2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--5b50b23c-d7f0-4195-8512-13c30acd0835",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2021-05-24T09:50:13.000Z",
|
|
|
|
|
"modified": "2021-05-24T09:50:13.000Z",
|
|
|
|
|
"name": "Synovus Financial",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--5b50b23c-d7f0-4195-8512-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2021-05-24T09:50:13.000Z",
|
|
|
|
|
"modified": "2021-05-24T09:50:13.000Z",
|
|
|
|
|
"name": "Email Credential Phish, Dropbox Theme",
|
|
|
|
|
"published": "2020-07-02T06:01:56Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--5b50b23d-c010-457e-aee4-13c30acd0835",
|
|
|
|
|
"indicator--5b50b23d-ac94-4e1b-9003-13c30acd0835",
|
|
|
|
|
"indicator--5b50b23d-67a4-48ba-8a4f-13c30acd0835",
|
|
|
|
|
"indicator--5b50b23d-80e0-497c-bc6a-13c30acd0835",
|
|
|
|
|
"indicator--5b50b23d-db9c-4f85-a1f1-13c30acd0835",
|
|
|
|
|
"indicator--5b50b23d-a688-45c7-b4af-13c30acd0835",
|
|
|
|
|
"indicator--5b50b41d-ad64-48a4-aed8-ffb30acd0835",
|
|
|
|
|
"observed-data--5b50b4e8-ee38-4349-9811-13c30acd0835",
|
|
|
|
|
"file--5b50b4e8-ee38-4349-9811-13c30acd0835",
|
|
|
|
|
"artifact--5b50b4e8-ee38-4349-9811-13c30acd0835",
|
|
|
|
|
"observed-data--5b50b4e8-51d8-4363-b8e1-13c30acd0835",
|
|
|
|
|
"file--5b50b4e8-51d8-4363-b8e1-13c30acd0835",
|
|
|
|
|
"artifact--5b50b4e8-51d8-4363-b8e1-13c30acd0835",
|
|
|
|
|
"observed-data--5b50b4e8-8968-4de9-a6d2-13c30acd0835",
|
|
|
|
|
"file--5b50b4e8-8968-4de9-a6d2-13c30acd0835",
|
|
|
|
|
"artifact--5b50b4e8-8968-4de9-a6d2-13c30acd0835",
|
|
|
|
|
"observed-data--5b50b4e8-19b4-4c7d-85d6-13c30acd0835",
|
|
|
|
|
"file--5b50b4e8-19b4-4c7d-85d6-13c30acd0835",
|
|
|
|
|
"artifact--5b50b4e8-19b4-4c7d-85d6-13c30acd0835",
|
|
|
|
|
"indicator--5b50b4a0-d69c-452d-8bde-eb520acd0835"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"veris:action:social:variety=\"Phishing\""
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
2023-06-14 17:31:25 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5b50b23d-c010-457e-aee4-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"pattern": "[url:value = 'https://ahqcs.fr/.quantum/1/direct.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-07-19T15:53:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "External analysis"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"External analysis\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
2023-06-14 17:31:25 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5b50b23d-ac94-4e1b-9003-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"pattern": "[url:value = 'https://abri.org/.q/1/emailprovider/signin/off.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-07-19T15:53:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "External analysis"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"External analysis\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
2023-06-14 17:31:25 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5b50b23d-67a4-48ba-8a4f-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"pattern": "[url:value = 'https://abri.org/.q/1/emailprovider/signin/other.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-07-19T15:53:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "External analysis"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"External analysis\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
2023-06-14 17:31:25 +00:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5b50b23d-80e0-497c-bc6a-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"pattern": "[url:value = 'https://abri.org/.q/1/emailprovider/signin/Gmaildocs.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-07-19T15:53:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "External analysis"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"External analysis\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5b50b23d-db9c-4f85-a1f1-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:53:04.000Z",
|
|
|
|
|
"pattern": "[url:value = 'https://abri.org/.q/1/emailprovider/signin/connect.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-07-19T15:53:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "External analysis"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"External analysis\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5b50b23d-a688-45c7-b4af-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:54:30.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:54:30.000Z",
|
|
|
|
|
"description": "Compromised WordPress Site",
|
|
|
|
|
"pattern": "[domain-name:value = 'ahqcs.fr']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-07-19T15:54:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5b50b41d-ad64-48a4-aed8-ffb30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:54:32.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:54:32.000Z",
|
|
|
|
|
"description": "Compromised WordPress Site",
|
|
|
|
|
"pattern": "[domain-name:value = 'abri.org']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-07-19T15:54:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5b50b4e8-ee38-4349-9811-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:57:47.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:57:47.000Z",
|
|
|
|
|
"first_observed": "2018-07-19T15:57:47Z",
|
|
|
|
|
"last_observed": "2018-07-19T15:57:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"file--5b50b4e8-ee38-4349-9811-13c30acd0835",
|
|
|
|
|
"artifact--5b50b4e8-ee38-4349-9811-13c30acd0835"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"attachment\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "file",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "file--5b50b4e8-ee38-4349-9811-13c30acd0835",
|
|
|
|
|
"name": "other mail phish page.jpg",
|
|
|
|
|
"content_ref": "artifact--5b50b4e8-ee38-4349-9811-13c30acd0835"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "artifact",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "artifact--5b50b4e8-ee38-4349-9811-13c30acd0835",
|
|
|
|
|
"payload_bin": "/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wAARCAKgBQQDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD9KvNf++350ea/99vzptUNe1/TfC+k3OqavfQabp1su+a5uXCIg9yffgDuTigDR81/77fnR5r/AN9vzrzP4R/G7T/ilcavp8lqNE17TZQsmlzT75WiKIfOUFVJQSF4yccNGfUV6VTatuA7zX/vt+dHmv8A32/Om0UgHea/99vzqG81KPT7Z7i5uBBCgyzu2AKkrI0q3GuajJqU4329tK0VlGegKkq8vuScqPQDI+8aAHJrOrX3zWOlSeSfuy30/wBnDe4UBmA/3lB9qH1nVrH5r7SpPJH3pbGf7QF9ypCsR/uqT7U3x94+0T4Z+F7zX9fuxaafbjHAy8rn7sca/wATseAB+gBNYnwW+Lll8avBf/CQ2WmXukqtzJayWt8o3B0wcqw+V1ww5HfI6g0AddZ6lHqFslxbXAnhcZV0bINTea/99vzrA1Tw7pFrr0GrXWlWN5BdSJbXi3NskmCxCpKCw4IYgH1DZP3RXTzeB/CtvC8svh/R4oo1LO72UQVQBkknbwKAK/mv/fb86PNf++351xMPiTwpqkP23RPhhfeINExkavY6TaJBIv8AfjSaRJZVPZo42DdVJrrPDGl+BfGWkR6npGjaRdWjM0ZJ05EeN1JV43RkDI6kEFWAIIwRQBa81/77fnR5r/32/OsjxpN8Nfh5Zw3PiKz0HS4pmKxCWyjLyEYztVVLHGRkgcZGetami+HfBPiTS7fUtL0jQ7+wuF3RXFvaQsjjODghexBBHYgis1Ug5umpLmXTqTzxcuVPUf5r/wB9vzo81/77fnUc3hXwxDrtnpv/AAi+kn7RbTXHmfY4vl8tolxjbznzeueNvvxaHg3wi121qND0U3KoJWh+yQ7whJAYrjOCVIz7H0rQoh81/wC+350ea/8Afb86t/8ACA+GP+hc0n/wBi/+Jo/4QHwx/wBC5pP/AIAxf/E0AVPNf++350ea/wDfb86t/wDCA+GP+hc0n/wBi/8AiaP+EB8Mf9C5pP8A4Axf/E0AVPNf++350ea/99vzp0fhXwZN5OzR9CfznaOLbawne653KvHJG1sgdNp9KNS8J+DdG0+6v9Q0bQrGwtYmnuLq5tYY4oY1BLO7MAFUAEkngAUAN81/77fnR5r/AN9vzqzF4H8KzxpJH4f0eSNwGV1soiGB6EHbyKrTeGfBVvqltpsuk6BHqNzHJNBZvbQCaWNCod1TGWVS6ZIGBuXPUUABlc9XY/jSbj6mrn/CA+GP+hc0n/wBi/8AiaP+EB8Mf9C5pP8A4Axf/E0AU9x9TRuPqauf8ID4Y/6FzSf/AABi/wDiaih8F+ErhpVi0LRZWhfy5AlnCSjYB2nC8HBBwfUUAV6Ku/8ACA+GP+hc0n/wBi/+Jqlc+HPBFnb3E9xpfh+CC2fy55ZLeBVibAO1iRhThl4PqPWgAoqxceC/CVqqtPoWiwqzrGpks4VBZjhVGV6kkADvmpf+EB8Mf9C5pP8A4Axf/E0AUqKu/wDCA+GP+hc0n/wBi/8AiaP+EB8Mf9C5pP8A4Axf/E0AUqKnuPB3hG1aFZ9D0SFpn8uJZLSFS7YJ2rkcnAJwOwNLa+DPCV9bRXFtoWi3FvKoeOWKzhZHU9CCBgigCvRV3/hAfDH/AELmk/8AgDF/8TR/wgPhj/oXNJ/8AYv/AImgClRVi68F+ErK3luLjQdFggiUvJLLZwqqKBkkkrgADvSXHg/whZ2j3VxomiQWsa73mktIVRV9SxGAPegCCirv/CA+GP8AoXNJ/wDAGL/4mj/hAfDH/QuaT/4Axf8AxNAFKirFv4L8JXkXmwaFos8e5l3x2cLDKkqwyF6ggg+4NIvg3wi109quh6KblEWRoRaQ71UkgMVxkAlTg+xoAgoq7/wgPhj/AKFzSf8AwBi/+JqG68G+EbGIS3Oh6Lbx7lTfLaQqNzEKoyR1JIA9SRQBBRV3/hAfDH/QuaT/AOAMX/xNRL4L8JSXEkC6ForTxqrPELOEsobO0kbcgHBx64NAFeirv/CA+GP+hc0n/wAAYv8A4morbwb4RvFdrfQ9FnVHaJmjtIWCupwynA4IIII7EUAQbiOho3H1NXP+EB8Mf9C5pP8A4Axf/E0f8ID4Y/6FzSf/AABi/wDiaAKe4+ppRIy9GYfjVv8A4QHwx/0Lmk/+AMX/AMTUVt4N8I3iu1voeizqjtEzR2kLBXU4ZTgcEEEEdiKAIfNf++350ea/99vzq3/wgPhj/oXNJ/8AAGL/AOJo/wCEB8Mf9C5pP/gDF/8AE0AVPNf++350ea/99vzq3/wgPhj/AKFzSf8AwBi/+Jo/4QHwx/0Lmk/+AMX/AMTQBU81/wC+350ea/8Afb86t/8ACA+GP+hc0n/wBi/+Jo/4QHwx/wBC5pP/AIAxf/E0AVPNf++350ea/wDfb86t/wDCA+GP+hc0n/wBi/8AiaP+EB8Mf9C5pP8A4Axf/E0AVPNf++350ea/99vzq3/wgPhj/oXNJ/8AAGL/AOJo/wCEB8Mf9C5pP/gDF/8AE0AVPNf++350ea/99vzq3/wgPhj/AKFzSf8AwBi/+Jo/4QHwx/0Lmk/+AMX/AMTQBU81/wC+350ea/8Afb86t/8ACA+GP+hc0n/wBi/+Jo/4QHwx/wBC5pP/AIAxf/E0AVPNf++350ea/wDfb86t/wDCA+GP+hc0n/wBi/8AiaP+EB8Mf9C5pP8A4Axf/E0AVPNf++350ea/99vzq3/wgPhj/oXNJ/8AAGL/AOJo/wCEB8Mf9C5pP/gDF/8AE0AVPNf++350ea/99vzq3/wgPhj/AKFzSf8AwBi/+Jo/4QHwx/0Lmk/+AMX/AMTQBU81/wC+350ea/8Afb86t/8ACA+GP+hc0n/wBi/+Jo/4QHwx/wBC5pP/AIAxf/E0AVPNf++350ea/wDfb86t/wDCA+GP+hc0n/wBi/8AiaP+EB8Mf9C5pP8A4Axf/E0AVPNf++350ea/99vzq3/wgPhj/oXNJ/8AAGL/AOJo/wCEB8Mf9C5pP/gDF/8AE0AVPNf++350ea/99vzq3/wgPhj/AKFzSf8AwBi/+Jo/4QHwx/0Lmk/+AMX/AMTQBU81/wC+350ea/8Afb86t/8ACA+GP+hc0n/wBi/+Jo/4QHwx/wBC5pP/AIAxf/E0AVPNf++350ea/wDfb86t/wDCA+GP+hc0n/wBi/8AiaP+EB8Mf9C5pP8A4Axf/E0AVPNf++350ea/99vzq3/wgPhj/oXNJ/8
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5b50b4e8-51d8-4363-b8e1-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:57:47.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:57:47.000Z",
|
|
|
|
|
"first_observed": "2018-07-19T15:57:47Z",
|
|
|
|
|
"last_observed": "2018-07-19T15:57:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"file--5b50b4e8-51d8-4363-b8e1-13c30acd0835",
|
|
|
|
|
"artifact--5b50b4e8-51d8-4363-b8e1-13c30acd0835"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"attachment\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "file",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "file--5b50b4e8-51d8-4363-b8e1-13c30acd0835",
|
|
|
|
|
"name": "gmail phish page.jpg",
|
|
|
|
|
"content_ref": "artifact--5b50b4e8-51d8-4363-b8e1-13c30acd0835"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "artifact",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "artifact--5b50b4e8-51d8-4363-b8e1-13c30acd0835",
|
|
|
|
|
"payload_bin": "/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wAARCALmBP4DASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD9Ef8AhFbD+/qH/g0uv/jtH/CK2H9/UP8AwaXX/wAdrXooAyP+EVsP7+of+DS6/wDjtH/CK2H9/UP/AAaXX/x2oPB/jrQ/H1jcXmg366hb2832eVhG6FJDGkm0hgCDskQ9P4hW9Taa0YGR/wAIrYf39Q/8Gl1/8do/4RWw/v6h/wCDS6/+O1r0UgMj/hFbD+/qH/g0uv8A47R/with/f1D/wAGl1/8drXrGeN/El9ParI8Wl2reXO0bbWuJMZMYI5CrkZI6k47HIBm3C+Hbe4eAXeo3E6HDxWuoXs7qfQhHJB9jRbr4duLhIDd6jbzucJFdahewOx9AHcEn2FdYFs9F09iPIsbG2jLMeI44kAySewAGTmsvw54n8O/Erw6NQ0a/stf0a4LR+dCwliYqcMp9wexoAj/AOEVsP7+of8Ag0uv/jtH/CK2H9/UP/Bpdf8Ax2qy6LNp2tW1oda1C00m6/dW3lGF/Jl5IRjJGzFWGdpzwRjuMdF/wg83/Qyat/3xa/8AxigDG/4RWw/v6h/4NLr/AOO0f8IrYf39Q/8ABpdf/Haq6tqPhjw/q6aVqnxNj03VJMbLG7vdPinbPTCNEGP5V0Y8EzMAR4l1Yj/ctP8A4xQBjf8ACK2H9/UP/Bpdf/HaP+EVsP7+of8Ag0uv/jtbP/CDzf8AQyat/wB8Wv8A8Yo/4Qeb/oZNW/74tf8A4xQBjf8ACK2H9/UP/Bpdf/HaP+EVsP7+of8Ag0uv/jtaT+FhHfQ2beKNWFzNG8yJ5dryiFAxz5GODIn5/Wp/+EHm/wChk1b/AL4tf/jFAGN/with/f1D/wAGl1/8do/4RWw/v6h/4NLr/wCO1s/8IPN/0Mmrf98Wv/xij/hB5v8AoZNW/wC+LX/4xQBjf8IrYf39Q/8ABpdf/HaP+EVsP7+of+DS6/8AjtbP/CDzf9DJq3/fFr/8Yo/4Qeb/AKGTVv8Avi1/+MUAY3/CK2H9/UP/AAaXX/x2j/hFbD+/qH/g0uv/AI7Wz/wg83/Qyat/3xa//GKP+EHm/wChk1b/AL4tf/jFAGN/with/f1D/wAGl1/8do/4RWw/v6h/4NLr/wCO1s/8IPN/0Mmrf98Wv/xij/hB5v8AoZNW/wC+LX/4xQBiHwfpDtultpbr/Zu7uadD9VdyP0rZhCW8KRRRpFEg2rGi7VUDoAB0FO/4Qeb/AKGTVv8Avi1/+MUf8IPN/wBDJq3/AHxa/wDxigBfNPtQZCeOKT/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKAG0U7/hB5v+hk1b/vi1/wDjFH/CDzf9DJq3/fFr/wDGKABXK8Cl80+1J/wg83/Qyat/3xa//GKP+EHm/wChk1b/AL4tf/jFAC+afase48K6RdXDTmyWGZm3NJayPbs59WMbLk/Wtf8A4Qeb/oZNW/74tf8A4xR/wg83/Qyat/3xa/8AxigDG/4RXT/72oD/ALil1/8AHaP+EVsP7+of+DS6/wDjtbP/AAg83/Qyat/3xa//ABij/hB5v+hk1b/vi1/+MUAY3/CK2H9/UP8AwaXX/wAdo/4RWw/v6h/4NLr/AOO1s/8ACDzf9DJq3/fFr/8AGKP+EHm/6GTVv++LX/4xQBjf8IrYf39Q/wDBpdf/AB2j/hFbD+/qH/g0uv8A47Wz/wAIPN/0Mmrf98Wv/wAYo/4Qeb/oZNW/74tf/jFAGN/with/f1D/AMGl1/8AHaP+EVsP7+of+DS6/wDjtbP/AAg83/Qyat/3xa//ABij/hB5v+hk1b/vi1/+MUAY3/CK2H9/UP8AwaXX/wAdo/4RWw/v6h/4NLr/AOO1s/8ACDzf9DJq3/fFr/8AGKP+EHm/6GTVv++LX/4xQBjf8IrYf39Q/wDBpdf/AB2j/hFbD+/qH/g0uv8A47Wz/wAIPN/0Mmrf98Wv/wAYo/4Qeb/oZNW/74tf/jFAGN/with/f1D/AMGl1/8AHaP+EVsP7+of+DS6/wDjtbP/AAg83/Qyat/3xa//ABij/hB5v+hk1b/vi1/+MUAY3/CK2H9/UP8AwaXX/wAdo/4RWw/v6h/4NLr/AOO1s/8ACDzf9DJq3/fFr/8AGKP+EHm/6GTVv++LX/4xQBjf8IrYf39Q/wDBpdf/AB2j/hFbD+/qH/g0uv8A47Wz/wAIPN/0Mmrf98Wv/wAYo/4Qeb/oZNW/74tf/jFAGN/with/f1D/AMGl1/8AHaP+EVsP7+of+DS6/wDjtbP/AAg83/Qyat/3xa//ABij/hB5v+hk1b/vi1/+MUAY3/CK2H9/UP8AwaXX/wAdo/4RWw/v6h/4NLr/AOO1s/8ACDzf9DJq3/fFr/8AGKP+EHm/6GTVv++LX/4xQBjf8IrYf39Q/wDBpdf/AB2j/hFbD+/qH/g0uv8A47Wz/wAIPN/0Mmrf98Wv/wAYo/4Qeb/oZNW/74tf/jFAGN/with/f1D/AMGl1/8AHaP+EVsP7+of+DS6/wDjtbP/AAg83/Qyat/3xa//ABij/hB5v+hk1b/vi1/+MUAY3/CK2H9/UP8AwaXX/wAdo/4RWw/v6h/4NLr/AOO1s/8ACDzf9DJq3/fFr/8AGKP+EHm/6GTVv++LX/4xQBjf8IrYf39Q/wDBpdf/AB2j/hFbD+/qH/g0uv8A47Wz/wAIPN/0Mmrf98Wv/wAYo/4Qeb/oZNW/74tf/jFAGN/with/f1D/AMGl1/8AHaP+EVsP7+of+DS6/wDjtbP/AAg83/Qyat/3xa//ABij/hB5v+hk1b/vi1/+MUAY3/CK2H9
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5b50b4e8-8968-4de9-a6d2-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:57:47.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:57:47.000Z",
|
|
|
|
|
"first_observed": "2018-07-19T15:57:47Z",
|
|
|
|
|
"last_observed": "2018-07-19T15:57:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"file--5b50b4e8-8968-4de9-a6d2-13c30acd0835",
|
|
|
|
|
"artifact--5b50b4e8-8968-4de9-a6d2-13c30acd0835"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"attachment\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "file",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "file--5b50b4e8-8968-4de9-a6d2-13c30acd0835",
|
|
|
|
|
"name": "0365 phish page.jpg",
|
|
|
|
|
"content_ref": "artifact--5b50b4e8-8968-4de9-a6d2-13c30acd0835"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "artifact",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "artifact--5b50b4e8-8968-4de9-a6d2-13c30acd0835",
|
|
|
|
|
"payload_bin": "/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wAARCALnBQcDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD9KvNf++350ea/99vzptYHjjxlZeBfDtxqV3JD5uPLtLWSXy2u7gg+XAnBJZ2wBgE85xxT30A6HzX/AL7fnR5r/wB9vzrg/hH8W9K+LmgT31lstL61nkgu9NaYPNb4dhGzDAIWRAsinHIb2Nd1RtoA7zX/AL7fnR5r/wB9vzptFIB3mv8A32/Oq2oavDpcAluZ2jUsFUDLM7HoqqOWPsBmpmYIpZiFUDJJ6Csrw3aDUmXXrld01wubRWH+ogPK4HZmGGY+4HQUAOXVNcuvmttI8qPsb+7ETH3wivj8efYU2TxBfafltT06a2gHW5t5PPjX/ewAw+u3A7kVkfF74waD8GfCzaxrTtLLITHZ6fb4M95Lj7iAnoOpY8KOvYHS+Gvju1+JngXR/E9laXVjb6jEZFt7xNskZDFWB9RlThhwwwRwaANuG6+0RJLFN5kbgMro2QwPQg9xTvNf++351z9v4V0LTfFEa3Ojadc2eqsyjz7WNzFcBS3BIztdVbjsyjH3jW9rXhvwV4d0m71PU9H0Ox0+0jMs9zPZxKkaAZJJ20AO81/77fnR5r/32/OuK/4SDwz5H27/AIVPq39h43f2p/YVtjb/AHvs2/7VjHP+pzjtXZ6L4b8FeItJtNT0zR9DvtPu4xLBcwWcTJIhGQQdtADvNf8Avt+dHmv/AH2/Ouf8Y6t8LPh/dWtt4gh8P6Zc3IzFDJZRs5XONxCoSq5BG44HB54rprTwZ4Sv7WG5ttC0W4tpkWSKaKzhZHUjIZSFwQQc5FZxqQlJwjJNrddiVOLbinqiHzX/AL7fnR5r/wB9vzqOHwr4Ym12803/AIRfSR9ntobjzPscXzeY0q4xt4x5XXPO725tQ+DfCNxNPFFoeiySwMFljS0hLRkgMAwxwSCDz2IrQoh81/77fnR5r/32/Orf/CA+GP8AoXNJ/wDAGL/4mj/hAfDH/QuaT/4Axf8AxNAFTzX/AL7fnR5r/wB9vzq3/wAID4Y/6FzSf/AGL/4mkbwH4XRSzeHdIVQMkmxiwP8Ax2gCr5r/AN9vzo81/wC+350+Hwn4NuWhWHRtDlaeLz4glrCTJHx864HK/MvI45HrTNU8M+CtDs/tWpaToOn2vmRxeddW0ESb3cIi7mAGWdlUDuWAHJoAPNf++350ea/99vzq3/wgPhj/AKFzSf8AwBi/+JqpH4Z8FS6rNpiaToD6lDClxLZrbQGaOJyyo7JjIVijgEjBKtjoaAAyO3VmP40m4+pq5/wgPhj/AKFzSf8AwBi/+Jo/4QHwx/0Lmk/+AMX/AMTQBT3H1NG4+tXP+EB8Mf8AQuaT/wCAMX/xNRW/gvwleRebBoWizx7mXfHZwsMqSrDIXqCCD7g0AV6Ku/8ACA+GP+hc0n/wBi/+Jqk/hzwRHHBI2l+H1jnm+zxM1vABJLuK7FOOW3AjA5yCKACirEngvwlDLDFJoWixyTMViRrOEFyAWIUbeTgE8dgal/4QHwx/0Lmk/wDgDF/8TQBSoq7/AMID4Y/6FzSf/AGL/wCJo/4QHwx/0Lmk/wDgDF/8TQBSop954X8F6ccXekaDany3mxNbQJ+7TG9+R91cjJ6DIqyvgPwuyhl8O6QVIyCLGLB/8doAp0Vd/wCEB8Mf9C5pP/gDF/8AE0f8ID4Y/wChc0n/AMAYv/iaAKVFT3Xg3wjYxCW50PRbePcqb5bSFRuYhVGSOpJAHqSKW58G+EbNUe40PRYFd1jVpLSFQXYgKoyOpJAA7k0AV6Ku/wDCA+GP+hc0n/wBi/8AiaRvAfhdFLN4d0hVAySbGLA/8doAp0VZt/BPhS6gjng0DRpoZFDpJHZxMrKRkEELyCO9Nh8G+EbiWeKLQ9FlkgYJKiWkJMbEBgGAHBwQeexFAEFFXf8AhAfDH/QuaT/4Axf/ABNQz+DfCNrJCk2h6LE87+XEslpCpkbBO1cjk4BOB2BoAgoq7/wgPhj/AKFzSf8AwBi/+JqKHwX4SuGlWLQtFlaF/LkCWcJKNgHacLwcEHB9RQBXoqS88J+DdPaBbrRtCtjPIIYRNawp5jnoq5HJPoOaLHwn4N1JZWs9G0K7EMhhkMFrC+xxjKnA4IyODzzQAzcfWjcfU1c/4QHwx/0Lmk/+AMX/AMTUVp4N8I6haxXNroei3NvKoaOaG0hZHB6EEDBFAEG4+ppRI69GYfjVv/hAfDH/AELmk/8AgDF/8TR/wgPhj/oXNJ/8AYv/AImgCp5r/wB9vzo81/77fnVv/hAfDH/QuaT/AOAMX/xNH/CA+GP+hc0n/wAAYv8A4mgCp5r/AN9vzo81/wC+351b/wCEB8Mf9C5pP/gDF/8AE0f8ID4Y/wChc0n/AMAYv/iaAKnmv/fb86PNf++351b/AOEB8Mf9C5pP/gDF/wDE0f8ACA+GP+hc0n/wBi/+JoAqea/99vzo81/77fnVv/hAfDH/AELmk/8AgDF/8TR/wgPhj/oXNJ/8AYv/AImgCp5r/wB9vzo81/77fnVv/hAfDH/QuaT/AOAMX/xNH/CA+GP+hc0n/wAAYv8A4mgCp5r/AN9vzo81/wC+351b/wCEB8Mf9C5pP/gDF/8AE0f8ID4Y/wChc0n/AMAYv/iaAKnmv/fb86PNf++351b/AOEB8Mf9C5pP/gDF/wDE0f8ACA+GP+hc0n/wBi/+JoAqea/99vzo81/77fnVv/hAfDH/AELmk/8AgDF/8TR/wgPhj/oXNJ/8AYv/AImgCp5r/wB9vzo81/77fnVv/hAfDH/QuaT/AOAMX/xNH/CA+GP+hc0n/wAAYv8A4mgCp5r/AN9vzo81/wC+351b/wCEB8Mf9C5pP/gDF/8AE0f8ID4Y/wChc0n/AMAYv/iaAKnmv/fb86PNf++351b/AOEB8Mf9C5pP/gDF/wDE0f8ACA+GP+hc0n/wBi/+JoAqea/99vzo81/77fnVv/hAfDH/AELmk/8AgDF/8TR/wgPhj/oXNJ/8AYv/AImgCp5r/wB9vzo81/77fnVv/hAfDH/QuaT/AOAMX/xNH/CA+GP+hc0n/wAAYv8A4mgCp5r/AN9vzo81/wC+351b/wCEB8Mf9C5pP/gDF/8AE0f8ID4Y/wChc0n/AMAYv/iaAKnmv/fb86PNf++351b/AOEB8Mf9C5pP/gDF/wDE0f8ACA+GP+hc0n/wBi/+JoAqea/99vzo81/77fnVv/hAfDH/AELmk/8AgDF/8TR/wgPhj/oXNJ/8AYv/AIm
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5b50b4e8-19b4-4c7d-85d6-13c30acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:57:47.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:57:47.000Z",
|
|
|
|
|
"first_observed": "2018-07-19T15:57:47Z",
|
|
|
|
|
"last_observed": "2018-07-19T15:57:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"file--5b50b4e8-19b4-4c7d-85d6-13c30acd0835",
|
|
|
|
|
"artifact--5b50b4e8-19b4-4c7d-85d6-13c30acd0835"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"attachment\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "file",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "file--5b50b4e8-19b4-4c7d-85d6-13c30acd0835",
|
|
|
|
|
"name": "phishing site.jpg",
|
|
|
|
|
"content_ref": "artifact--5b50b4e8-19b4-4c7d-85d6-13c30acd0835"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "artifact",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "artifact--5b50b4e8-19b4-4c7d-85d6-13c30acd0835",
|
|
|
|
|
"payload_bin": "/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wAARCALjBNwDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD2H9lX4T694m/Z/wDCGpWXja50i2mhm2WcdpvWPbPIp+bzBnJBPTvXrH/CivFH/RSbz/wB/wDttVP2I/8Ak1vwJ/1xuf8A0qmra+P3xuufg7o9q1loVxql9fExwTsh+yxv2DsOS3ogxnnkV7eBeLxlaGFw8IuT0V4w/FtfmePjPq2EoyxOIlJRWrtKf5JlD/hRXij/AKKTef8AgD/9to/4UV4o/wCik3n/AIA//bayPHH7QvjDwn8O9D8Qn4eXltNckNffbD+5t1BGeFO9d3YuFx6NXrPw68bL8QvCNhrqabeaUt0u4W98m1/qP7yns3cc12Ymhj8LQWJqQhyNuN1Gk9V6JnLh6+BxNZ4enKfMkpWbqLR+rR57/wAKK8Uf9FJvP/AH/wC20f8ACivFH/RSbz/wB/8AttdHq3xjNj4q1zQ9P8GeJPEEmiiE3t1pa2ZjTzY/MUKslwkjnb2VD+NdZ4R8XaX458P2mtaNcG5sLkNtZkZHVlYq6OjAMrKwKlSAQQRXkfXqtr2j/wCAQ/8AkT1PqdLa8v8AwOf/AMkeYf8ACivFH/RSbz/wB/8AttH/AAorxR/0Um8/8Af/ALbXs9FH16r2j/4BD/5EPqdPvL/wOf8A8keMf8KK8Uf9FJvP/AH/AO20f8KK8Uf9FJvP/AH/AO216V4P8Y2XjSz1C5sYp4kstQudNkFwqgmSCQxuRgn5SVOCcHHUCt2j69V3tH/wCH/yIfU6XeX/AIHPp/28eMf8KK8Uf9FJvP8AwB/+20f8KK8Uf9FJvP8AwB/+217PRR9eq9o/+AQ/+RD6nT7y/wDA5/8AyR4x/wAKK8Uf9FJvP/AH/wC20f8ACivFH/RSbz/wB/8Attez0UfXqvaP/gEP/kQ+p0+8v/A5/wDyR4x/worxR/0Um8/8Af8A7bR/worxR/0Um8/8Af8A7bXs9FH16r2j/wCAQ/8AkQ+p0+8v/A5//JHjH/CivFH/AEUm8/8AAH/7bR/worxR/wBFJvP/AAB/+217PRR9eq9o/wDgEP8A5EPqdPvL/wADn/8AJHjH/CivFH/RSbz/AMAf/ttH/CivFH/RSbz/AMAf/ttez0UfXqvaP/gEP/kQ+p0+8v8AwOf/AMkeMf8ACivFH/RSbz/wB/8AttH/AAorxR/0Um8/8Af/ALbXs9FH16r2j/4BD/5EPqdPvL/wOf8A8keMf8KK8Uf9FJvP/AH/AO20f8KK8Uf9FJvP/AH/AO217PRR9eq9o/8AgEP/AJEPqdPvL/wOf/yR4x/worxR/wBFJvP/AAB/+20f8KK8Uf8ARSbz/wAAf/ttez1zfjD4g6R4EudHTWpJbS21O4+yR3xjP2eGUjKrK/RNx4BPGfSj69V7R/8AAIf/ACIfU6XeX/gc/wD5I88/4UV4o/6KTef+AP8A9to/4UV4o/6KTef+AP8A9tr0STx/o48dReEYpZLrW2tmu5oreMutrGMbTMw4Tdn5QeT+VdHR9eq9o/8AgEP/AJEPqdLvL/wOf/yRwvw98OTaHY6npup35126tbzb9tni2sytDE4GCTgDdjr7966r+z7X/n2h/wC/Yqjo/wDyFvEX/X8n/pLBWtXDKTlJyfX5fgjsjFRSiuhX/s+1/wCfaH/v2KP7Ptf+faH/AL9ivPPAfjTV9c+NHxS8P3lwsulaH/Zf2CERqpi862Z5MsBlssAeScdq9LqSiv8A2fa/8+0P/fsUf2fa/wDPtD/37FWKKAK/9n2v/PtD/wB+xR/Z9r/z7Q/9+xViigCv/Z9r/wA+0P8A37FH9n2v/PtD/wB+xViigCv/AGfa/wDPtD/37FH9n2v/AD7Q/wDfsVYooAr/ANn2v/PtD/37FH9n2v8Az7Q/9+xViigCv/Z9r/z7Q/8AfsUf2fa/8+0P/fsVYooAr/2fa/8APtD/AN+xR/Z9r/z7Q/8AfsVYooAr/wBn2v8Az7Q/9+xR/Z9r/wA+0P8A37FWKKAK/wDZ9r/z7Q/9+xR/Z9r/AM+0P/fsVYooAr/2fa/8+0P/AH7FH9n2v/PtD/37FWKKAK/9n2v/AD7Q/wDfsUf2fa/8+0P/AH7FWKKAK/8AZ9r/AM+0P/fsUf2fa/8APtD/AN+xViigCv8A2fa/8+0P/fsUf2fa/wDPtD/37FWKKAK/9n2v/PtD/wB+xR/Z9r/z7Q/9+xViigCv/Z9r/wA+0P8A37FH9n2v/PtD/wB+xViigCv/AGfa/wDPtD/37FH9n2v/AD7Q/wDfsVYooAr/ANn2v/PtD/37FH9n2v8Az7Q/9+xViigCv/Z9r/z7Q/8AfsUf2fa/8+0P/fsVYooAr/2fa/8APtD/AN+xR/Z9r/z7Q/8AfsVYooAr/wBn2v8Az7Q/9+xR/Z9r/wA+0P8A37FWKKAK/wDZ9r/z7Q/9+xR/Z9r/AM+0P/fsVYooAr/2fa/8+0P/AH7FH9n2v/PtD/37FWKKAK/9n2v/AD7Q/wDfsUf2fa/8+0P/AH7FWKKAK/8AZ9r/AM+0P/fsUf2fa/8APtD/AN+xViigCv8A2fa/8+0P/fsUf2fa/wDPtD/37FWKKAK/9n2v/PtD/wB+xR/Z9r/z7Q/9+xViigCv/Z9r/wA+0P8A37FH9n2v/PtD/wB+xViigCv/AGfa/wDPtD/37FH9n2v/AD7Q/wDfsVYooAr/ANn2v/PtD/37FH9n2v8Az7Q/9+xViigCv/Z9r/z7Q/8AfsUf2fa/8+0P/fsVYooAr/2fa/8APtD/AN+xR/Z9r/z7Q/8AfsVYooAr/wBn2v8Az7Q/9+xR/Z9r/wA+0P8A37FWKKAK/wDZ9r/z7Q/9+xR/Z9r/AM+0P/fsVYooAr/2fa/8+0P/AH7FH9n2v/PtD/37FWKKAK/9n2v/AD7Q/wDfsUf2fa/8+0P/AH7FWKKAK/8AZ9r/AM+0P/fsUf2fa/8APtD/AN+xViigCv8A2fa/8+0P/fsUf2fa/wDPtD/37FWKKAK/9n2v/PtD/wB+xR/Z9r/z7Q/9+xViigCv/Z9r/wA+0P8A37FH9n2v/PtD/wB+xViigCv/AGfa/wDPtD/37FH9n2v/AD7Q/wDfsVYooAr/ANn2v/PtD/37FH9n2v8Az7Q/9+xViigCv/Z9r/z7Q/8AfsUf2fa/8+0P/fsVYooAr/2fa/8APtD/AN+xR/Z9r/z7Q/8AfsVYooAr/wBn2v8Az7Q/9+xR/Z9r/wA+0P8A37FWKKAK/wDZ9r/z7Q/9+xR/Z9r
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5b50b4a0-d69c-452d-8bde-eb520acd0835",
|
|
|
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
|
|
|
"created": "2018-07-19T15:56:16.000Z",
|
|
|
|
|
"modified": "2018-07-19T15:56:16.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '31676c03e4c1a454e5ba5e50ecf056af' AND file:hashes.SHA256 = '3830f13e0a832a4b13b22ecc2acf7cdd39ce7cd48a21ad8537e944c68e4e86a9' AND file:name = 'Quantum Logistics 07192018.pdf' AND file:x_misp_state = 'Malicious']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2018-07-19T15:56:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
