misp-circl-feed/feeds/circl/misp/57c8398d-2238-41df-bbc7-45b7950d210f.json

{
    "type": "bundle",
    "id": "bundle--57c8398d-2238-41df-bbc7-45b7950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:16.000Z",
            "modified": "2016-09-01T14:35:16.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--57c8398d-2238-41df-bbc7-45b7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:16.000Z",
            "modified": "2016-09-01T14:35:16.000Z",
            "name": "Malware Posing as Human Rights Organizations and Commercial Software Targeting Iranians, Foreign Policy Institutions and Middle Eastern Countries (ExtremeDownloader and Strealer)",
            "published": "2016-09-01T14:35:51Z",
            "object_refs": [
                "indicator--57c83a33-f6d4-4791-a524-47fe950d210f",
                "indicator--57c83a33-53e8-4a85-88cb-4c30950d210f",
                "indicator--57c83a34-7500-4033-a076-47f4950d210f",
                "indicator--57c83a34-eb4c-4010-9c4f-432f950d210f",
                "indicator--57c83a34-3e24-4416-8f90-4a25950d210f",
                "indicator--57c83a35-0c04-4523-8f40-42bb950d210f",
                "indicator--57c83a35-4ab4-49b0-80a3-43c3950d210f",
                "indicator--57c83a36-7eb8-418f-8181-4bb4950d210f",
                "indicator--57c83aa3-897c-4a04-ba98-435d950d210f",
                "indicator--57c83aa4-42e4-40b0-a045-470c950d210f",
                "indicator--57c83aa4-d7ac-4cb8-a9cb-4d31950d210f",
                "indicator--57c83aa4-99b4-4d1a-9bbb-4542950d210f",
                "observed-data--57c83bfb-4838-4a75-9522-41bc950d210f",
                "url--57c83bfb-4838-4a75-9522-41bc950d210f",
                "indicator--57c83ca4-d5bc-49b7-9778-48a102de0b81",
                "indicator--57c83ca5-2308-4ce2-b870-4cc202de0b81",
                "observed-data--57c83ca5-89ac-4e60-b7d0-4eda02de0b81",
                "url--57c83ca5-89ac-4e60-b7d0-4eda02de0b81",
                "indicator--57c83ca5-ec84-4e30-90f7-4f8d02de0b81",
                "indicator--57c83ca5-f860-4991-b6ee-486302de0b81",
                "observed-data--57c83ca5-971c-45a8-89ae-428d02de0b81",
                "url--57c83ca5-971c-45a8-89ae-428d02de0b81",
                "indicator--57c83ca6-be84-471d-bc23-428402de0b81",
                "indicator--57c83ca6-d4e0-46d3-9a59-4e8702de0b81",
                "observed-data--57c83ca6-ca38-4a27-805b-4e8702de0b81",
                "url--57c83ca6-ca38-4a27-805b-4e8702de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "circl:incident-classification=\"malware\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83a33-f6d4-4791-a524-47fe950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:29:34.000Z",
            "modified": "2016-09-01T14:29:34.000Z",
            "description": "Payloads",
            "pattern": "[file:name = 'newlity.exe' AND file:hashes.SHA256 = 'a62dde31eecf650c2dd39eeda9daf8fd35b1dff5330e72035d1846579ea838dc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:29:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83a33-53e8-4a85-88cb-4c30950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:29:34.000Z",
            "modified": "2016-09-01T14:29:34.000Z",
            "description": "Payloads",
            "pattern": "[file:name = 'private_chat.exe' AND file:hashes.SHA256 = '1a24714fd99030bd63804ab96fc2612f148a5f08d1c2845152c3a0e168600db9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:29:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83a34-7500-4033-a076-47f4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:29:34.000Z",
            "modified": "2016-09-01T14:29:34.000Z",
            "description": "Payloads",
            "pattern": "[file:name = 'multiplay-register.exe' AND file:hashes.SHA256 = 'e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:29:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83a34-eb4c-4010-9c4f-432f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:29:34.000Z",
            "modified": "2016-09-01T14:29:34.000Z",
            "description": "Payloads",
            "pattern": "[file:name = 'TeamSpeak.EXE' AND file:hashes.SHA256 = '13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:29:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83a34-3e24-4416-8f90-4a25950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:29:52.000Z",
            "modified": "2016-09-01T14:29:52.000Z",
            "description": "Extreme downloader",
            "pattern": "[file:name = 'dwm.exe' AND file:hashes.SHA256 = 'e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:29:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83a35-0c04-4523-8f40-42bb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:30:01.000Z",
            "modified": "2016-09-01T14:30:01.000Z",
            "description": "Dropper / Moreoriz",
            "pattern": "[file:name = 'contask.exe' AND file:hashes.SHA256 = 'b0afef1ee97c8a9a7a7d4a83b5d8aab3a710062d9df98f909a3306c031e2cc21']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:30:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83a35-4ab4-49b0-80a3-43c3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:30:13.000Z",
            "modified": "2016-09-01T14:30:13.000Z",
            "description": "Strealer",
            "pattern": "[file:name = 'mozilla.exe' AND file:hashes.SHA256 = '3a8995413b8e63dca766999c5a3220114e4ab4c446130c5bd7c852a618dd2fa7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:30:13Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83a36-7eb8-418f-8181-4bb4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:30:16.000Z",
            "modified": "2016-09-01T14:30:16.000Z",
            "description": "TightVNC",
            "pattern": "[file:name = 'vn.exe' AND file:hashes.SHA256 = '1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:30:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83aa3-897c-4a04-ba98-435d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:26:43.000Z",
            "modified": "2016-09-01T14:26:43.000Z",
            "description": "C2",
            "pattern": "[domain-name:value = 'apache-utility.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:26:43Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83aa4-42e4-40b0-a045-470c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:26:44.000Z",
            "modified": "2016-09-01T14:26:44.000Z",
            "description": "C2",
            "pattern": "[domain-name:value = 'microsoft-hotfix.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:26:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83aa4-d7ac-4cb8-a9cb-4d31950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:26:44.000Z",
            "modified": "2016-09-01T14:26:44.000Z",
            "description": "C2",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.152.202.53']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:26:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83aa4-99b4-4d1a-9bbb-4542950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:26:44.000Z",
            "modified": "2016-09-01T14:26:44.000Z",
            "description": "C2",
            "pattern": "[domain-name:value = 'update-finder.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:26:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57c83bfb-4838-4a75-9522-41bc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:32:27.000Z",
            "modified": "2016-09-01T14:32:27.000Z",
            "first_observed": "2016-09-01T14:32:27Z",
            "last_observed": "2016-09-01T14:32:27Z",
            "number_observed": 1,
            "object_refs": [
                "url--57c83bfb-4838-4a75-9522-41bc950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57c83bfb-4838-4a75-9522-41bc950d210f",
            "value": "https://iranthreats.github.io/resources/human-rights-impersonation-malware/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83ca4-d5bc-49b7-9778-48a102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:16.000Z",
            "modified": "2016-09-01T14:35:16.000Z",
            "description": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
            "pattern": "[file:hashes.SHA1 = 'b89d8b5bd6f9bf1c1d61f0d3851dec9cf4216b9b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:35:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83ca5-2308-4ce2-b870-4cc202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:17.000Z",
            "modified": "2016-09-01T14:35:17.000Z",
            "description": "TightVNC - Xchecked via VT: 1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae",
            "pattern": "[file:hashes.MD5 = 'a2ff24322c12558eb1f29aea3ca6f24a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:35:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57c83ca5-89ac-4e60-b7d0-4eda02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:17.000Z",
            "modified": "2016-09-01T14:35:17.000Z",
            "first_observed": "2016-09-01T14:35:17Z",
            "last_observed": "2016-09-01T14:35:17Z",
            "number_observed": 1,
            "object_refs": [
                "url--57c83ca5-89ac-4e60-b7d0-4eda02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57c83ca5-89ac-4e60-b7d0-4eda02de0b81",
            "value": "https://www.virustotal.com/file/1ba26bcd857944b0486a76928f41f74d91dad492b46ea93c4ca246a0503cdaae/analysis/1452468082/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83ca5-ec84-4e30-90f7-4f8d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:17.000Z",
            "modified": "2016-09-01T14:35:17.000Z",
            "description": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
            "pattern": "[file:hashes.SHA1 = 'd5144c73f7e7c961bc2823cf002892eee70c4dbf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:35:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83ca5-f860-4991-b6ee-486302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:17.000Z",
            "modified": "2016-09-01T14:35:17.000Z",
            "description": "Extreme downloader - Xchecked via VT: e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716",
            "pattern": "[file:hashes.MD5 = 'ccaf21e122ca9d2e2397a9e28eb4cc87']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:35:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57c83ca5-971c-45a8-89ae-428d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:17.000Z",
            "modified": "2016-09-01T14:35:17.000Z",
            "first_observed": "2016-09-01T14:35:17Z",
            "last_observed": "2016-09-01T14:35:17Z",
            "number_observed": 1,
            "object_refs": [
                "url--57c83ca5-971c-45a8-89ae-428d02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57c83ca5-971c-45a8-89ae-428d02de0b81",
            "value": "https://www.virustotal.com/file/e6cd39cf0af6a0b7d8129bf6400e671d5fd2a3797b92e0fe4a8e93f3de46b716/analysis/1470948989/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83ca6-be84-471d-bc23-428402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:18.000Z",
            "modified": "2016-09-01T14:35:18.000Z",
            "description": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
            "pattern": "[file:hashes.SHA1 = 'f2179dbba6a4f132864d8edd38c26991ac21559d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:35:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57c83ca6-d4e0-46d3-9a59-4e8702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:18.000Z",
            "modified": "2016-09-01T14:35:18.000Z",
            "description": "Payloads - Xchecked via VT: 13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9",
            "pattern": "[file:hashes.MD5 = '77857588c41f778b7660d4e52634a4e3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-09-01T14:35:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57c83ca6-ca38-4a27-805b-4e8702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-09-01T14:35:18.000Z",
            "modified": "2016-09-01T14:35:18.000Z",
            "first_observed": "2016-09-01T14:35:18Z",
            "last_observed": "2016-09-01T14:35:18Z",
            "number_observed": 1,
            "object_refs": [
                "url--57c83ca6-ca38-4a27-805b-4e8702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57c83ca6-ca38-4a27-805b-4e8702de0b81",
            "value": "https://www.virustotal.com/file/13c462f6606c20d23796d6b937b0fa6887029dc68f2a3376cc3fa1e068a833e9/analysis/1470330553/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}