u / T 2 X M 5e4 t y n Q D w M b g o P z 3 X h e N m 7 U y Z o 64 F + E R t V + I K L y A q y g G G h C 6 L p f y v L 20 / W 2 D A b Z c O z Z 7 s M I u s I b p W W x S W w 71 P P O v k u G n P 4 N I c l 527 h 56 d s p n + 1 / 96 f 73 J E a X 77 d T H W V D B D 4 f p b w t 36 y N p 4 h x D 2 i l K N U 9 Q a t m z 3 X 2 H e 341 f 32 + Q n q l j n 2 D u r x 9 K 4 k v e w v X c S v Q c n N X Q q X t K i / l l P B 8 A J y 8 b h m d P N D Y 97 n w v 4 C k y s 3 y B o D K 4 Y E 2 y t 6 m k o 4 / 6E8 g b o a N Z r B p A 5 m 3 U U + F h y O G U f i p T V z g Y J f b W U y 1 l x R 2 D q y W l o C R v 2 P S v r D d K w z O S X 5 C 5 C W C z C 94 p w x q X E K / g J z K E 4 V b 30 T b U p L + E G I v 6 i 21 u C U P P K n d I d y Z C X m I 7 Y L 7 d f i V T 98 J S k I d Y a R I o 8 / 1 e S f 8 N n I 9 N q 5 j x C l q 7 f L x h 2 f a Y B r m n I v Q j X 2 D Z l O j m s 9 H 84 N z G R P 9 + / D u 8 u C 2 W 2 m S T 4 / P 1 I R T F U q i x T z w b z 3 k M b Y E G T p X t s E z s M a Z f / Q L C 1 u B x K W b D / W Y o o a 8 m h 30 X R 1 B u z 3 K I / s J i S O v D r C S r / M W
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:16:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a770c83e-0eb5-4442-aa3a-19a38f0f94ad" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:06.000Z" ,
"modified" : "2021-06-19T07:16:06.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 8 a 66 c c f 9261 a 0 c c 0 8 a 6 a d 0 85 d 6 d d 4055 ' A N D f i l e : h a s h e s . S H A 1 = ' 8 b 860 c 5 d 34254290769 d 40 d 703625 f 774 c 213e00 ' A N D f i l e : h a s h e s . S H A 256 = ' 0 4e88 b 7717 a a d c 6 b 56 d f a 0 0 6 b 9414 f c 2 c 899 c 398 d 7e003627770 e 0 7 f e d 52 e d f d ' A N D f i l e : h a s h e s . S H A 512 = ' 0 79 f 55 f 2633 f 86640351 a 658067 c b 8 b 0 8 b 308 a 1997 a 2e6698 d 18 d 61 b 16 b 715 a c 55 f 721 e a 0 b d 8 d c e 61 a c 0 e b c 4513 e b 32 b 0 a 989 a a b 258 a b c b 818897 b 6 c 0e78 c 464 ' A N D f i l e : h a s h e s . S S D E E P = ' 192 : 9 K t e J 3 c a G 3 G O / p f Q m H O 3 T i 3 p H e U z D B + v W K 4 : 9 v c N t / R Q W O 3 T i 3 p + U z D Q r 4 ' A N D f i l e : n a m e = ' 0 4e88 b 7717 a a d c 6 b 56 d f a 0 0 6 b 9414 f c 2 c 899 c 398 d 7e003627770 e 0 7 f e d 52 e d f d ' A N D f i l e : s i z e = ' 8704 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A M 601 J 1 N s a 0 d g 4 A A A A i A A A g A B w A O G E 2 N m N j Z j k y N j F h M G N j M D h h N m F k M D g 1 Z D Z k Z D Q w N T V V V A k A A 7 a Z z W C 2 m c 1 g d X g L A A E E I Q A A A A Q h A A A A + 1 n Y m K M C / X o E J Q v E b K R w p 31 y 5 b y v + I n 3 F I G + W d u s w J k d + n m L K c i l v z c I s m J p H 4 B 5 g g 4 B 0 c V 5 k p 6 K R n 4 R + E R A p 5 X I h P K t G P + 8 t R L O G J U g 6 q 3 T d + O B 78 S F P F j h X F R v N 1 h W 2 q H G 0 e L i d L Z d c G X c K R D u S a h Z / T V w X 0 H J S K v t Q i S E U T u o Z 3 n r v 2 f T / r C P a j J s P y m R 4 a V f b p / h L q I G c I H 3 s t K Z r / G 64 B M A H L x H e d h Q Y N l P M 5 z J u Y / a d A a W V G h K 7 a 0 V b V D v I a W S Q E T y N I l Y I q z t 8 f C V r U s c n r q y H t T 8 U b o a G 7 H R S y + z V g z s F b 5 M 65 m Z / l B q U 2 R O P x A f f j Q / T h A l p l G 8 Q y + J 2 E Q B 3 B g R A b 4 P l j A d x Y O 1 N y S l t L X P t c x K Z a q 0 j o a D E 65 m q 3 r p p M x 6 M m g e Y y j i d W x P r + a p e X i N S s 7 I e 6 d b e a x n H L i 7 B M U S D M p g g P 1 s q q A Q s L g r t q z R G m G R f Y 8 c 4e8 T q K W o + H m C e O l b K X r h M f u i E D l D n H F E t G C T 15 l z R b D g 3 p 4 m c e k W G s b 3 H b 5 R b e H / v i E M G U R M + s a F w 6 K D Q J j 0 U H K k B V w n B k N z 74 W p i l Z B 5 c 5 d 6 B + R 5 v o I K v d H A I c 4 u n F a b g w 5 D o O w v v 7 m t S O o E M y T 7 W s b x B h X g W f N u I P r 6 r F i J c k 0 K D z p r b P g 9 q H C T 5 C o t m 5 c V r w c P M Z H z 2 K S G b + Q L H g 55 W e O / V Z C y g 0 I + N V / K w N j T 42 t g v W h e U 0 8 p Q E 41 I m O a Z R S Z I 96 m 40 U j y m g 5 v e u d a h J i 9 M / C 7 J q 3 + n X w s c O Q U c k t S k m 6 X / y B F A j m l Y x K N F z c 0 r 8 H B y H 6 g 6 d M e s t z b h k S z g Y A P Q r A W l g 1 Q K K 7 V k y n 9 J K V Q k e E v U y X w y 0 0 W O a i B B m k D e T F k R P 9 X Q Z Q m i i F w T R 5 N Z q Z R k 81 w M d X Q 7 k 4 z B A B R y s L R C w X m 9 d d n o Y F b i e v X e j V C f S o 1 P G f i F L E W W r N N 1 n Q a H R W I 9 Q Y g Q 8 P L W w I o 5 R Q y 61 r L I D s J Y o 7 o f + H C v r B t t s v p L L L 2 v 2 O t T 5 u P C 0 k Y k 7 x D k f U 5 a n b r Z w 7 v h A M h n z O x w R L L E j 8 / 0 p 52 m h Q E W i 3 + L c R N 3 k X 0 d X S p I z H j H J z d c 3 W d M k q s f b C a W O V 4 o 3 y J K D i 4 q 9 A D a j x c i / 53 H + f b q Q r 0 u K c O S N d l u Y V F g l D A + m i 5 M m f z m H e L O O V 9 K 0 g N A 74 + u L 0 R n A S D h + c M T R A 18 j p t h / X b f N F j Q C c w J y L 21 P C s 14 r K X a f v m 2 B f Y y l F 5 L S f 97 R D 31 J m / H K b a j s + s H O R v H h z 1 N W C Y g D / F 2 e K 0 P m l p U F K v L O 4 H J m U 5 G x S T n D U V M 5 c N U e U H c z 28 a V f l Z 9 c r 1 j N C b m g z w B E q Q X t 9 y T C p I m A H 9 w + U b O P 7 w m v 5 I 35 Q M h n 5 r W 6 A k i 5 r M + o P Y s r / m w S e m m y t V S 0 7 M 5 i Y 3 s k t h U u m N G 8 Z V o D b p a u r R z x 7 l X 8 v F u G b p U a L L a 3 H G w W 75 / 2 o j 9 S R f e Z i m X b v B m Y q B J q J C I 7 V 1 I + s D F g S b T p N N V E U g e w A o q u X W b J x o j 2 K F t o n / c 5 V n y 8 + y s 9 a M G u Q p z u + i z / 26 o m t B O K q K W P K t 1 V Y z P A g j E B 8 n s 0 w U 4 d b 6 e i 7 a t I M 7 I d C / 56 l X H d q m D 5 p d K M R a g z t C e + H Z 4 F z Y 7 W / S 2 i 37 X h E s 7 G j X 1 W 7 X 55 n c h h i n E 2 x o E 0 N J m I X 0 y y 1 G 8 e O L b T U U w B M i I f H 77 E s J e x 1 N 9 s O d n 6 k Z 3 A Y 8 M 3 u F A l + v X 25 J D G T Q a 8 c k a 3 q N i + n A O A L E i 4 B a l 7 b W 4 n 6 k 6 K V 7 u h v e P g X s M I 3 B p 1 O P d 9 m x 394 P B a / 3 l I U v o 5 e Q q J t + W W 4 A v v 9 N c a x + 3 S O M M p V V 4 a L b M 86 c p D M T 1 N P P 43377 g p X a / i G V A 8 J u g i i G Y Q 6 L u p 1 S J R n o r B t Q K h d w t t q / P j + P J J 4 R h S q g G 12 O k 60 j G g F i i n e W B g j 0 h c T D + G G b n I y e 6 m s B s Y c y + J J r p 8 U r E w 6 A E Y N 2 C H h F M s f y I G c E s a o b t n B P D 6 v u R J K Q w U t f 0 n 0 T 6 Y L 5 V 3 t G d x 77 T B L c O s B a B e E S f W P k t v i h C t 5 w w i i m b 4 a Q u 1 m 4 i 3 N 3 i Z X F R l L a T l Q z + f E 5 M o m C E i H 1 k V R H 74 e h V M L 9 P G d / b j i T b L P v n o 223 B C 39 G + A k s 7 g i P B W s v f 0 E y A l U P V L v 9 n 6 G w w s 59 q l I S f 27 P p K h Z S G 2 q O g g 3 k w S u Z U x T r C l V k M w U G 3 D 254 / k u I 9 F A M f a A j W L R n f 8 c O 3 M 9 o i h i 4 M o j B f W I M / k J Z F W M 98 P H 1 / P Q w w 5 + O y e U V p v I Z v T Z M c g D H r a V 1 a P P f A C f H v D m n z b W A z 6 h v i d X p t X e f z g f i P e 4 s m x 6 F 1 I T 4 f 7 G W 8 q 71 N E N o 2 v 73 u U + 2 F t W J J k 6 T c z W R U R 8 a R 2 V Q Y Q T 1 r 5 H K o p d 5 Q p + H 0 1 c v 95 Y z t t 4 h l / M L 3 i H t z c B Y 7 g o u R 75 L 0 q 12 Y A G L s a n x a L a G L E a U Y F c r b O S S g 2 E L e k 7 x 5 / A O J + c b u C F 5 g B 0 e t R L o M S k v J L T u Y M h C F p M X 60 m 9 C u v U Z M B C L L C h P K V v d p A i 5 a e F o / 5 f A D q + g i a 4 P O / U B 71 E w O V V D d N w 2 x J 5 b N o a T G K i z F U T L J s G e s m y R B v m V g 6 q H N 9 G P V j m z F u P J 478 s v f S b V 4 K g A S k J o z w b c Y 2 C o t Q q E q o 8 I q E O t T S w L f o w V W 8 x 6 T 1 d 7 O e R O / 24 k F I r E X M X 3 N / 0 W 6 r T G T 96 b Q v p 5 c 5 Y 7 x V I y 7 s s u L Q b L L 9 v y D j B b 5 N f j j d e i b 3 M z 2 F S b O v h K V z w q x Q g D J a 719 i y R l Y W x H Z x d 9 n F 3 K y x 95 w 6 O q s A 0 X A a e i C 6 W D F C V h n z I R d E G B O c q m S h 6 v x 1 R J g Y Z T 6 D h / v k k F 0 I e w J w U h n P Y K E U u a n 4 W n G j 9 E Y S t U z X i Y E r 82 y U 0 H J n V p F I 0 X B c / R K F G 4 l I t l w W 2 W y D s D o g J R N f l / y c b E E u U c 7 + h w x Q X x N n 9 o f m H x C W c 6 a 5 k 1 D P q 16 U 8 e T d b X E r H 0 o k V A R o L C L P R V i m c R 26 t S X y / 2 G 2 J t X M V 0 Z R H g z l P Y v x d E 5 B b S 20 U O 8 q / x + J 3422 m C g A G x D G u V d x Y R f C 0 5 M j r 6 A Q H M K Y s 1 P 6 m R P M U U r i o A u c n e K T x 69 K T t S y X x 4 W a 1 U A Y c K v M Q Q l C 73 S 6 p y W K 4 g P 9 g Y Z z 535 k f G y I S W i L 2 r c / O Y n j K l q G S x 2 v 7 W J u 2 F 5E6 f i h W v / C z V N b 1 C U c R j o e 0 V 6 N C 19 q X o t k S 5 h 6 E M F S + Z 7 S I i F g M 515 W w C I H N I Y e S F C C Y Z s B n G m b 4 R f G F Y X Y G 6 u J e D s O q 8 a A 9 I f G r q C y Q R U 0 F 53 I b g 4 i 2 J h R s 0 + J 28 R p 5 O O G U i x n a e n 0 h n m 1 r b h a p f Y X + z u Q E j t 0 h 6 F c b V T 1550 R R y Q v E S 53 O / A 4 + z f L C z / l J r q s g Q 2 m 2 F x m r Z g D T N h n B U J / M E k n w d m o p 38 M 64 S r 3 u + 74 z z Z J w j k 510 A 9e9 Y h p K C 7 n a g p E 0 b T 28 h O Z P / g 175 e w D 4 Q 51 c p v s 3 l f E U 7 R P Z O G a x / Y i l N W H 4 / S v E g j N c / Z A r Q S Y X F a 2 O B 0 R N S c 4 l C i X b r / H + 0 I O I L Q d k V U
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:16:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--468c9831-66c2-465b-8e97-aa2cfae5ca25" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:21:56.000Z" ,
"modified" : "2021-06-19T07:21:56.000Z" ,
"pattern" : "[url:value = 'http://110.42.4.180:2081/u' AND url:x_misp_host = '110.42.4.180' AND url:x_misp_port = '2081' AND url:x_misp_scheme = 'http']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2021-06-19T07:21:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--cb2ad8d2-4513-4824-98af-2417ede9f9be" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:47.000Z" ,
"modified" : "2021-06-19T07:15:47.000Z" ,
"first_observed" : "2021-06-19T07:15:47Z" ,
"last_observed" : "2021-06-19T07:15:47Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--538fd0cb-d095-5a45-b311-c04ce8e7791d"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--538fd0cb-d095-5a45-b311-c04ce8e7791d" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "driver" ,
"number_of_sections" : 6 ,
"optional_header" : {
"address_of_entry_point" : 5368713632
} ,
"x_misp_compilation_timestamp" : "2021-04-18T14:09:04+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--c234d4d9-40e1-48a7-ba2c-0b5f007a4663" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:49.000Z" ,
"modified" : "2021-06-19T07:15:49.000Z" ,
"first_observed" : "2021-06-19T07:15:49Z" ,
"last_observed" : "2021-06-19T07:15:49Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--faa06b9c-cf5c-5f94-b066-1c11d658258d"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--faa06b9c-cf5c-5f94-b066-1c11d658258d" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "driver" ,
"number_of_sections" : 5 ,
"optional_header" : {
"address_of_entry_point" : 4198720
} ,
"x_misp_compilation_timestamp" : "2021-05-15T12:44:55+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--f41bb4be-9919-43b6-9196-0840d368ee1a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:50.000Z" ,
"modified" : "2021-06-19T07:15:50.000Z" ,
"first_observed" : "2021-06-19T07:15:50Z" ,
"last_observed" : "2021-06-19T07:15:50Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--bd5e4742-0223-5297-adc9-5a0d18aa448f"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--bd5e4742-0223-5297-adc9-5a0d18aa448f" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 2 ,
"optional_header" : {
"address_of_entry_point" : 4203264
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--64bed6a7-3297-4789-ac29-49c73b493235" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:51.000Z" ,
"modified" : "2021-06-19T07:15:51.000Z" ,
"first_observed" : "2021-06-19T07:15:51Z" ,
"last_observed" : "2021-06-19T07:15:51Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--127e79c1-76d1-5672-9412-d0edd90b1d99"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--127e79c1-76d1-5672-9412-d0edd90b1d99" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 2 ,
"optional_header" : {
"address_of_entry_point" : 4204160
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--73fe839d-d8b3-4b19-8df5-e075319f39cf" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:52.000Z" ,
"modified" : "2021-06-19T07:15:52.000Z" ,
"first_observed" : "2021-06-19T07:15:52Z" ,
"last_observed" : "2021-06-19T07:15:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--fd2177a1-9176-5869-b199-9f8baca59774"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--fd2177a1-9176-5869-b199-9f8baca59774" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 4 ,
"optional_header" : {
"address_of_entry_point" : 4201754
} ,
"x_misp_compilation_timestamp" : "2021-03-21T09:46:34+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--14cbcece-f046-4ffc-9558-8a1bbc704211" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:53.000Z" ,
"modified" : "2021-06-19T07:15:53.000Z" ,
"first_observed" : "2021-06-19T07:15:53Z" ,
"last_observed" : "2021-06-19T07:15:53Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--bd5e4742-0223-5297-adc9-5a0d18aa448f"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--bd5e4742-0223-5297-adc9-5a0d18aa448f" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 2 ,
"optional_header" : {
"address_of_entry_point" : 4203264
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--2c0b5972-cd00-4f8a-9e8a-cb31b9914593" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:55.000Z" ,
"modified" : "2021-06-19T07:15:55.000Z" ,
"first_observed" : "2021-06-19T07:15:55Z" ,
"last_observed" : "2021-06-19T07:15:55Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5078cef2-64fb-5b7c-9194-3566536e6c00"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5078cef2-64fb-5b7c-9194-3566536e6c00" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "driver" ,
"number_of_sections" : 6 ,
"optional_header" : {
"address_of_entry_point" : 5368713632
} ,
"x_misp_compilation_timestamp" : "2021-05-15T12:46:38+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--8d7a063c-54d3-492a-ad81-5352128577a7" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:56.000Z" ,
"modified" : "2021-06-19T07:15:56.000Z" ,
"first_observed" : "2021-06-19T07:15:56Z" ,
"last_observed" : "2021-06-19T07:15:56Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--016b55ea-6462-51ba-b868-932818db01f4"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--016b55ea-6462-51ba-b868-932818db01f4" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 2 ,
"optional_header" : {
"address_of_entry_point" : 4204128
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--83630b45-1bf6-46fc-b17d-3a4c69127899" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:57.000Z" ,
"modified" : "2021-06-19T07:15:57.000Z" ,
"first_observed" : "2021-06-19T07:15:57Z" ,
"last_observed" : "2021-06-19T07:15:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--2ba7efeb-43ba-58ec-b9fe-76bf8c92b957"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--2ba7efeb-43ba-58ec-b9fe-76bf8c92b957" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 2 ,
"optional_header" : {
"address_of_entry_point" : 4204800
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--2a138470-fe21-460e-835d-0fc839b2a9a3" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:57.000Z" ,
"modified" : "2021-06-19T07:15:57.000Z" ,
"first_observed" : "2021-06-19T07:15:57Z" ,
"last_observed" : "2021-06-19T07:15:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--127e79c1-76d1-5672-9412-d0edd90b1d99"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--127e79c1-76d1-5672-9412-d0edd90b1d99" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 2 ,
"optional_header" : {
"address_of_entry_point" : 4204160
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--adca75b8-b784-410d-abd9-4b589bccf3df" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:59.000Z" ,
"modified" : "2021-06-19T07:15:59.000Z" ,
"first_observed" : "2021-06-19T07:15:59Z" ,
"last_observed" : "2021-06-19T07:15:59Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--3366f255-2a49-5470-b397-6e35dc413a51"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--3366f255-2a49-5470-b397-6e35dc413a51" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 6 ,
"optional_header" : {
"address_of_entry_point" : 4670116
} ,
"x_misp_compilation_timestamp" : "2021-03-29T10:01:18+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--3d608d86-3642-4eaf-93b5-f9a2e464d0e3" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:00.000Z" ,
"modified" : "2021-06-19T07:16:00.000Z" ,
"first_observed" : "2021-06-19T07:16:00Z" ,
"last_observed" : "2021-06-19T07:16:00Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--bd301ee5-60e6-556b-94ca-84510d7bc8ba"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--bd301ee5-60e6-556b-94ca-84510d7bc8ba" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "driver" ,
"number_of_sections" : 5 ,
"optional_header" : {
"address_of_entry_point" : 4198720
} ,
"x_misp_compilation_timestamp" : "2021-05-15T12:46:21+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--a9ef8fca-738e-436c-8664-130419d87650" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:02.000Z" ,
"modified" : "2021-06-19T07:16:02.000Z" ,
"first_observed" : "2021-06-19T07:16:02Z" ,
"last_observed" : "2021-06-19T07:16:02Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--b65af11e-0995-5704-9392-cb52403d5c2a"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--b65af11e-0995-5704-9392-cb52403d5c2a" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 4 ,
"optional_header" : {
"address_of_entry_point" : 4211558
} ,
"x_misp_compilation_timestamp" : "2021-04-06T06:00:16+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--4badc42f-32ae-464d-bb86-d335c70e8821" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:03.000Z" ,
"modified" : "2021-06-19T07:16:03.000Z" ,
"first_observed" : "2021-06-19T07:16:03Z" ,
"last_observed" : "2021-06-19T07:16:03Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--ed52a7d9-24c3-502d-b4c6-7d2e1c286a03"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--ed52a7d9-24c3-502d-b4c6-7d2e1c286a03" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 2 ,
"optional_header" : {
"address_of_entry_point" : 4204768
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--03846d30-1141-4004-9f4c-cce033977a00" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:04.000Z" ,
"modified" : "2021-06-19T07:16:04.000Z" ,
"first_observed" : "2021-06-19T07:16:04Z" ,
"last_observed" : "2021-06-19T07:16:04Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--03698891-97a7-569b-a302-85a2ec308d63"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--03698891-97a7-569b-a302-85a2ec308d63" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "driver" ,
"number_of_sections" : 6 ,
"optional_header" : {
"address_of_entry_point" : 5368713632
} ,
"x_misp_compilation_timestamp" : "2021-05-15T12:17:21+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--fb4648ae-f09b-444c-b713-50e55353621d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:05.000Z" ,
"modified" : "2021-06-19T07:16:05.000Z" ,
"first_observed" : "2021-06-19T07:16:05Z" ,
"last_observed" : "2021-06-19T07:16:05Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--83b1eee8-a95a-5ae1-bfff-9b6adeb014cd"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--83b1eee8-a95a-5ae1-bfff-9b6adeb014cd" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 3 ,
"optional_header" : {
"address_of_entry_point" : 4215296
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--eeb9a762-1710-454d-8d57-178ab5e76839" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:06.000Z" ,
"modified" : "2021-06-19T07:16:06.000Z" ,
"first_observed" : "2021-06-19T07:16:06Z" ,
"last_observed" : "2021-06-19T07:16:06Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--3f6d7cb4-fe61-5056-af6f-ded4af854c8e"
] ,
"labels" : [
"misp:name=\"pe\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"False\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--3f6d7cb4-fe61-5056-af6f-ded4af854c8e" ,
"name" : "" ,
"extensions" : {
"windows-pebinary-ext" : {
"pe_type" : "exe" ,
"number_of_sections" : 2 ,
"optional_header" : {
"address_of_entry_point" : 4204192
} ,
"x_misp_compilation_timestamp" : "1970-01-01T00:00:00+00:00"
}
}
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--6321c3b7-2f5c-42bc-9678-3404093fcc86" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:46.000Z" ,
"modified" : "2021-06-19T07:15:46.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "9c471cab-8e3b-4745-8e48-43848b2fb184"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "26624" ,
"category" : "Other" ,
"uuid" : "aa69cc41-a982-48bc-b61b-8d9ded7c7c02"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.3151171440822" ,
"category" : "Other" ,
"uuid" : "754c42c7-3b86-470f-9936-7a1c0b24f1e7"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "cf0b16eca2aedff96b586a2add8e956e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "56d1dcc8-2819-491b-9d88-8846205d9974"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "6b3099c00646a54d25d96c0d9a3394463394083d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "491e9404-fe3c-412e-8345-ea061688895e"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "e64daa8926bfab138ddbe16a1f84ff4dd67984b06d0d908fecab21f051e7786a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a064ce37-572f-4d16-a327-ef82329a4c0b"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "f408833fd42da728bd7f89f4e288a4fbe1651cff3a26fa911cd09f845302d678c70037ceb36b3d58dba910d1b93ec602fa0f9ac13ae63936c4332d4c0f89c049" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "da2254e3-6ebe-4d94-89f5-7ed77ddb3791"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "384:T7ptyfdBgZqCq6pWKksgl2IYdSuC2WigRelS1K8C1x2i7JxhsmuH40m+wMe3ifsY:T1ZqCQKy8IYdfWiUelR36ihR6nmRYsY" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9ec1d8f5-124d-4dbe-86dd-9adc2d1bddcd"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--e382fa8a-ec6b-42f2-9aa9-d0c67d3ce31c" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:46.000Z" ,
"modified" : "2021-06-19T07:15:46.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "ec7f52ea-bf9e-457f-b879-c0b86ee0be7b"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "4096" ,
"category" : "Other" ,
"uuid" : "0aa501d8-8cbd-4a59-8099-c31f26abdd57"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.5975419614638" ,
"category" : "Other" ,
"uuid" : "fbb1dbb8-a1f0-4278-af9b-7100be6e8fb2"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "9bdac8b097939eaed66915ff2b749a65" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "fd5884c7-f7eb-460e-8824-a708a429dab9"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "90ffe7d75e330312af75613f6060ada878fd40bb" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3dadda97-cb77-42a2-9633-b4848478c7fa"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "6e9301ad9fc55c0985604ca76ea25bfbe34d5ea053a5693b63988b5771384403" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "4705a957-e834-4d4c-b375-68fc51d0cda7"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "e42210e5468e15207c537b77c87ff62a9519dcdff25b6ae370f738d35d73499af26a7608996b3f4fdb50c8e46aff7c016b353b195be156a3c8c320d545eb9cf3" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ff96257f-dfcd-4435-bf84-8157143c4975"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:rwcdILFDTZ8qNEFw6QNO8gpXqsBAXpQXQcPhhpHP52VosLHMEiLnRVsxO3YU4dTx:r4Cxefl0ZR2SsaROOrOBEM" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1ab9c7dd-958e-43a9-acdf-5b7a5f05f0dd"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--a5122353-0bad-4b08-9755-48619da51f61" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:46.000Z" ,
"modified" : "2021-06-19T07:15:46.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "7ccba7df-ae57-4817-b6a7-ba1c3e3178ba"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "10752" ,
"category" : "Other" ,
"uuid" : "da19b595-5098-4084-8194-0dfeb85cbd9f"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "0.6671192572015" ,
"category" : "Other" ,
"uuid" : "802dc942-2c3b-49cf-9b60-4b408cdc4499"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "cdfba2ba88c72647f5347a2835bfd043" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1425fd44-e4c1-4071-b9cd-db736caff24d"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "da6a4ffcc7026a22fc6df5b886285f194680b0ad" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b72508ca-66a6-4229-8407-5189a71d6c68"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "b5ca2985dcaf1bffd87922bf5ae6425012d9ebea70b1f9ec5ea7bc212c37cb25" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b35afd78-4cd4-469d-8b5a-8551a6b7dbdc"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "6ccf8b884e64df2a4074d994d97f287f43a263614ebd91597dbe5de0a5f3c48b288260fcbf3e382b4860747a6da9d03e5f7c8e483d81f1e236dd59ba833bd31e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "319ea4ac-d0bb-43a4-861b-89bca08d4ddd"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:W5xK9PJtoa+0SC8gTMCkzVk1yu6wnffu6wnfX6/1nS:aK9PJto8SbgQW196w+6wP6/9S" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e93a3ddb-0d4a-4138-a3ba-7ca89f3d602d"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--d20843ec-7a04-401b-909e-c26ebca453c2" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:46.000Z" ,
"modified" : "2021-06-19T07:15:46.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".pdata" ,
"category" : "Other" ,
"uuid" : "07718463-fd8a-4303-8c8b-4c02cd1be926"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2048" ,
"category" : "Other" ,
"uuid" : "eed1fe18-d608-4f94-b93a-e92f8f837605"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.4275237153285" ,
"category" : "Other" ,
"uuid" : "840a7eb8-8c95-4dc0-88bc-ff777f7340dd"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "28b9ff623b02f7596cf4564576009938" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "87c0f98c-c2ff-4ffa-8efb-7d6b424619a6"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "2d5145a5694e6dabce74ffbd02879ca657dbdc2c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b9d2e2a3-4f9b-4e7f-be7b-f8dd56d37ad9"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "f5a8d079615b1a06d900cbd6d3ec9fb4988d1c007634fcdc2bd42cd675b51fff" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "32c334dd-bf7b-48e9-b0fb-89412319ae21"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "a6d5a9d3f622d502ec30e85491a76589968b5f8a1c62f52257fe334d1643c7048bbdaef21a5c5888736f851bc39b7d3dfa13ce49a171fb7feeb4ae872c0a9398" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "36da0f6d-be6e-4b17-a982-6f81cd7acdd0"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:rworPlT2b8OvhB5+hc6TRNot/PiTmO+SMxsyBp/AFxXqLAQADSh5b:3sYgDwDT2HSfJYsSp/APwAQAurb" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1c45af3e-2cba-4b47-bbf2-2ff49d579c5c"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--c3389c56-14a2-49ff-a14e-a9cf391c07ef" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:46.000Z" ,
"modified" : "2021-06-19T07:15:46.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "INIT" ,
"category" : "Other" ,
"uuid" : "0f686d51-677f-4acd-a8ec-f3cdd9c92c37"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "3584" ,
"category" : "Other" ,
"uuid" : "f6d40ce1-8622-4b67-b3b9-47957e685ae3"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.1718697425243" ,
"category" : "Other" ,
"uuid" : "01e0a230-2a1f-48b3-b241-4832ac0dad50"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "bf3aaff8a4f25625c50651a235f234ea" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5c306537-3e30-40db-9b25-4d167e029dd9"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "efa19aba8be359ef3d1671eea2533d40a8ad3574" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9699addc-c80e-4066-b431-c5a8053a0784"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "0df32b5ab983d4f13d1f4d350e1a92f66e41350711886943720894025588ea7a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e0674277-451f-4346-a447-ce41208d691c"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "b3d5d87dfff44bc6cbf37f4f514c223bff7229ac93342c2754effb6d6b5a91fd01939160e5ef37c5edb66ae94670b7ef9387004102d1aa6aa128a32bd7f31bee" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "52b58145-d6c2-4597-b907-81d5e4d1a827"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:qjHwcdILFDTZ8qNeDYDOjNe7kBtWt2BpRbD+KCm7MuINTg3nuO4EgdW/lLWfe:qjH4ChDY6A2BXbD1XN2EgdW/lLW2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "769c8e2e-71ab-48cd-99e9-2d6fa6007240"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--67ee881e-d39f-42fb-a99d-5c55ca19a6bf" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:46.000Z" ,
"modified" : "2021-06-19T07:15:46.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".reloc" ,
"category" : "Other" ,
"uuid" : "5e06ebe5-8c0f-47d5-856f-8536019f6582"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "512" ,
"category" : "Other" ,
"uuid" : "0864a3ef-08c4-4806-84a4-822fabc7368b"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "3.6204816846131" ,
"category" : "Other" ,
"uuid" : "32f759f8-2ede-4ca5-9973-9360bf68189f"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "fcb8a85ae2d11c0aefad6b5535e1bc90" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ae036816-45bc-4115-bc99-a31dc9657662"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "12c935664a10eea034a86053d7dad2c872d582e7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "084590e3-bb13-4758-9644-e4bdbdc9c004"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "199727264dad79db742e501ee665c0adb8a5e08f70158dd23a8780663e330e0e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "252bf901-28f4-4f50-8623-e0224a00aca8"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "aa6cd28eb6eb70ef70229126734a359aed53a505608162ee9462c5bbdc9790e4c35336c52f39941988c3f7c9ee8b4c1d53c9e44b241bf2dd75cb827a61777419" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ef13ab02-6fea-4727-ba93-3c9ceaff1abe"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "3:X96q9llvt1CtC4/:0+6tC4/" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "81593feb-0503-4169-ad55-9bc396077d3e"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--47b82d50-d85e-48c2-a3c9-3d34d0f9dcdb" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:47.000Z" ,
"modified" : "2021-06-19T07:15:47.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "a8546e63-2f2f-4e2f-9c7c-48dcd6b73858"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "24064" ,
"category" : "Other" ,
"uuid" : "8569f4cc-d72a-4ddb-a117-3a173d12e3e2"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.3405794123405" ,
"category" : "Other" ,
"uuid" : "6168ab45-a42c-432c-9feb-e9f8ac6c2187"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "776e79f0764eff801aae771252c3fa02" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5e74dbb5-0a84-4516-a4f0-5a8b7a8e5d8c"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "4024c296618817b9b35df8e78a2e610e3a7e2251" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "30ed1beb-43c9-46dc-a00e-cb7daa88f6b2"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "b3a1f978c3c288ba58f7540ab0d596d698eb1a450a57abda3c1cc07e19114407" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "7ec61737-8d55-4c60-abe1-c58ea3600a70"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "a56dcd5211f03861d13d14f04142c262750d3717bf589277ab47e1d496dac3d2cbcb6a6627486a33bde3202ab1d42ede030d736f597a7314ec2d3db82dd79ca0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "48c997d3-88ab-4df6-b103-9a4d2f72e075"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "384:h21YxntngRRPOQaniVXgMmZku8YcTTO58N1ZQdY2x4qyg+3h:hWetQRPOQaniqkpY0O5w8dBxmTR" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e4e558a4-3f5a-42df-a409-01e19fc1ba46"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5bcc2973-c2ab-4e94-9fa6-c7e7ec195fae" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:48.000Z" ,
"modified" : "2021-06-19T07:15:48.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "ae55d480-1907-42ab-8d3f-ae437ff7ebf7"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "1536" ,
"category" : "Other" ,
"uuid" : "32060bcb-fa68-4cbd-8053-e0986daf1934"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.565535020822" ,
"category" : "Other" ,
"uuid" : "dd6aa8d8-7098-451c-a7de-3afc7813bf1a"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "e0c219ca37595280d7640998b6b9c704" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "06ae2b8b-0bc1-45ec-9eac-72ae4f556f03"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "e2241b5839b9b49217a5920b0abe3b26df755847" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d76693f1-4fba-45cb-b580-98abd609d03c"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "d0342377ac505f37a21fba24e68195ec67e0cabaa5aba3ca18f6c8ac81337881" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "2480a737-6a00-4cfb-a2ef-e63288161503"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "20d989aa10d27dc41464801f34a5ca1f2752b46547c625461aa9cddd5fe8ee9f7d58a7dd5fe8775e4c6a83d61a8ae84f5de119bf570bf89657485f1499766cb8" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9c954469-e387-4e76-8a67-e86d44ac24ea"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:VuYWgpPdowf+p7n3JAlYHj4OoSSWMU1w6QO/OW5elrBSdNcSaFDVNyfwfQyxiEiG:sYbp5+52lWSWB1w6Q4OW5e5BeKSaZqs1" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3b8cbbc0-afad-4a4f-835f-55ebfcc9153b"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--69b9552b-6d64-4b76-a0a9-dc0f90cd6bb8" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:48.000Z" ,
"modified" : "2021-06-19T07:15:48.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "2be9d9cf-053e-49ed-89d0-d22cf4a604b7"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "10240" ,
"category" : "Other" ,
"uuid" : "6c30d4c9-cba6-4ed4-ad04-44c33a56a5cb"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "0.6890836305716" ,
"category" : "Other" ,
"uuid" : "11545395-be0f-46d4-b7c3-d01d2637edc0"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "d962b31f202d0ed76ca43a73874ee4ab" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "cca3cfa0-5b03-4c6f-8aea-029044da8fe0"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "d3427e3bed6686f6592787ebe95d209fedc871a4" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1a7bca30-1dd8-4e13-b262-78cc80e9eb7b"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "cd81fe7de212dc7357a8b316e2d9abf50274683592d4e97b84307f4e510785eb" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e877e128-9096-4066-b496-28a005e362fc"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "938cae1a8b0463e806bfa5d0ae4db760b6a89251c1ed4aac5a67c7bf32402806ce56351c44df8242bfe66a76e43ede0bb918c5e82f60cf10178891e4744ec29f" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "fb2f8a1d-4539-4441-8e10-e7430abe527d"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:25fI5K9PJtoa+0SC8gTMC0zVk1yu6wnffu6wnfX6/1nSBtN:smK9PJto8SbgQm196w+6wP6/9SPN" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b4d590f5-53d7-4433-b61d-cf8f21eb7365"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--2332dcdc-e184-4d02-8df1-e00055e7c435" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:48.000Z" ,
"modified" : "2021-06-19T07:15:48.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "INIT" ,
"category" : "Other" ,
"uuid" : "cc2c195d-988f-4e9b-8e58-cff5fb2b7539"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "3072" ,
"category" : "Other" ,
"uuid" : "b1f4311a-1f0b-4ae3-88f9-da504b9a5deb"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.6744050867927" ,
"category" : "Other" ,
"uuid" : "78242e9e-9536-42af-baee-882eeb57f75d"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "5900abb4cd3dcf41ca91b58504b690d6" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "99bac18d-503d-4de2-8bf0-3ff4dd51608b"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "6c02d86e3aa6caf28bf4c17e5e9ddb0113999b78" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "7ba8222a-1d44-49db-9e07-c4f70b4411cd"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "4a819123fe7f7360495dec76b6fcb73b105bb87c5255df7650b15421b95f45e4" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a371825b-e049-4b33-83e6-c5e91aea63df"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "55fcc8138926964081972710e6ad7756dd42639dc25c65e166533c980720cdf489aa62bf6598e3ad871d12c6d5c7e0890c220cf12bb0fec6d010d755b4790679" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c9ad0f6f-950c-47d1-ad0b-4fd9044c6de3"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:OM2DYbp5+52l1DYDOjNeYrOENPMgFBBTd98bCMQem7zPaTgcV5iHrXAm/lLWfU:Z28p5+52l1DY6h5PbBBv8bCjTvTAm/lf" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "750caebf-06da-4d1f-8e72-ef5e554be61e"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--fa1b96f7-95f4-41a7-8282-d51ea35a003a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:48.000Z" ,
"modified" : "2021-06-19T07:15:48.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".reloc" ,
"category" : "Other" ,
"uuid" : "0d11583f-3325-41b9-b476-40e2551c236b"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2048" ,
"category" : "Other" ,
"uuid" : "bb4242d9-8536-49b5-a1df-5383658c7bcd"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.678416291454" ,
"category" : "Other" ,
"uuid" : "3a86afd6-e682-41c7-a4e0-1966d1298ffa"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "5697b274e4aaa5fdec318fcc871f591c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "143b0031-5ebe-447b-9e3d-07f76894ef42"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "385859eef08a7554e5988d1c0a71b493c40bfc54" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "85fef2c6-b10e-43a6-ba18-7a58bdbae6a2"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "a35fedda00d2ae53ae9fffaf7307f6307f7c9c91c4bcf51c6973b5391da8c211" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d2f78f4e-fe76-46c8-83c1-830a201868b4"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "a6594eccefe7cbd618ad9f03662c0cd3ee9fae5460ead576da8b902c6428f8a753132614c816efafc6b4b18805a41d2741760843e160fefae7029d2222eb4a7c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c25224b0-50ef-4c86-b9e2-efd8651e4c81"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:yjg+3sYgvUduAGpW2VBpYXhzRMClFvlXfFwXyWi11g2q5GjtBe2BLfJyUNmZWdeF:hn8kGXZvFF1ZqkjV5JYTAw" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f745c225-67c5-4963-bb13-70f8b68b7fef"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--d40bd6a2-0eb5-4796-b699-dffc2be4b431" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:49.000Z" ,
"modified" : "2021-06-19T07:15:49.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "e8e9a949-fb7d-43c8-b254-6fd99e5e50b3"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "5632" ,
"category" : "Other" ,
"uuid" : "c8c7c6a0-28fa-41ff-9055-256f7966233a"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.058013904165" ,
"category" : "Other" ,
"uuid" : "ef19baca-5dbd-47f4-9ff1-6f08f9059e28"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "56cda77a320b3cfbbfe5e1eb818f8abe" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e4cb9d1b-c263-4e72-a848-915a2fb877a9"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "0d2795d63eff30382c17a44639995b5e56564ea2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "69af45bf-182a-46ac-a524-b4ec1d8c9d9e"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "d3e92988e0c616f054220d238b76a4a68f15547adc7f9b1e8c5abc199c306706" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1ef0dbb0-22e3-43b5-a69d-4b2d6b8d8949"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "18b1856853135518a06e4c1467a569e47ff551f5f9b3ca528fd3896f0aeb93bde3b54439ccc5415025d369f4e0b95ae73ed8edce493954b8ab83c7f34bf30ac2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "89495fce-4d4a-4bac-a73b-4fd20c1d0747"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:wD0sc/cytcPa9M34/L6/sGVFx39Wot0F5ttVAZ2F8patDLX:wacytIaG3GO/pVFx3ci0Frt+MF8p2HX" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1ef88778-55eb-4424-90ba-94913ec617da"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--d7bf8eb3-19e9-4aad-92b8-3a95c884e22d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:49.000Z" ,
"modified" : "2021-06-19T07:15:49.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "c03f69a2-57d8-493a-92d6-fe16f99cab5b"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "109568" ,
"category" : "Other" ,
"uuid" : "f82071ff-68e0-4cdf-a806-0e560e03162a"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.8367064851345" ,
"category" : "Other" ,
"uuid" : "401675c5-1907-41f8-826c-6a9c24bae37d"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "c2f903dd844c290e1778f9b1956b5e3a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "62a8d214-05dd-48e1-a893-79cc877fffdc"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "7411f92a0e96519a2c2babcf23af488251aa695b" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "cece7d80-a32b-4ba6-b436-6cbb9047dbce"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "d126053a505dd4be9f4f6314a2f513a39fa8c1bfd472fc01d54fb41433d0eafc" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b391fbef-13f5-4cf5-b8dd-d54d5222a180"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "04f186bc509f54305963cdf2200efe4660e926d276c4cdf3450583c1e2657b23bbe00f1e99c503bbcf342542c1c996961fad049d56fc337425dbdf4177be810f" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5408850f-a2ca-4d52-a471-7935ca61c5f8"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "1536:QWXOQwi6wEBxmTSp3EpoNyq+4lRX6IHOSyOVi77:QKOQwNOT+eFq+4lAvOi7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d18191d6-06c0-4e04-a427-ca8d2fe3dd0a"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--c41067d8-f1e0-4a79-b653-b1de3a333983" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:50.000Z" ,
"modified" : "2021-06-19T07:15:50.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "7f478b35-0275-4416-9590-e6f5013f4505"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "6144" ,
"category" : "Other" ,
"uuid" : "d64d1dcb-0752-44d4-991e-9e115c13ad11"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.0216588985258" ,
"category" : "Other" ,
"uuid" : "09698219-24b4-4661-a4ca-bc10259e574b"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "d95c252424ff0222f4e9aae3ad461c57" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "7635d5e1-6de6-4de4-ab3d-9148a3bd258f"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "694eaadc11895e88b9bffbeb250a95b9913c2917" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "8843aefd-0ca0-47b8-af7b-780140bcda26"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "761aa5997b2fbbf52dc0225df16a0ba111246e31b7915d3e8dc316adc0b09bdc" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d02e3fed-7c73-43e1-a3c8-5fe9f3f86417"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "ee20b57ddd887761a758d8ba26e0b4c641dae84f945f995ff3dabe3e51d5dd9b11c7614907e5b99c075cf9139a2ceabd05430240d8fa12dfbc96dd64f8a3359c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e02ca84a-3de1-4a50-bba5-7f0f163b4fc9"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:bJhcyN+iiPca9M34/L6/sGyGOVCTAy3L4i39DEKdsVPTilD3r:bhN+ivaG3GO/pyBA30i3X2POlDb" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c5ec40c5-39d8-409b-aba0-ea4a9e124b3a"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--d54701ff-0998-4d1d-a226-52968b38688e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:50.000Z" ,
"modified" : "2021-06-19T07:15:50.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "75e744c1-0359-4e78-9bac-7d570c2b5b35"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "5120" ,
"category" : "Other" ,
"uuid" : "9aac0cb2-4310-44f2-82a6-277e4ae30ea5"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.9696789438541" ,
"category" : "Other" ,
"uuid" : "be7e74dc-1fe5-4cb6-bd58-65a72f7f9111"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "5254471169d40804343c29a0c7c2c756" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "df3fb9c0-fff0-46ee-b863-b7e0a0498149"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "b879e7313f3d05f12df64bb127636e6da1d6b13d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "91ce8303-5e8c-4cfb-91b2-2fcd2f50a02c"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "e05febf89b27e15fff85688ebe072fe1c21a909a25c1c950283eacef1db09062" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "72e90c64-bdd9-4d15-bdde-b27664136af3"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "bb20fe30a57a33e0afcddef4ffe80634714df3ee66cc0a1d9447439b5fb611679ee450c77d16fdc4f33992abeb2bb5c1a3cc548de9b420cf8be5ecfb40c3c6b0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a7a2e169-907f-47f9-804a-0de16590f22c"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:6oDC2bjNUtWh0G3yJR20gltKdJdvPf/4v9K4RV:RC2bJUISPNglwPv2K4" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d3b6d507-4123-4116-92f4-aa9f81dd6cdd"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5460049c-12dc-4c6b-ad1b-574ee6e27b46" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:51.000Z" ,
"modified" : "2021-06-19T07:15:51.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "2a97749c-b384-4b9e-b24c-c2d08799278a"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "73216" ,
"category" : "Other" ,
"uuid" : "7400dedd-67cd-4278-9e50-1c6b69dd6bf2"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.6460112902163" ,
"category" : "Other" ,
"uuid" : "5a288f2f-7da0-4007-b264-c4512de65b2b"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "ba122448e9e534fc1bd66fe1e20c2817" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "03d9c5be-3fc0-43b5-8f12-befc2f42af15"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "55cd8e9b39a5269edae46760f3015496d61ed417" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e8c125a5-adab-4b88-8953-da755f5e68b6"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "c8e8917bf6b5f311173b7652240c8d752e83d8354e00ccfb42e18d9539decc81" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "199923a3-650d-4033-9bdf-23b556cba695"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "87bee0f652995ae0a2432115271d90be033996e215c32356d541274ee6331590a0442d1c064cf81bd0d5875841d426b5824b5b8a61e3666daa19bdb5a457be63" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "0c4fa4d2-fe70-4c9a-afa5-91efb540a3aa"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "1536:tF4UxFgiCmlggnF549biIJWiwmYRWLGZxu7QTb6BRIAxKKM36h/do9zcEruQYf:t3Jlggn749TgxSGZxu7yb6BGCKKMA/2C" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c9d5275e-8af3-4691-8cb6-7602464a2e8b"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--8ac5b696-de49-428d-8edc-8ac677efef52" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:52.000Z" ,
"modified" : "2021-06-19T07:15:52.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "6be7726c-6525-4344-ada2-ac45b2575876"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "29184" ,
"category" : "Other" ,
"uuid" : "7a86bf4d-1444-42bf-8e6e-2d5814322b48"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.1292811401258" ,
"category" : "Other" ,
"uuid" : "358c19ab-6fd9-4b12-9d8f-dcb9e6453ff3"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "256a7bc964bed0b763853e7d06254cf0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e6d532c1-f399-4109-87c3-2ffe5b61e8ec"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "230666307a7060e10f26a9ec7b14631391b6d3ee" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9b08dd66-08dd-46e1-84b4-664133390f3f"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "f41d59e5ea021a69e5b9a3a546a9b5b4f4ac256b802c53403b4984b74adf8334" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "15d8eb08-03f1-4836-815a-259bdf7aa81b"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "d708e62fb30c8f00d40ea1dadb0e4a31e43cca5dc00ef31f67d3927d92409605edba5a87ff2ce841eeb148b5a9e65460b6bd21008ca263662cf30d39ebbb07c8" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "88bb9966-d1b2-47f8-b24e-4925b46ff582"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "768:AgCQxRalWkTsWAg83cd7zBD9vmOCP3gED3m:AWalLsW8cd7lzCPQmm" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "978dc06c-0ddf-4a9e-8e6b-9d62fa5bfa8c"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--8688dd97-17cc-426c-99a8-663fb002ae49" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:52.000Z" ,
"modified" : "2021-06-19T07:15:52.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "a7ff5a1d-b58d-4a45-9410-78b2e68efb4c"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2560" ,
"category" : "Other" ,
"uuid" : "7952bef5-48f5-473e-95ae-eeda78e4bb26"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "2.1461655382031" ,
"category" : "Other" ,
"uuid" : "8c40f6f1-7771-49e9-8bae-52968f36d358"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "e6ddbb0c98bdbc5cb6ef5e47332ef148" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "51c73a96-597a-4a78-8321-364091bcbfdc"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "1bc4fcb6cf6b3a452a53d3dd0890fcc26ac878d6" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1b8f53b3-4df3-4084-b56a-e0ab9d0d7b90"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "4f6d5b6cb5664c7fa5cdf5149aa3842cfb6c8fc98fdddad8f3e688a36879a5ab" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "bedea244-7145-4aa3-8043-f0f89dcc9ba3"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "fb98d03b2c9bbc1351c04454c6924d792dd6c83e92aea6cd40f21ad306984dcbf610261d55fce683e621dec095f329b49ec66a8cafb43e96db85147690ef0dd7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d29d5b96-dec3-4b25-ba39-f5b5abf85464"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "12:pi2DX6nhiE04LF6LO5SfXMvmNKzuW6LO5SfXMvmNKzuXhB/q0qeUcKgBFyXXXXXQ:FIF6uSkeKv6uSkeK8hBSq6h/CScSdu" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c871ef8a-c0df-488e-9c6a-be8d7f2919c7"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--0e9b987d-c99f-483c-9bf8-40d0adb31ba7" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:52.000Z" ,
"modified" : "2021-06-19T07:15:52.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".reloc" ,
"category" : "Other" ,
"uuid" : "df09274d-513f-46bb-865c-a0b6631535a8"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "4608" ,
"category" : "Other" ,
"uuid" : "5c35fff8-b20f-42c5-86fc-6c5a1255f0f9"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.5342268114962" ,
"category" : "Other" ,
"uuid" : "f9680b36-2f73-4f1f-bae7-182d30648d7e"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "d85fe860a8751a320647388fdfd485b4" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1e514782-687f-410f-a3a2-d5c04edc5986"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "e4076bc60d87609162518e9d651c39b3554cfa70" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "069b6cfe-c212-418f-a2a5-515975e4fe98"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "0c20438725be27a7af290c3634341b54c971d2407b0b4b482b0dca81fbe813da" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a770e3f3-cce2-453d-b478-6d7d0eeae3ca"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "efe8f55288934db25667545a7382f36c496a6d16263ad489613ed5c42dca8bb06ba435764c2cbbe5dcb0420a174ac20c1ee3cdaf4c01905843fa08f0bde8fbf0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "203c0c56-032a-4ef8-9b22-bcd2370f630d"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:kt+f9W+sN2GU7doIH+t3+uNE7sBpnnnGbGkmnqjnnSDs:A+VWBsWIH8ZgQnGb5mkes" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ebc674bb-b783-45b2-b7f7-e61b451751b6"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--e92bb5ad-f7e0-4f31-a7a2-8091fa441d02" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:53.000Z" ,
"modified" : "2021-06-19T07:15:53.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "d03a7d53-b1ba-453a-9ae6-eb1b4f8b42e8"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "5632" ,
"category" : "Other" ,
"uuid" : "c84431da-d6bf-47d7-9bf2-729af75c2cf7"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.0629575138343" ,
"category" : "Other" ,
"uuid" : "6bbfc2c5-9444-41f7-80a4-bfae4ab9f207"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "0dca461c1012640bb1985540881084f9" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "68a008f2-e456-4215-957e-beced2c29922"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "8c61e395d24967ebdcbff73eb8d32c460f606e44" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a6034f77-b46e-46ad-8641-0d98937a891a"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "2894f5e511f54f4c17452782967a436b750f0c7bb5a59cf7bb26608ef196bd25" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ec9bf6cd-0923-4ff3-b3f8-5a3a0a2b79f4"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "18f5a748127ca2860aab7e0f409bac7ed508411da9d360524b35708a843a738314fcd08fc56568d6677ab8ce5de34cd623d1fa0643d098704c199f8aa43f775c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "4ec76269-ea47-4330-9f65-d017c724984e"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:wD0sc/cytcPa9M34/L6/sGVGb39Wot0F5tWVAZ20nQaey1ae:wacytIaG3GO/pVGb3ci0FrW+M0nQryz" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "af18d250-d370-40b2-a247-ef142bb104ea"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--ae6ea4c4-1136-41b1-a103-b760a5d6b949" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:53.000Z" ,
"modified" : "2021-06-19T07:15:53.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "8ed18e5b-7e5e-4f05-8c62-e5fae97974b3"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "109568" ,
"category" : "Other" ,
"uuid" : "f4f04e39-ce0d-4e7f-9e3e-60b3d09fde9e"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.8356487190746" ,
"category" : "Other" ,
"uuid" : "9b988502-fafe-4656-93ae-b6aacd3aa16d"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "16de5f9c14fe90eaf907e43e0e90cd0e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c7ba4be4-0789-4173-afeb-fee59dc4c715"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "d0c5dcdf0f57839036d81f57e9b1eaf39dcbb6fc" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "53edcc6c-fde1-47c5-87a3-c973f99d2d44"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "28a43e17fa80f38df5d39a1e7f4a1cff93c4925f3ccf79b6cc1c67cb558fb025" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "822e4a5c-0802-47d8-b360-9f4f50e8f3e9"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "3699000880f31578366c5c46502acd84c6ddc82affa45ea3553487217fb6b857a742218e943bd2c094fdf9d0ac5520b705801041782e619fcdc8547e3e455e0e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e831236a-a24c-4d65-9bc5-d5a66c7aca3e"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "1536:iWXOQwi6wEBxmT33U/aNyq+4lRX6IHnsOVi7s:iKOQwNOTH47q+4lAezi7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "20d12826-f7c4-4f43-8e2b-25a9b920913e"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--98c6cb34-b6c8-46d0-a6ff-c5c01732510a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:54.000Z" ,
"modified" : "2021-06-19T07:15:54.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "2e0b8998-ae45-4c1a-b944-0b1e72261e10"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "26624" ,
"category" : "Other" ,
"uuid" : "c475d2ae-4176-45ed-bd1f-c0a75ad9c73c"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.3151171440822" ,
"category" : "Other" ,
"uuid" : "a7357e68-1a73-426f-91f4-7ced0116f7e8"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "cf0b16eca2aedff96b586a2add8e956e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f6034d0c-e06e-437f-848d-a358721ce667"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "6b3099c00646a54d25d96c0d9a3394463394083d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "adb742e4-6f03-4f01-87de-fb5285e677ee"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "e64daa8926bfab138ddbe16a1f84ff4dd67984b06d0d908fecab21f051e7786a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "66f3d0d9-4653-4ee5-9a12-2df850b8588c"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "f408833fd42da728bd7f89f4e288a4fbe1651cff3a26fa911cd09f845302d678c70037ceb36b3d58dba910d1b93ec602fa0f9ac13ae63936c4332d4c0f89c049" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "bc76fbea-f0ce-41d8-94df-7b1457416cb5"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "384:T7ptyfdBgZqCq6pWKksgl2IYdSuC2WigRelS1K8C1x2i7JxhsmuH40m+wMe3ifsY:T1ZqCQKy8IYdfWiUelR36ihR6nmRYsY" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3738d1a6-ddd4-4443-b63b-138af26016d3"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--86fb9914-7d7b-4236-9abd-9d102ce95d08" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:54.000Z" ,
"modified" : "2021-06-19T07:15:54.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "3b3ad8b7-b0b0-487a-80b0-be80be3a344f"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "4096" ,
"category" : "Other" ,
"uuid" : "747b77c5-a867-4a6c-9613-b104900f48c6"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.5653063746933" ,
"category" : "Other" ,
"uuid" : "975502ac-c370-497a-aff3-bfe13b1d7c69"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "d5cc9dcb8f2e36237c1895d9de49de46" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "22bbef16-0cd9-4cac-a24d-1811fcd74eee"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "c96c6dcbed0c58f3cc2253157395b66bb1e2fc9f" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "27d7923a-0e61-486d-a569-5d94e11138db"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "5d2c59d196897e18445d7dc7d3ff2875a32449ce55fc2d47d6d38661aa9f2a38" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "77f7e933-6c5d-4c4c-a585-1297ac7d8b43"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "1dfc4a8ca1abfbfdb93f20d13ef88dd589c837eaffe2c2a908bb763d0cd4841e78a2bba8b7598b520397cd57aa22de1eda324da1a35e44f5ed1323106548046d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c3a4ec42-543a-469f-8cb3-18005ee1242a"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:rwcdILFDTZ8qNEFw6QNOqiKsBAXpQXQcPhhpHP52VosLHMEiLnRVsxO3YU4dTh+s:r4Cxefz4ZR2SsaROOrOBEM" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b4ae9fbf-d9b0-4219-80ae-9f61f4797fcc"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--bc94cea5-59b0-49c6-b478-db6deb6213ee" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:54.000Z" ,
"modified" : "2021-06-19T07:15:54.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "0685919c-504a-4904-8cde-9d978d104bac"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "10752" ,
"category" : "Other" ,
"uuid" : "dc928a7a-e274-450f-9ada-65a210568f50"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "0.6671192572015" ,
"category" : "Other" ,
"uuid" : "16f0e3bb-543d-45e3-b68a-789a637b1ec7"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "cdfba2ba88c72647f5347a2835bfd043" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f814fc1e-4bc4-4509-b61e-902e976ca152"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "da6a4ffcc7026a22fc6df5b886285f194680b0ad" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3779cc80-fd22-4210-aec4-88dd6103ccb4"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "b5ca2985dcaf1bffd87922bf5ae6425012d9ebea70b1f9ec5ea7bc212c37cb25" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "876955c2-d4c7-409c-ba61-28ee21bc786f"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "6ccf8b884e64df2a4074d994d97f287f43a263614ebd91597dbe5de0a5f3c48b288260fcbf3e382b4860747a6da9d03e5f7c8e483d81f1e236dd59ba833bd31e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "4f57785e-fdf9-4a06-996d-3c054a791369"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:W5xK9PJtoa+0SC8gTMCkzVk1yu6wnffu6wnfX6/1nS:aK9PJto8SbgQW196w+6wP6/9S" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "63f7e973-4276-4581-b53f-7beb3767caad"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--244e9eec-ff34-4fd9-9899-5259e99af7f1" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:54.000Z" ,
"modified" : "2021-06-19T07:15:54.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".pdata" ,
"category" : "Other" ,
"uuid" : "52b91feb-574d-4827-8673-9a41b7b83489"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2048" ,
"category" : "Other" ,
"uuid" : "6bbf9100-a7d7-4a7e-b3d3-a0ab80bb4f36"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.4171417196239" ,
"category" : "Other" ,
"uuid" : "9f2b4212-bbb8-4f99-887f-e5faeec40ad3"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "af11065588ff1be5e27be4cd684508b9" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f1a1c6fe-50a1-4031-9577-4433f2515849"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "5aca630b4b10132b3933a7919d630b37a2d77e4a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "6f17ca9f-2da1-49c1-80f2-ba22e8536bb2"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "20b45bf068739ca996e0b62119b8f06045946193bd1fee9e963eab141b90865d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f227bc46-ad4f-4be1-9951-76c820a53724"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "67c859d7e9cc3a0a0dafffdec1e2cc1a3950c32a9655d38520b9670df9a213bf29ce2c00c2e50e3fa24f999cc45c3dc748ca75121244a95a41a8bc447e38d8e0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5e87e5d5-2ac1-4d8b-8027-c551e6f611b9"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:rLIjwvEE2vBxBtsyzw1o9/PlmOOKbcyIp341BqCLoosPTLiZeS7:PcwCBxfzw12FmGbc+CHlLi77" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "2695c642-e4c4-4b1f-a263-fc6cc31e60ed"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--c4f4dbf3-50b0-40bf-b658-9775ffec4b0d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:54.000Z" ,
"modified" : "2021-06-19T07:15:54.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "INIT" ,
"category" : "Other" ,
"uuid" : "90df9187-12a1-4a9a-bc9e-ba9a56255030"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "3584" ,
"category" : "Other" ,
"uuid" : "2dfc5d88-d058-4c9d-8d5c-1269500b5cad"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.1718697425243" ,
"category" : "Other" ,
"uuid" : "5fd52953-4a9d-4a06-9f89-a21b3712f5d5"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "bf3aaff8a4f25625c50651a235f234ea" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e9155182-a74d-49cb-9483-76002eb3bf95"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "efa19aba8be359ef3d1671eea2533d40a8ad3574" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5b3388db-ba5c-422e-9f98-18523fc7dcdc"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "0df32b5ab983d4f13d1f4d350e1a92f66e41350711886943720894025588ea7a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "73fb5641-6da3-4133-9160-70ece5d586ea"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "b3d5d87dfff44bc6cbf37f4f514c223bff7229ac93342c2754effb6d6b5a91fd01939160e5ef37c5edb66ae94670b7ef9387004102d1aa6aa128a32bd7f31bee" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "51c07fea-a0d9-4dec-850c-0afe58444cab"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:qjHwcdILFDTZ8qNeDYDOjNe7kBtWt2BpRbD+KCm7MuINTg3nuO4EgdW/lLWfe:qjH4ChDY6A2BXbD1XN2EgdW/lLW2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "2f69ab94-3736-4933-9f2b-844c7b1bf5dc"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--d09fb46e-5fa5-49a2-86dd-f3d8d1804c8b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:54.000Z" ,
"modified" : "2021-06-19T07:15:54.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".reloc" ,
"category" : "Other" ,
"uuid" : "6c0d541a-f913-479e-9c44-7dc09de2f4fb"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "512" ,
"category" : "Other" ,
"uuid" : "c4a4e5ee-c908-4099-8129-1d666e41dacd"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "3.6204816846131" ,
"category" : "Other" ,
"uuid" : "988aefc6-90d7-4478-b132-36017511684e"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "fcb8a85ae2d11c0aefad6b5535e1bc90" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "43baf62c-92fb-4465-8e75-228d9e19c881"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "12c935664a10eea034a86053d7dad2c872d582e7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d8a7aef5-5374-4182-ae0a-251bb5cb8a6a"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "199727264dad79db742e501ee665c0adb8a5e08f70158dd23a8780663e330e0e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a59d2d2b-aaa1-4ba1-bd3d-5dce2c938a02"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "aa6cd28eb6eb70ef70229126734a359aed53a505608162ee9462c5bbdc9790e4c35336c52f39941988c3f7c9ee8b4c1d53c9e44b241bf2dd75cb827a61777419" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "91f7ba58-af6c-4f65-9f9b-6989d2c3c660"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "3:X96q9llvt1CtC4/:0+6tC4/" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "08a35045-8cfa-4523-b4a1-09018220b0b2"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--e6358f45-c3fa-44be-ab85-eb8ae2b92b26" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:55.000Z" ,
"modified" : "2021-06-19T07:15:55.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "5376e206-5b63-4dda-ab8b-b09cbc62dba5"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "6144" ,
"category" : "Other" ,
"uuid" : "7abee9c1-9503-4d90-b2bd-ad41c166e7d3"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.0220033275988" ,
"category" : "Other" ,
"uuid" : "22552293-f2fd-4402-b35a-090c3675e29c"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "99a48e94880084ad9c1924a5dcaaf54b" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "844fc2b3-3d7b-4420-88d5-b4f7b204b39b"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "71b2600a416d9883cf9e063fc75ec4fbd9f8a57f" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "2d9950e8-d988-47c6-8b4d-b44fa7cb8588"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "76bafec380341efddd6ff5753c579f1aa5a6ff969d32d36747a0e9549149ebe0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "bcfafe4e-003f-4849-99c4-6f8a78289fdc"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "951f54dabfc574acec7a32359214c3614685e306a96cae0b0d60cd51556f70c5eb0a246191073c094b64c87734ca177be8a94d8571eafc02aaf430cc47befd65" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "86288a4e-4ad1-4621-9ae8-70d5f64ccf34"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:q86Bc6RteCoca9M34/L6/sGTmuViTAy3L4i39jbpSR+ePb+cSr:74teCocaG3GO/pTBg30i3BcPb+7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "12f620e7-b513-4806-a1fd-186642a6621d"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--94756020-94fb-42da-ac3c-9307d2670cc4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:55.000Z" ,
"modified" : "2021-06-19T07:15:55.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "5120d398-fe65-4bbb-a455-c844c1823577"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "5120" ,
"category" : "Other" ,
"uuid" : "a127b6eb-363e-4f2b-9372-eb36bf1df5ef"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.9696789438541" ,
"category" : "Other" ,
"uuid" : "ed336a9e-459a-436a-a410-47d58265b082"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "5254471169d40804343c29a0c7c2c756" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "93c2dc72-a6f4-4990-bd18-217f207a2e28"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "b879e7313f3d05f12df64bb127636e6da1d6b13d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "dbdb49d5-38b8-46d8-8bf8-f7ce9da4699c"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "e05febf89b27e15fff85688ebe072fe1c21a909a25c1c950283eacef1db09062" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "220d5d42-9c1b-48cc-aa8d-1420ad1fb1f2"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "bb20fe30a57a33e0afcddef4ffe80634714df3ee66cc0a1d9447439b5fb611679ee450c77d16fdc4f33992abeb2bb5c1a3cc548de9b420cf8be5ecfb40c3c6b0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f06431fa-5a33-4c26-ab92-e2e2ae80ede6"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:6oDC2bjNUtWh0G3yJR20gltKdJdvPf/4v9K4RV:RC2bJUISPNglwPv2K4" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "19fde9ac-a645-4abe-899f-061249ef3016"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--e85cde67-3817-48d8-b6ed-a1415aec0e57" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:56.000Z" ,
"modified" : "2021-06-19T07:15:56.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "f0edcb98-a9bd-4aa9-bfd2-2fc7576701cb"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "7168" ,
"category" : "Other" ,
"uuid" : "d547277e-98f7-4a1d-a03e-f23d708d24e3"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.0916181299081" ,
"category" : "Other" ,
"uuid" : "cac6552a-345a-4d79-895b-a99ba82170d5"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "cfdcf4e026b658096360b3074dc64976" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "373de5f6-4d46-4c5b-a5de-00bc611fbd52"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "f994d8177a07b53a4fd00e17fc1809815c4132d3" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "58089344-1d73-461b-8fab-d97a4f7336cb"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "1d797c47b69b5d7a736b9d5b898d461b37a303e1e70c1857fc572c5b92cc86c2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f1b43456-23e8-4a0b-9c34-82271ed29b48"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "8a52615ba3ee6d0f8ae42a11eb508236fb1530cd309c9e617b1f65bd5e4160d6d2a130ebb723a32918ee9b71903c4a94ce65d85d58a8c2ba377c9a608bb6b6b2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "202ec508-615e-4daf-881b-9d9ad17ac87e"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:iNXc7HaQ3oNa9M34/L6/sGfg9K8NIAY3L2J398FcXu/wVgYdEB8m:iCaQ3qaG3GO/pfg9m3CJ3Mc+YeZBR" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "09848400-21a6-4fc9-b0b3-93396c21ca13"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--07a39763-3d47-44d3-bf12-fec30f348026" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:56.000Z" ,
"modified" : "2021-06-19T07:15:56.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "9e7d93d5-9e91-4dc9-96a0-1e4a4b2f6aa5"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2048" ,
"category" : "Other" ,
"uuid" : "856e1e8c-3048-44ad-9698-2b641eaebcc7"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.8235535794019" ,
"category" : "Other" ,
"uuid" : "83ce773f-3914-4cac-a750-fadcb6664e2f"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "b71e24a232cbf15c55c58f0bbe722b68" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c2a88acf-886d-4c00-ae62-590862c69935"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "5147860b708a336da3f27920a1b729390dc93e06" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "7759e405-7d79-44ac-bd52-2883b17a7ff1"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "9dd20c4ff51c2ea26bc0acb7f8d64de68957b31616dad2ae6225eb204ebbd934" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f2f09075-86b3-4c1f-8d40-0e59ec6b0b01"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "8be573ee5247c2167275697fe355042439ac78dac64b228e095d60092ca3e46fc13e094b48d6dd533b8451b819f5b10567b07994f4624ba35e67e46d1686bbd9" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c55de3ce-f08e-41b8-90d2-6a02b7ab968d"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:ChoqgiPO4TCO18D8aUqSt9RwkrXkr99dIAMnF9AIaPPTW:6o9iPf/uSpzo99KI7HS" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a70a74eb-e8d4-4fd1-8997-1acd1e369798"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--1fa704f1-5526-4c00-98ad-970a36b2b688" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:57.000Z" ,
"modified" : "2021-06-19T07:15:57.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "3caad570-754e-411c-a82d-30e0ad85d47a"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "6144" ,
"category" : "Other" ,
"uuid" : "ddefdc49-61eb-485b-ac6e-87f20d1fffa1"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.0204417084589" ,
"category" : "Other" ,
"uuid" : "921cd159-cdb4-4ff7-abcf-7ff41639b69c"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "54d67a3e6b7fefaa850dc0a355a95188" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ebd9453d-f93f-4e1b-9859-fea1d5950026"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "22f269d22ce15e39755bcf324768ea33a1bbc5f6" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a2889a95-d8b5-4285-b213-67e91adf3bbf"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "70016a2861fe99117c570b93f0d3fc711c3bfb2ef150ad2d851ac0adf82cb930" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3b87ab8f-6121-4bc9-a87d-e2c866c065aa"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "970bec109da07499c4500396b597d0c4886b495d2bd0ec2a45f0e05e1ff991cb4466c9b68a22a914b8a5fe9cf2129246ee6b0ba06b87f7c2dde51a503442ad46" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "4b885039-f911-46d9-98d9-c1384e409753"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:bJhcyN+iiPca9M34/L6/sGyGOVCPA23L4i39D0LKapPrTi5DnDU:bhN+ivaG3GO/pyBg30i3yPK5DDU" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f8ebd098-11b7-4db4-afb6-9496c3361a00"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--bdfcfd96-ec37-44e2-b012-6729b188db11" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:57.000Z" ,
"modified" : "2021-06-19T07:15:57.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "ce168081-6584-4012-9a06-e3a00aa328db"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "5120" ,
"category" : "Other" ,
"uuid" : "04355250-4273-4be5-80c5-e6d517a54a67"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.9533285792542" ,
"category" : "Other" ,
"uuid" : "ea621489-5808-41e6-a261-273a5f9acf43"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "0597c666cdd75b55383579f6268fee5e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "feb8b5f9-7b66-4fb2-929c-e4a55f4dc0f2"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "088f09b0e2b3fc880ec34578c1dcc2b6cc6462a7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b1957ba2-9cf3-415b-a4da-72ddf6262878"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "b8725d7bb0162108ea5e310deb5542ccd74122d04e4772e577d0c0616455f15f" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "914648d5-87c3-4e93-80cb-2f6697ede0ab"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "4f7df59486f72ea45f492a0cac12f9fc1c8ba01662ac11a081fd738160bdb2e5f9af6e40b0a7c42ddf35cad907f9f2da80b60a3000c91e68f7615b2ba673ea56" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ea1a88ec-e076-4d15-9c79-dc705e8c7db4"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:6oDC2bjNUtWh0G3yJR20gltKdJlvPf/4v9K4RV:RC2bJUISPNglwXvWK4" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "eec3f598-d87e-40f3-a1ad-c91f0a5e6dbd"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5a0ff8c4-9323-474c-8f79-6f56e78b57fc" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:58.000Z" ,
"modified" : "2021-06-19T07:15:58.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "2bb66bc0-f0d9-4e36-83bd-e94c3d8d4c4a"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "518144" ,
"category" : "Other" ,
"uuid" : "a8319e65-c040-417b-a3ce-dd94f98432f6"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.8673939918433" ,
"category" : "Other" ,
"uuid" : "5f63af1b-f088-4764-9f5c-589629841285"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "b969ebdb64c9563cc78851c96faea37e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "042a7180-b6ac-4bfe-9124-8ab0d494b7e6"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "76a2222080f5240f6e0dfd2ee22898b52e090691" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9bc7e8eb-615d-437e-a384-017185e4d2bf"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "e3a71e645f99a738e8e70e950baf8b7bad489cc493cfaa839978b5b37d7d6bad" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "8a6915d9-b6d7-422c-af39-e8c29e114c44"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "25540461f6c90af0a52f721dd400f8de3f20f3f14def0316fbce729b3667ed938ed19e26750310a88f83cb6e70b3ac0b3d92856e88d07a746076e20223266ec9" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b0581489-949b-4f67-b25e-e1b5873248bf"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "6144:jzhRwaGlf2ofbRuNPMxJZWWXR6UVUmxTOdbRnveIks9HRizW9:jzLE3TRuNP8cU0UVUCINWns9QW9" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b7be8cfd-da94-4c71-a8cf-4dec9cec9367"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--a13b139c-8971-44c6-bd15-771d74eef813" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:58.000Z" ,
"modified" : "2021-06-19T07:15:58.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "31210ba3-957a-4b44-a73f-9160c9b0474e"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "24064" ,
"category" : "Other" ,
"uuid" : "f6703156-86aa-444f-afc3-b2b4ecd362e8"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.9150635303897" ,
"category" : "Other" ,
"uuid" : "356e8777-4b0d-416f-9478-3d8688fa2537"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "1d5a9d5ff3f1175261f317147e4f6dcf" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "71db20aa-3a9d-4576-960f-fe105a1a0ac5"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "d85c9f849c542258e9966ddf478c84e25263f29f" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5d357cb3-f67b-4a1e-9d96-64be9b0ff213"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "08196d06dd7a83bda8222f41a1c164ef7d10def145796dbeaee09d1480fa60e5" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "744a8d8d-4d81-46a6-ae28-ca989b92319e"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "1f1c58d0ab7287996ed1ee9ef1895129946c0ed276973eec79ff3fedffb5d889ae53e5ea67f6724211abf8d295247579fb1872a2b3b15d4eb4967bf436270c22" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5544fd05-ff9a-4ce4-9f14-d8e7adf6242c"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "384:9iuQypdcMUsowNRD9HPmYsKFWFQkIUKbFMfstIcxrX34bLNB1rRpv:hcMrfDD9vmYtd9bmfs2cxrX349Bl/v" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "38764702-7208-4d50-a808-1b1c8ba299d7"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--0c46da1e-551f-4952-b183-0bf6281bae5d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:58.000Z" ,
"modified" : "2021-06-19T07:15:58.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "c70a5ce8-342c-46e5-bc6e-a17a18ae09c5"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2560" ,
"category" : "Other" ,
"uuid" : "30eb6ddf-28a1-4ec1-9df9-ecedb38533cc"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "1.7882408653491" ,
"category" : "Other" ,
"uuid" : "d40c15d1-6409-46ce-a9da-56b9e8e9c3d1"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "50efd9b25d8700e42055b6c74636e989" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d5e01126-d732-4063-befc-fba3141da780"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "09f570be50a16e269e24318b22fe1175ae5c1b4e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ddaf6803-699b-4134-a2ee-68a80f52e7bc"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "10c99649385d6358095abcb6202fcfc3caf9a43c06caf9d83fb0365a9d94e3f2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "dca8b99e-f2d0-4f52-8446-e78d1c42ad01"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "7be428bf41aff729e1172fa04b7025b57fc798e669f69b91079f2b7ad326190d9893d0743a37b4246aab7c1c4c4c8a741fe5f61b424c0af3b29fc2d141cc55d1" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "261c4657-5c86-41bd-a0f2-8ac9238f030a"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "12:llTv6LO5SfXMvmNKzuW6LO5SfXMvmNKzuXhB/q0qeUcKgBF51E0anX6Ov66666TN:P6uSkeKv6uSkeK8hBSqCnF66666s" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "43cfee1c-5623-4e8f-959c-4b207522c6c2"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--c13b7e6b-312e-4ad8-bfcb-0ca5d14c40c4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:58.000Z" ,
"modified" : "2021-06-19T07:15:58.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".00cfg" ,
"category" : "Other" ,
"uuid" : "1e10d498-fd0a-4a86-971e-addc27ab781f"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "512" ,
"category" : "Other" ,
"uuid" : "903b5655-af31-41d7-96e6-4315a27f6270"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "2" ,
"category" : "Other" ,
"uuid" : "b385082f-686b-4acd-8c4a-51edc4c1eb2f"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "c89f7a0f9778f92a5e219125b3610d61" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "001d07cc-f276-474d-ac2b-25043c97e43e"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "a329b23c1e44534bb0a54715aa5449b9a6ba1273" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "96e7b658-0364-421d-a21e-f2ce3e227f47"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "184d506c38a5a5a9528f8394e7b0ba122b31031884745843b863ea8903d127bf" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "7dbb3330-b267-42ca-a672-fb54f311efb2"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "460a964985c9821b63904a28aca58af8af206acedaa9a6dca4cc563d6581c7d56cebe89bc53384a643e1c8baafdb88aa7c21dcf5b8cfd77dbe7a8e3e79853e56" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "56ed64e5-1ac1-407a-8834-a35752eeb807"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "3:Vln:Pn" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "8a4aa359-3cae-45e5-8b59-6e25d392f1ae"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--9f405895-ce3c-457d-93a3-572d4c91dff4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:59.000Z" ,
"modified" : "2021-06-19T07:15:59.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".voltbl" ,
"category" : "Other" ,
"uuid" : "7cded3d8-0ab8-46e1-8764-20eb338f9d59"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "512" ,
"category" : "Other" ,
"uuid" : "c6f40655-319b-4ba8-8fa4-2b92620703f4"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.5778529113994" ,
"category" : "Other" ,
"uuid" : "69a94707-2211-45fa-8a67-c2f708ee98c6"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "40a0cfdc483f27981dc1db763d8e6625" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e3440dff-b714-4528-b914-b665909e35c3"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "630388842d3a04ede7a9632cd0f5ddedda3b167d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "7db56222-e4e8-406d-aaba-417c0efaf78e"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "889f9db49e469827c2d037407bbc1b72b3e5f6773d4e7ef14b8957b0a6384e73" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "c53aaffc-756f-4115-946b-906146b3a09c"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "c68aed826791932e6ed98f33347b42290984b944ff4e0b0aff020d80fbb9c236e0324c66785cd955dcf6a91a46cd0559e674bcec8d782000ec5061764064cb41" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "88c55d4d-2c79-444f-9b29-6205516f7505"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "3:ggY/k26fl09zaQxNo9AXL+Eeun:dY/kY9zxx69Lu" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b186f177-d4a9-4698-8ad6-c680587d7644"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--763f4304-eed1-4c21-956f-2cbcc23e338d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:15:59.000Z" ,
"modified" : "2021-06-19T07:15:59.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".reloc" ,
"category" : "Other" ,
"uuid" : "448234de-ee37-4a88-8fa4-447836670495"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "24576" ,
"category" : "Other" ,
"uuid" : "b7cd39c0-bcea-44bb-90c9-dcb77639e51d"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.8135056523198" ,
"category" : "Other" ,
"uuid" : "caa71d71-9a19-4082-8c34-cea6f7e53117"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "74844ffef4749a1b7298478eead63864" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5b4ed82b-4372-4883-bfb9-4011292520de"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "4ccad7c12baa6c312a69e6c9e42cb875990d8848" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e5726284-022f-4b42-b325-a0ce177db178"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "e144113e0a4424225dbc5051eea67883a4cec1b40e2a3ec680113b832a7d25c6" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "8a99e0ac-2311-44b9-a2f6-84bbee0f314a"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "c8dacedb1adf163ecd1ab0cd396bfc9ff392928c31b664cad26003d3aec69b7f938e2517fac873c3318ccec948cba73c64c98514a0be9469c001691089f29437" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ee2c951f-2f9d-4203-bbfc-970045bf6270"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "384:V8OAwsGu8F13CPM4ACvM4ox8O+CbWriYr9dCHw25zLNqOF7kGXdaNjOdwW5ImiVS:VXoZM49knCtzr9Iw8NqOdkCAN2wWZiVS" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9e953b60-3001-4361-bc7a-660e8d093b07"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--695b2e91-223f-48cf-abda-0b224cd0dbe0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:00.000Z" ,
"modified" : "2021-06-19T07:16:00.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "b069a73e-39f4-42e2-944d-e607f9286d97"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "24064" ,
"category" : "Other" ,
"uuid" : "14cd008b-50fa-4832-b73d-cae63ef145af"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.3405794123405" ,
"category" : "Other" ,
"uuid" : "d768b582-c7ce-4e35-9660-60aaf38e325e"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "776e79f0764eff801aae771252c3fa02" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "71fee3ad-da5f-4924-a8fd-e80300055746"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "4024c296618817b9b35df8e78a2e610e3a7e2251" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9fc5077e-7b14-4565-b91e-6fde2ce617e5"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "b3a1f978c3c288ba58f7540ab0d596d698eb1a450a57abda3c1cc07e19114407" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "bd14bb07-55e9-45ed-ba5f-9fa7772ce014"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "a56dcd5211f03861d13d14f04142c262750d3717bf589277ab47e1d496dac3d2cbcb6a6627486a33bde3202ab1d42ede030d736f597a7314ec2d3db82dd79ca0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9d0c97ee-d861-47f1-99dc-0f582ec4c9b1"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "384:h21YxntngRRPOQaniVXgMmZku8YcTTO58N1ZQdY2x4qyg+3h:hWetQRPOQaniqkpY0O5w8dBxmTR" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ecdb08e6-66a5-4af1-b588-1bf6656e82e3"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--63384292-3560-4fa2-8a58-2c7f60f64260" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:00.000Z" ,
"modified" : "2021-06-19T07:16:00.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "cb47e4f1-7e3d-472c-85d1-9360eb4d69f4"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "1536" ,
"category" : "Other" ,
"uuid" : "83641f64-5997-4a0d-a9c6-69ad022f37b2"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.5724257089827" ,
"category" : "Other" ,
"uuid" : "3646fdfb-a79c-419b-91e1-f9b47894e3c4"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "23e21b5423c0eb4e7c8dc80651c96527" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3c83bd12-3123-43e8-bcbb-b03d2a03ccaf"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "a9d589716ca04f76fc41d2441edc5e9effd615c7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a3651ebb-696d-4832-9b7b-86c9af9421b1"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "3ab921929a9cf31f030f4bd6bf70921451510d7c7fd99201db4fcca566ad8373" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "051fd022-7e2b-4abb-9ea3-39d50aa96d85"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "1394f2b35f5e05e957a274f38e4a784f34b822015ebf0af15b7e84689268bf556761e40d91ed2fca15da1084fa9f7f65b0c6f601fa13b8856b7f267c0a5b87fc" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "10720745-f4a9-4f1d-96fb-95bd7275b845"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:VuYWgpPdowf+p7n3JAlYHj4OoSSWMU1w6QO/OOGrBOdNcSaFDVNyfwfQyxiEiTXS:sYbp5+52lWSWB1w6Q4OOeBqKSaZqsQWL" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b2b8a9d4-b31a-4697-9d68-1f176f2eeb91"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--11687ce6-7ff4-4aab-a60b-39ae2517d112" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:00.000Z" ,
"modified" : "2021-06-19T07:16:00.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "16832906-6dbc-4f70-ad7d-260686e39c19"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "10240" ,
"category" : "Other" ,
"uuid" : "2ff67ea9-ffd8-4287-a90a-2bf746e95605"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "0.68903575703687" ,
"category" : "Other" ,
"uuid" : "2b13d034-cd73-46b8-b147-3a5d94422a16"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "24aba87b5ee0f8eff228cff35e7fe22e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9ad05960-be10-4e50-b919-df3ef3c86fbc"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "7a44172ef63d69fcd213e024f94b532ceb8855ec" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "38eca73c-14db-46d5-8ae8-7a959b46f455"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "2df8a31269ff695570b9909bc7537c4c2883e95a6ee89fca7fb2ce90e8c6d559" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3b040581-6b82-41ef-8d10-651a973d7859"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "599a37e0ff591cb06be7f8f059222c2c2315c8bee65c213347a574228faf8030d1c0692e27f533738a36ec0535d0f575e7637098f8815f00fe41d0192fc2a3f5" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "825bdd6d-f930-42c7-85d3-9bec23206aa4"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:25xK9PJtoa+0SC8gTMC0zVk1yu6wnffu6wnfX6/1nSBtN:6K9PJto8SbgQm196w+6wP6/9SPN" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "778b5e59-1384-4229-8ee3-ec1d8cf2b900"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--3b50a303-b6bc-455d-bf36-3ebd14302773" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:00.000Z" ,
"modified" : "2021-06-19T07:16:00.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "INIT" ,
"category" : "Other" ,
"uuid" : "1a209102-e737-42da-ba28-1a7089334445"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "3072" ,
"category" : "Other" ,
"uuid" : "f30adec8-b753-4660-95ea-7dbb7d458659"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.6744050867927" ,
"category" : "Other" ,
"uuid" : "536d71a1-9a3e-4885-bf31-6730d4e8698c"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "5900abb4cd3dcf41ca91b58504b690d6" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e70e9b37-5e57-4e3c-95d9-da36916dc168"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "6c02d86e3aa6caf28bf4c17e5e9ddb0113999b78" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f3b39fad-2ed6-4b40-986d-25cf37f519d0"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "4a819123fe7f7360495dec76b6fcb73b105bb87c5255df7650b15421b95f45e4" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "6c8a34ef-4cf5-4787-b69c-ffcab26f253c"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "55fcc8138926964081972710e6ad7756dd42639dc25c65e166533c980720cdf489aa62bf6598e3ad871d12c6d5c7e0890c220cf12bb0fec6d010d755b4790679" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a7c19af8-f193-4cc6-aab7-38042ad87965"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:OM2DYbp5+52l1DYDOjNeYrOENPMgFBBTd98bCMQem7zPaTgcV5iHrXAm/lLWfU:Z28p5+52l1DY6h5PbBBv8bCjTvTAm/lf" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ae973a57-b20d-4c45-91ce-6c5ed46043b6"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--7e34aa06-bdea-47f4-8831-8df457b51504" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:00.000Z" ,
"modified" : "2021-06-19T07:16:00.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".reloc" ,
"category" : "Other" ,
"uuid" : "ae4de669-f1a1-4588-b696-c33bbb755b3c"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2048" ,
"category" : "Other" ,
"uuid" : "f53702d7-764b-46e6-af2e-f3305fcc59dc"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.678416291454" ,
"category" : "Other" ,
"uuid" : "b2c77ffa-7957-45fc-8336-8c41a4a08c7b"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "5697b274e4aaa5fdec318fcc871f591c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "55d2ad83-a9b4-48b2-a62f-2c68cc6bcf41"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "385859eef08a7554e5988d1c0a71b493c40bfc54" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3d86d61f-5657-4dd8-bc5c-3cea8c8b26b8"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "a35fedda00d2ae53ae9fffaf7307f6307f7c9c91c4bcf51c6973b5391da8c211" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "5d5863af-c84f-4944-8f00-b13141d72137"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "a6594eccefe7cbd618ad9f03662c0cd3ee9fae5460ead576da8b902c6428f8a753132614c816efafc6b4b18805a41d2741760843e160fefae7029d2222eb4a7c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e5aa9142-94ba-4f46-8c62-ab9acafcc6d3"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:yjg+3sYgvUduAGpW2VBpYXhzRMClFvlXfFwXyWi11g2q5GjtBe2BLfJyUNmZWdeF:hn8kGXZvFF1ZqkjV5JYTAw" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b34ab6e2-7c3e-4ff5-ba51-f697dc46c280"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--a7655859-ee97-4f41-b84e-2e1fcb0205b2" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:01.000Z" ,
"modified" : "2021-06-19T07:16:01.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "808f5279-22bf-4af9-a194-d51f4de3b082"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "470016" ,
"category" : "Other" ,
"uuid" : "3b1518a9-e328-4535-b0d7-c266d8ef47f0"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.5436924987407" ,
"category" : "Other" ,
"uuid" : "b9ced296-4885-4566-bc4d-9d559a3f734e"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "fa7c25533908f8ca133a569f4d05ff19" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f7431fc2-5675-41b6-a31a-03d169ddbd9b"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "0dd36081fd8d797203a9b66f53fd4156eed45f88" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "97b885f1-7ecc-4273-9af1-b09a0f0cfb60"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "501612dbdb3dc22040a30897a6e00bc7c6971ef5eebe85ee1e26f052ab33d053" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "0dd1117f-56bf-4744-902f-4330e534e2a8"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "14a433bb50405afbb084b490d9382d662882a1180a253e6bcff07c98e412ada52d80eb4e344e746b757d8467067a4b254357b783cb6ccf57d75f3eb6b788cf12" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d027820b-cd9a-4841-a655-7d8d9c7801fc"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "12288:43yoMayFrZ6j7CNWYE3EY3yWGnJmF92UO3Jr7v3t306zGo9:b/aUQ3EiEUF92UO3JrxnGY" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "385d4c5d-49e8-4678-8c5f-ec0d87c0b0ba"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--304b08a9-d17b-41b7-803f-9c572aac0bd3" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:01.000Z" ,
"modified" : "2021-06-19T07:16:01.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "1c6a2f9c-ffa2-4baa-9a5d-fa845e783658"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "102912" ,
"category" : "Other" ,
"uuid" : "9adb059c-e761-4ac3-976a-7bf66b56aeed"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.9050219782688" ,
"category" : "Other" ,
"uuid" : "529273f5-543d-4886-85c7-9c86e2ee5577"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "9ca50d952966036f9014c2eb7c49966e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e4a95cd3-7580-43f5-8c00-e70c91efe6af"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "dec3c1387042dc4972e4e47ec22f592128b55dfb" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "fe673c90-c8a3-4a41-9958-53e4faf82c5c"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "a113f5722a6e05ab62998e9981026ea0c3e9921c015bb17f16d2e6a5a941be86" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "fe8c1cc6-d747-4bc8-a8b8-48a6f71e205b"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "41b61f0ee1a785b4b50dc6bb6d3fb406de79fee78d52cd7f082f536bcec70e2bdb2285b4f9e9fe65a243ce9fbd3c74534b13e7ffb4b80586318f66464ca3dc48" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "0dbdf25b-edc4-4119-8e10-f5ddf74bcc49"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "1536:zbaNtsWhhcdSp94GvDkBBSz8crW4dYrml+IOlnToIfI0tUE7/1t:zb0GACjSwcrVGUsNTBfIEz7/1t" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "6e2cab76-605b-412c-ac64-7fa51bdfc84c"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--2d0875b8-37f8-4c74-a96c-0bab0a77af8b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:01.000Z" ,
"modified" : "2021-06-19T07:16:01.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "9a5eb5d2-214f-4175-b616-807b437623fa"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "3072" ,
"category" : "Other" ,
"uuid" : "9e2770da-f69c-4b1a-80f7-3ffe7a36c5ab"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "2.445945983115" ,
"category" : "Other" ,
"uuid" : "1039748f-9c20-4339-b84e-87ed3bf8aafd"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "cc5f99a67d584076176fae2f3822a191" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "64219115-abd3-445c-a6f2-54ffeacfa715"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "5772e72eec839165cb29caf4b52e83fcbad5124c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "65b9d621-0ae6-4ca4-a3c0-ecae12c57f08"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "a0e0e3344e21336ba23f866bde4aa5b5d994cdc9a5db9441d1ca39a055ba49ee" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f5c1d832-e7bd-4caa-97e0-03394bec9879"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "a9b1aba1d5914c051f2e8a1331e1cd68a7feccd73c90ac1f62281aa54a7c18bd1b319e3d5ca29739b77275f4a1f62d2f8db96c8a2fab31290fecce3a1cf56866" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "daccf9fd-fb93-4eae-959c-dfdc694d5235"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:gCccccq6uSkeKv6uSkeK8hBSqaZVUUey7UrAX/43KKKcmXu:gCccccqTk4TkvkhUnWAK/43KKbmXu" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "93c76331-21ce-4a2c-a27f-43d9330ab0cb"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--62f7447c-fc39-4d03-8172-ec14eaa04460" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:01.000Z" ,
"modified" : "2021-06-19T07:16:01.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".reloc" ,
"category" : "Other" ,
"uuid" : "483b6a43-5878-4f10-a165-b5dfe4ae7139"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "19456" ,
"category" : "Other" ,
"uuid" : "92705f82-bc5f-4414-badd-acfa6dbae84e"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.6971722413812" ,
"category" : "Other" ,
"uuid" : "659d8b6d-ccfe-46c8-8a14-eec4fc641635"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "f84ee5798792da4db33195dde77b6e91" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "86f23273-10a1-42f7-987c-51964342e3be"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "6b0669841917fa3b0fa6a62503d6cd3330ab9bd7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "050a977c-31b7-486f-a53f-e86cc1e23282"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "1723cc719741456e864cf779983360b269e9ca2638ab4e8b95d70f044aef02ca" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "edf4a79d-ebe1-4dc5-a8f6-53131c17942e"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "70219aafb3e592934811ed93dbb2d78c67f09bd8b2ecb99d2967a18a3b15c25c24101f50c90afa80a5b2b58794ed2a589e0349c6f6c8bee5a3297c60e23dce3a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "22ec4e14-b368-4e5e-bd59-7a107e5eaf5a"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "384:zLAv35Bi9RFgKcQvd0ZWA5FtuEYftV/G9astHmKiRw9LFjtbzlN803i:zAPARamd0W40ZftV/G9astH7SkBVl6Oi" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "e8682cb0-a1a1-403f-8c14-7117f83179b5"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--04314631-c3a6-48e8-bb9b-6d5bd11dabc0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:02.000Z" ,
"modified" : "2021-06-19T07:16:02.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "9bef26cd-6816-4709-a67f-a8f7a0d2d766"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "7168" ,
"category" : "Other" ,
"uuid" : "953a4d03-108c-4510-8552-55bb4748939b"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.0935798215195" ,
"category" : "Other" ,
"uuid" : "caf47a04-d970-4ef9-ad1e-9898030f163d"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "57118168edda6878c97381cdd163ffac" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "265f49be-7d74-457d-a040-27004fb6ea25"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "9232bb5492e5f8974534f8d2a37ba003f561d70d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "af07c6d3-5a43-481d-884a-d5305f053c0f"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "4fad497162606616d236882ae69b6408c6deb777e2a07e6d28232a612f879719" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "57744c29-9875-433f-9fbf-c708c0b311e9"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "f0f6eeade6d50faf9436e6c05b67eb53bb2db64349678761a8ed9d5135a7860ddeb6990f3440946aea5658fcb81bbd5ec225d4d8d0d2e5c511290bd5110eaeaa" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "09ca3df6-8d55-4cba-811a-caac946696a8"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:CvjcT6wXINa9M34/L6/sG/gj2v8NIAY3LgCp39myXOfQVvn8h8m:C06wXINaG3GO/p/gqEQ3UCp3syXOYWX" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "628182b9-3d6c-4aa7-b1d8-4e805869b267"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--70c9a0a2-55e7-4801-a1eb-38428b7753d0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:02.000Z" ,
"modified" : "2021-06-19T07:16:02.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "bd2342ca-082e-4933-8273-8d8d6c639b07"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2048" ,
"category" : "Other" ,
"uuid" : "74c89eaf-ba9c-4dc3-9205-083c45e7a7f0"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.8235535794019" ,
"category" : "Other" ,
"uuid" : "598d0a44-8978-4727-a00c-d4b65d34ef2d"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "b71e24a232cbf15c55c58f0bbe722b68" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "860e0f06-a82a-4aa0-94a1-31e021ea714d"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "5147860b708a336da3f27920a1b729390dc93e06" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "01013ce6-9dbc-4521-bd0c-a8bf3ac95864"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "9dd20c4ff51c2ea26bc0acb7f8d64de68957b31616dad2ae6225eb204ebbd934" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "8cb12f07-a471-4b8a-9d95-675163bcb54e"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "8be573ee5247c2167275697fe355042439ac78dac64b228e095d60092ca3e46fc13e094b48d6dd533b8451b819f5b10567b07994f4624ba35e67e46d1686bbd9" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "77f32174-8ff5-4924-ac8c-9028941870ac"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:ChoqgiPO4TCO18D8aUqSt9RwkrXkr99dIAMnF9AIaPPTW:6o9iPf/uSpzo99KI7HS" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "59d19c93-976c-4352-8899-3b03f64abe94"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--d7b4fe9a-b4f7-47fc-980f-a832d5436af0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:03.000Z" ,
"modified" : "2021-06-19T07:16:03.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "35ff0bfd-b6c1-487b-87ab-b142b77e177d"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "26624" ,
"category" : "Other" ,
"uuid" : "3642f81f-06c9-412a-bf2d-c6fedbb58c04"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "6.3151171440822" ,
"category" : "Other" ,
"uuid" : "6fe58e3a-bc98-448b-bc10-afe2c20ee24f"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "cf0b16eca2aedff96b586a2add8e956e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "0bc9fd2a-3c11-4eaf-bd9c-fe2d3665cc9c"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "6b3099c00646a54d25d96c0d9a3394463394083d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "0413784f-b90a-47b6-8d3f-4fd23a0bca57"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "e64daa8926bfab138ddbe16a1f84ff4dd67984b06d0d908fecab21f051e7786a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a5cff96d-ce55-4499-a2ea-8c0d090d6baa"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "f408833fd42da728bd7f89f4e288a4fbe1651cff3a26fa911cd09f845302d678c70037ceb36b3d58dba910d1b93ec602fa0f9ac13ae63936c4332d4c0f89c049" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "4b927828-da7c-49dd-bb6b-311b1fe61648"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "384:T7ptyfdBgZqCq6pWKksgl2IYdSuC2WigRelS1K8C1x2i7JxhsmuH40m+wMe3ifsY:T1ZqCQKy8IYdfWiUelR36ihR6nmRYsY" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "445c7bba-45df-4a35-86d1-83133ede8de8"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--1567f95b-65c3-4730-bc4d-93bc73d5892d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:03.000Z" ,
"modified" : "2021-06-19T07:16:03.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".rdata" ,
"category" : "Other" ,
"uuid" : "f92dbb37-647a-4047-ad4b-6c22939029ab"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "4096" ,
"category" : "Other" ,
"uuid" : "8ae0a71a-1e36-43f3-826a-d3f6caaac33a"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.5671717525546" ,
"category" : "Other" ,
"uuid" : "801b8b84-340f-4ab1-b98c-eac2cabd3a97"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "aff5b1cfc5506fa3a5d8804efc11d698" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "49b3ee44-c48b-46a3-97fc-fce1d414e4db"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "c46d865af7939046f409156a9f50cacf86a70d94" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ad4c5607-06e3-4ea1-9f94-c9a460d18f3a"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "822da4186064486ce61c2d4f9840ecc9e962c0317e8faa62460944118a439eee" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a541e783-1fc5-4f3d-9d55-6d1117252c33"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "4ed646b46f415c4d9eb9f15e19be64e8924fa9db941bdfaf5d4452319b099c212145a1c9e211560d03780644070c0c04afe425dac13d037f62d0a2a9c5bcaf14" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "10ca781e-74f0-4434-a1ee-25a6c6115897"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:rwcdILFDTZ8qNEFw6QNOyjKsBAXpQXQcPhhpHP52VosLHMEiLnRVsxO3YU4dTh+s:r4CxefzfZR2SsaROOrOBEM" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "abc211f9-0943-4f64-9f62-c695b28e3568"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--020e7d50-df08-4474-ae41-7f5120f0e7de" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:03.000Z" ,
"modified" : "2021-06-19T07:16:03.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "102ce2a1-79f2-459e-aca8-4c282221ef29"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "10752" ,
"category" : "Other" ,
"uuid" : "034b4f4d-1c2f-4ef5-b46c-0224e98a009e"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "0.6671648510441" ,
"category" : "Other" ,
"uuid" : "c2ccf7a2-99fa-4a6a-9376-845d8e975940"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "4c60b1abdf10c563cf887337d224e16e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "4157a669-45a3-4ff0-9d46-ca91d3d1fbb5"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "1672fe96a78d97957a10d762a4e4be151feaf820" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "fb820d47-8390-4cc7-aaae-1359a2cc1f2d"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "5c0948fdd61baf6a4dbf6dc1b8d2980edcbe81ab47a203e73358432c99607d0e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "6c6616a7-b663-4b81-902e-f82e439a0601"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "1bc13c7564fc100b3bcb7e0b269d0a0b089810247cafb43800987c0ff4438748f335bb1e6bb5d9e33644c490ddeaae7f3066f55ffb3c3a8eb0de09eed93e9613" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "523f0b32-18f6-42b5-93e1-24a537c2568d"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:W5fI5K9PJtoa+0SC8gTMCkzVk1yu6wnffu6wnfX6/1nS:MmK9PJto8SbgQW196w+6wP6/9S" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "40728d43-984c-4d5b-b2ec-c0773f108031"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5762f80a-2219-4fa7-b847-5d16c739f152" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:04.000Z" ,
"modified" : "2021-06-19T07:16:04.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".pdata" ,
"category" : "Other" ,
"uuid" : "0d892f5c-3c0e-4399-a5c2-d7b3503389d4"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2048" ,
"category" : "Other" ,
"uuid" : "65b7cda8-b0db-47a1-affa-254b69e646e3"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.4171417196239" ,
"category" : "Other" ,
"uuid" : "db55d821-dada-4280-9e24-989010f0260b"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "af11065588ff1be5e27be4cd684508b9" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1b7df6b3-f97f-4cbf-8c66-9c46d8899c80"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "5aca630b4b10132b3933a7919d630b37a2d77e4a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "243ad98c-05b4-43e8-b451-7c35a5a1987e"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "20b45bf068739ca996e0b62119b8f06045946193bd1fee9e963eab141b90865d" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "4b82b047-9d72-4db1-bc79-89f4db20d541"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "67c859d7e9cc3a0a0dafffdec1e2cc1a3950c32a9655d38520b9670df9a213bf29ce2c00c2e50e3fa24f999cc45c3dc748ca75121244a95a41a8bc447e38d8e0" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b06ed357-6a1b-4a15-9d71-e6ed85b8571f"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "24:rLIjwvEE2vBxBtsyzw1o9/PlmOOKbcyIp341BqCLoosPTLiZeS7:PcwCBxfzw12FmGbc+CHlLi77" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "eb702ec8-13ba-4bff-acf5-15b6a1bd8283"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--3573f36a-2d32-42d2-bf5f-2d91a580510e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:04.000Z" ,
"modified" : "2021-06-19T07:16:04.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "INIT" ,
"category" : "Other" ,
"uuid" : "2f9191ac-ca9f-4745-8400-6399dafe9998"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "3584" ,
"category" : "Other" ,
"uuid" : "c4bd0a97-188c-4e49-8257-180560e20684"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.1718697425243" ,
"category" : "Other" ,
"uuid" : "44bbedb1-ed0e-4ac2-bf97-979da77bd8fa"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "bf3aaff8a4f25625c50651a235f234ea" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d6922e1d-c35a-44f2-b47f-4ca6f963cdc2"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "efa19aba8be359ef3d1671eea2533d40a8ad3574" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "af6d4c7c-bc6a-4d1b-866d-92163ffb3a44"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "0df32b5ab983d4f13d1f4d350e1a92f66e41350711886943720894025588ea7a" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "0e74e8ac-63d6-4521-96ea-1ce8dd2a9af5"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "b3d5d87dfff44bc6cbf37f4f514c223bff7229ac93342c2754effb6d6b5a91fd01939160e5ef37c5edb66ae94670b7ef9387004102d1aa6aa128a32bd7f31bee" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "12cdad28-1e42-43e3-bee7-6a38637c489b"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:qjHwcdILFDTZ8qNeDYDOjNe7kBtWt2BpRbD+KCm7MuINTg3nuO4EgdW/lLWfe:qjH4ChDY6A2BXbD1XN2EgdW/lLW2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "cfa7891d-cc95-4bf3-bc9e-03c097a238c7"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--eee305b5-1d33-4751-8438-e4e425dce7cd" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:04.000Z" ,
"modified" : "2021-06-19T07:16:04.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".reloc" ,
"category" : "Other" ,
"uuid" : "d91e4256-f293-4c45-a630-518b5d6c4b9d"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "512" ,
"category" : "Other" ,
"uuid" : "b8628b7f-67c5-4fd9-9a7d-aabff5c9ddbe"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "3.6204816846131" ,
"category" : "Other" ,
"uuid" : "244a9eb2-2db8-45a3-af55-4656ed8cb6f2"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "fcb8a85ae2d11c0aefad6b5535e1bc90" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "baf359d5-ce30-40c2-8fb4-e1fca5914020"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "12c935664a10eea034a86053d7dad2c872d582e7" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "ef2bf816-5eac-4098-8226-9ad372724aa6"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "199727264dad79db742e501ee665c0adb8a5e08f70158dd23a8780663e330e0e" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "6e26172f-5fac-4fa4-8740-b66db865c103"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "aa6cd28eb6eb70ef70229126734a359aed53a505608162ee9462c5bbdc9790e4c35336c52f39941988c3f7c9ee8b4c1d53c9e44b241bf2dd75cb827a61777419" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f5de927d-5aa4-482d-8a67-b37ce7365540"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "3:X96q9llvt1CtC4/:0+6tC4/" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "18e0a65a-c0f6-4dd8-b4fe-6536d2e34ba0"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--81b3754b-947e-4508-abe9-c9485907355d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:05.000Z" ,
"modified" : "2021-06-19T07:16:05.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "UPX0" ,
"category" : "Other" ,
"uuid" : "92a9ebf2-7c9b-4f87-87ff-dbece271679e"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "0" ,
"category" : "Other" ,
"uuid" : "85967f2a-4219-40cb-899e-68f79ff4c6d9"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5ac0e594-a97e-459e-822e-a5817e4a7164" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:05.000Z" ,
"modified" : "2021-06-19T07:16:05.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "UPX1" ,
"category" : "Other" ,
"uuid" : "3508ff9a-f36d-44d2-8e2f-9243711341b6"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "5120" ,
"category" : "Other" ,
"uuid" : "3807a3c3-f83b-4c5f-939c-730b8773963d"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "7.508942901406" ,
"category" : "Other" ,
"uuid" : "43e0f8f6-1d39-4cf6-bd3c-06c4bedd0196"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "ccae6ab3ef57e1a2745c58bf1c5ff494" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f3d605e7-f655-4ba1-af73-d21385b85ef0"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "3a19ec072786bf350b7561e638bc15b44c095d16" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "09cfac7d-eefc-4d4e-8756-c1879f78fede"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "29141ae55c5d686794d357ff09dc8270f1e734652a561f37cefaebedb283bae1" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "89a01a0e-7ad0-4862-bac7-71adab6152b9"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "69550da8fd01abbd719506505797aca6fdf587c4d1b54d864004b4cab1fd436013c8c5358c9075f063e6a77b3e04c4e5f15064e37e5fe6e56eeed57d73f9d24c" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "a2c119f8-a106-4be7-a74d-ec003a7cc9ed"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:9nXD23Cm0IShlUrCWHVwsMMej2TQu20p05ZPUcNVG7lEqhZRi2wot6xMvazl:9j3IOUBVIuQue567lvhZTHtdcl" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "1bd6f798-d184-465a-9f04-c233418b43b1"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--4a858930-96b7-495e-9d9c-70ead6e7652c" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:05.000Z" ,
"modified" : "2021-06-19T07:16:05.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : "UPX2" ,
"category" : "Other" ,
"uuid" : "60a9921d-e030-43c3-a5a0-d63d46c1439f"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "512" ,
"category" : "Other" ,
"uuid" : "496ca0ab-96a6-4f8b-a2c0-7f8a09c3dacc"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "2.0018429810303" ,
"category" : "Other" ,
"uuid" : "e2aee878-48c1-419c-9357-2c9a154eb8f3"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "6788768dca66f72f50487409a60d2178" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "7f4fc03b-82f1-4cdf-afb4-26ce260bd373"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "f52833e57211e02f15c0ffdbf9b5212fc5e5eebd" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "843a08fa-61b0-44ad-b2cf-9a1bf0a94837"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "6e2d461d20a0b424272beb9d17ae5687b46fea1dbee2b398b5ec0ab6c52097f2" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "6b47c0a8-a576-4f9b-bd41-cee87554b0a3"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "d22b7cc251b2527ae69e3fe0ec47b9d637d8390c766abdd2bd7f69cf436c6e5c912dcde530df218bbf01447cfca89fa00880fade34d91af356da37d6d13d24e5" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b1e6662e-e10e-4232-8beb-b8ac8d34253c"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "3:clf/llVLNjX//Jrs+ctpKklDIth6lizJ1SgzJkJCRJjdlgKaXRRAAHhHt:cHrklGSedloBRAQ" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3b5725c5-638c-4f60-a97b-4987fa39c790"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--ac495c0b-7c85-42b5-af1c-5448b40f5987" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:06.000Z" ,
"modified" : "2021-06-19T07:16:06.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".text" ,
"category" : "Other" ,
"uuid" : "3bccc07c-d37e-40b9-ad88-dbdbeb205f66"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "6144" ,
"category" : "Other" ,
"uuid" : "804ca645-4510-4127-b7e0-7e34e4adfe74"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "5.0346994054755" ,
"category" : "Other" ,
"uuid" : "0b9b4cd0-a80c-438c-bae7-bf6e5653e557"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "72a513a5d0b5ad70b8090fbc35439458" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "9d0385b2-9233-4179-aee1-520aac07b53c"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "b18105716636ecd4d852101654fb5c50cf5fb735" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "d38528ae-c086-4f13-a8f0-6ecb5f603eac"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "7f0a3160ecafe114e4ceaf85c001f46297c7dc055541e59f67581b33ef22d726" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "f7a69422-d7e0-42bd-a58e-e26fecb525dd"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "2ca362483345160413a5ec08bf5a94855c392609c97736f954c1b244583a6fb68d59dbe88314afc6c19828d7409e1862dc5648c5fe152d783eb23f06d5d5a715" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "49e38680-fa2d-419a-94d5-b919b77b1616"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "96:IzBcvteJ3ca9M34/L6/sGfQmVpt8AC3L3a/39jQUoLD+rHeUzDBI:IKteJ3caG3GO/pfQmHO3Ti3pHeUzDBI" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "adc48678-70db-4b98-9961-ff108afd3559"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--df11c33f-30d2-4c05-b727-bd223e59296e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2021-06-19T07:16:06.000Z" ,
"modified" : "2021-06-19T07:16:06.000Z" ,
"labels" : [
"misp:name=\"pe-section\"" ,
"misp:meta-category=\"file\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "name" ,
"value" : ".data" ,
"category" : "Other" ,
"uuid" : "ae73765c-490b-48f8-95e3-63baaa3c8ad3"
} ,
{
"type" : "size-in-bytes" ,
"object_relation" : "size-in-bytes" ,
"value" : "2048" ,
"category" : "Other" ,
"uuid" : "9643e6e8-2963-481c-8676-92eea01c5704"
} ,
{
"type" : "float" ,
"object_relation" : "entropy" ,
"value" : "4.9702676948355" ,
"category" : "Other" ,
"uuid" : "a8068e29-dde3-4c44-875a-00869748f4e2"
} ,
{
"type" : "md5" ,
"object_relation" : "md5" ,
"value" : "220bb86509378eb738d76536fd661248" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "838b75ed-6959-4109-b49b-716dacbe6e18"
} ,
{
"type" : "sha1" ,
"object_relation" : "sha1" ,
"value" : "0c8558886dc869749a141417d6af55ce6543a712" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "6ea699d0-9014-4dd4-90ca-bb0da4349c48"
} ,
{
"type" : "sha256" ,
"object_relation" : "sha256" ,
"value" : "8ae6d4330775fb1ca101f8520871f54a0ceded00e6440c08aea069a62b7f4efc" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "3cca435a-ff8b-45bd-bfd0-67f65bdefc3c"
} ,
{
"type" : "sha512" ,
"object_relation" : "sha512" ,
"value" : "7a8c0a3b8f3bd12501033d844f1c14d65ffc1a9434bfa32562784f9717f50a27206b56a1fc77c31b1c98bbac341dc992eb171e3e8e9ef790608627bb84e83078" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "b8611e3f-10c6-4f72-8547-6112cf367993"
} ,
{
"type" : "ssdeep" ,
"object_relation" : "ssdeep" ,
"value" : "48:ChoqgOKvPO4TCO121qgugj9dIAM/47RKW:6o9FvPf/4v9K4RV" ,
"category" : "Payload delivery" ,
"to_ids" : true ,
"uuid" : "901ce007-1537-447f-888a-96c18e3755e5"
}
] ,
"x_misp_meta_category" : "file" ,
"x_misp_name" : "pe-section"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
