19437 lines
836 KiB
JSON
19437 lines
836 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--59189548-f120-4050-be33-46b9950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-15T06:33:43.000Z",
|
||
|
|
"modified": "2017-05-15T06:33:43.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--59189548-f120-4050-be33-46b9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-15T06:33:43.000Z",
|
||
|
|
"modified": "2017-05-15T06:33:43.000Z",
|
||
|
|
"name": "OSINT - Jaff Ransomware: Player 2 Has Entered The Game",
|
||
|
|
"published": "2017-05-15T06:33:46Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--59189558-6554-4458-960f-4c9e950d210f",
|
||
|
|
"url--59189558-6554-4458-960f-4c9e950d210f",
|
||
|
|
"x-misp-attribute--5918956c-0b44-4e78-8f14-4449950d210f",
|
||
|
|
"indicator--5918958a-08d4-4f91-887a-48b9950d210f",
|
||
|
|
"indicator--5918958b-5474-41c6-8764-4126950d210f",
|
||
|
|
"indicator--591895c3-7ef4-492f-be54-4713950d210f",
|
||
|
|
"indicator--591895c4-9854-4f56-8299-481b950d210f",
|
||
|
|
"indicator--591895c4-6cf4-4ff9-89d7-426d950d210f",
|
||
|
|
"indicator--591895c5-5ab8-436f-8420-429c950d210f",
|
||
|
|
"indicator--591895c5-b0cc-4913-8341-404e950d210f",
|
||
|
|
"indicator--591895c6-2b88-4a17-88a8-4d48950d210f",
|
||
|
|
"indicator--591895c6-7ac0-4d4e-96ec-44d0950d210f",
|
||
|
|
"indicator--591895c7-f1a8-413c-bd1c-4286950d210f",
|
||
|
|
"indicator--591895c7-882c-47f9-a765-4e05950d210f",
|
||
|
|
"indicator--591895c7-70c8-4434-a3e1-434d950d210f",
|
||
|
|
"indicator--591895c8-99cc-44cc-83e3-44d5950d210f",
|
||
|
|
"indicator--591895c8-b17c-411c-b947-4eba950d210f",
|
||
|
|
"indicator--591895c9-91d4-4279-a60d-4713950d210f",
|
||
|
|
"indicator--591895c9-0500-4a41-863c-44ef950d210f",
|
||
|
|
"indicator--591895c9-7690-46b9-ad64-4f63950d210f",
|
||
|
|
"indicator--591895ca-e578-48de-b15f-4d76950d210f",
|
||
|
|
"indicator--591895ca-7e78-4bbc-ad06-477d950d210f",
|
||
|
|
"indicator--591895cb-3d04-4683-8b18-4b7d950d210f",
|
||
|
|
"indicator--591895cb-2d44-4d2b-8716-4e32950d210f",
|
||
|
|
"indicator--591895cb-7468-46bc-8284-4a2d950d210f",
|
||
|
|
"indicator--591895cc-eb34-42f7-995a-4008950d210f",
|
||
|
|
"indicator--591895cc-ea68-491a-b9a8-4018950d210f",
|
||
|
|
"indicator--591895cd-b9a8-4f3c-9b68-4662950d210f",
|
||
|
|
"indicator--591895cd-2d5c-4bcf-b50a-4845950d210f",
|
||
|
|
"indicator--591895cd-984c-4d81-8e9b-4604950d210f",
|
||
|
|
"indicator--591895ce-02ac-43f2-9250-492e950d210f",
|
||
|
|
"indicator--591895ce-2a3c-4f86-a34e-43a8950d210f",
|
||
|
|
"indicator--591895cf-beb8-4d4d-9ed8-491c950d210f",
|
||
|
|
"indicator--591895cf-f8a4-476f-a513-46d5950d210f",
|
||
|
|
"indicator--591895cf-66ac-44bb-9348-4aec950d210f",
|
||
|
|
"indicator--591895d0-e49c-4da7-b2a8-456c950d210f",
|
||
|
|
"indicator--591895d0-7f74-49ac-a478-4213950d210f",
|
||
|
|
"indicator--591895d1-6518-48d3-9c70-412f950d210f",
|
||
|
|
"indicator--591895d1-6358-48ec-bb02-479c950d210f",
|
||
|
|
"indicator--591895d2-e148-4825-816c-4a5c950d210f",
|
||
|
|
"indicator--591895d2-063c-4aa1-964e-497a950d210f",
|
||
|
|
"indicator--591895d2-4904-49c5-8a29-4e5d950d210f",
|
||
|
|
"indicator--591895d3-5c1c-4ca2-a4fb-4c9f950d210f",
|
||
|
|
"indicator--591895d3-bc0c-4642-a459-422e950d210f",
|
||
|
|
"indicator--591895d4-b548-4d59-9ad7-4403950d210f",
|
||
|
|
"indicator--591895d4-a0d4-474a-9a64-42e7950d210f",
|
||
|
|
"indicator--591895d5-7c60-4dab-9752-41b3950d210f",
|
||
|
|
"indicator--591895d5-f94c-4a66-b27d-46e2950d210f",
|
||
|
|
"indicator--591895d6-be74-4de3-ac6f-4b36950d210f",
|
||
|
|
"indicator--591895d6-92e0-481e-8148-4a8e950d210f",
|
||
|
|
"indicator--591895d6-72c8-46ed-9802-43ea950d210f",
|
||
|
|
"indicator--59189648-2bc4-4840-a880-4c1a950d210f",
|
||
|
|
"indicator--59189794-80d0-4673-bdbd-4a12950d210f",
|
||
|
|
"indicator--59189795-1e00-4ef8-93b3-44ed950d210f",
|
||
|
|
"indicator--59189795-360c-4edf-9dec-4bbc950d210f",
|
||
|
|
"indicator--59189795-a7b4-4499-aad5-4fad950d210f",
|
||
|
|
"indicator--59189796-a39c-475f-bcad-48ad950d210f",
|
||
|
|
"indicator--59189796-1290-4d2b-b14d-45a9950d210f",
|
||
|
|
"indicator--59189797-0234-4503-b4c7-4f72950d210f",
|
||
|
|
"indicator--59189797-0f80-47fa-9084-4563950d210f",
|
||
|
|
"indicator--59189798-2580-4ee9-845e-4bfc950d210f",
|
||
|
|
"indicator--59189798-81c4-49d6-9a66-402f950d210f",
|
||
|
|
"indicator--59189799-c848-461b-9230-4ca5950d210f",
|
||
|
|
"indicator--59189799-fd5c-49d5-aea0-4d00950d210f",
|
||
|
|
"indicator--59189799-763c-4d56-996b-4230950d210f",
|
||
|
|
"indicator--5918979a-8bb8-49e1-8a81-49ae950d210f",
|
||
|
|
"indicator--5918979a-4470-4f01-a442-419f950d210f",
|
||
|
|
"indicator--5918979b-def0-4711-a170-4dbd950d210f",
|
||
|
|
"indicator--5918979b-267c-4978-a0a2-4164950d210f",
|
||
|
|
"indicator--5918979b-2b10-4452-8b71-4fda950d210f",
|
||
|
|
"indicator--5918979c-bb4c-422a-824d-45ae950d210f",
|
||
|
|
"indicator--5918979c-f130-4c12-9900-4f94950d210f",
|
||
|
|
"indicator--5918979d-3d78-4a2c-8f7e-40d4950d210f",
|
||
|
|
"indicator--5918979d-8404-4e5c-a980-4ca8950d210f",
|
||
|
|
"indicator--5918979e-692c-42d2-ab0d-4768950d210f",
|
||
|
|
"indicator--5918979e-f7f8-47b6-a29b-4616950d210f",
|
||
|
|
"indicator--5918979f-7a44-4d79-a185-43ad950d210f",
|
||
|
|
"indicator--5918979f-2c44-4f5a-8a2a-4971950d210f",
|
||
|
|
"indicator--5918979f-a550-4caa-8c1a-48b6950d210f",
|
||
|
|
"indicator--591897a0-a528-4e5e-bf72-48a0950d210f",
|
||
|
|
"indicator--591897a0-0ec4-40e0-8e7f-462b950d210f",
|
||
|
|
"indicator--591897a1-12b0-430a-ac93-4241950d210f",
|
||
|
|
"indicator--591897a1-616c-4583-87a7-42fa950d210f",
|
||
|
|
"indicator--591897a2-ca38-4972-91f3-40e4950d210f",
|
||
|
|
"indicator--591897a2-9974-46de-90c9-4891950d210f",
|
||
|
|
"indicator--591897a3-b4e4-45bc-aace-4277950d210f",
|
||
|
|
"indicator--591897a3-c3f8-440b-8981-41e1950d210f",
|
||
|
|
"indicator--591897a3-834c-4b5c-afc6-4604950d210f",
|
||
|
|
"indicator--591897a4-1fc0-4ff5-842a-4015950d210f",
|
||
|
|
"indicator--591897a4-a280-4ab0-8b35-4cc1950d210f",
|
||
|
|
"indicator--591897a5-382c-40af-a19d-4eca950d210f",
|
||
|
|
"indicator--591897a5-52e8-464c-92c6-42ef950d210f",
|
||
|
|
"indicator--591897a5-5eb0-4ee8-8149-4eed950d210f",
|
||
|
|
"indicator--591897a6-b67c-4df2-85bc-45c2950d210f",
|
||
|
|
"indicator--591897a6-20d4-4a92-ae65-4aba950d210f",
|
||
|
|
"indicator--591897a7-b09c-4278-924c-4724950d210f",
|
||
|
|
"indicator--591897a7-fe08-4f95-9916-4c46950d210f",
|
||
|
|
"indicator--591897a8-f654-4df4-b167-4fd6950d210f",
|
||
|
|
"indicator--591897a8-f784-4ec9-aaa4-4e66950d210f",
|
||
|
|
"indicator--591897a9-a8e0-49a8-aefb-4f05950d210f",
|
||
|
|
"indicator--591897a9-1e6c-4e84-a3ce-47dd950d210f",
|
||
|
|
"indicator--591897aa-8780-4cc7-b2c9-49a1950d210f",
|
||
|
|
"indicator--591897aa-d83c-4329-86d3-4bdb950d210f",
|
||
|
|
"indicator--591897aa-0088-4fc3-933b-4eb7950d210f",
|
||
|
|
"indicator--591897ab-1270-48fa-bca2-441a950d210f",
|
||
|
|
"indicator--591897ab-20cc-4d70-825c-4989950d210f",
|
||
|
|
"indicator--591897ac-b340-498a-a58f-45a9950d210f",
|
||
|
|
"indicator--591897ac-ae34-4b6e-aa10-47ac950d210f",
|
||
|
|
"indicator--591897ad-4ed4-453c-b3bb-4559950d210f",
|
||
|
|
"indicator--591897ad-12cc-46f7-8d5b-4bcc950d210f",
|
||
|
|
"indicator--591897ad-027c-499d-9568-4424950d210f",
|
||
|
|
"indicator--591897ae-66b8-4849-889e-4adc950d210f",
|
||
|
|
"indicator--591897ae-ece0-46cb-a080-427f950d210f",
|
||
|
|
"indicator--591897af-0c44-4c0b-98b2-4384950d210f",
|
||
|
|
"indicator--591897af-572c-41e9-94b8-4869950d210f",
|
||
|
|
"indicator--591897af-c5e4-4ebf-b95b-4fe4950d210f",
|
||
|
|
"indicator--591897b0-983c-415f-a3eb-4f55950d210f",
|
||
|
|
"indicator--591897b0-dc78-4976-a08a-4e62950d210f",
|
||
|
|
"indicator--591897b1-dfe4-4354-be6c-4f40950d210f",
|
||
|
|
"indicator--591897b1-41e0-4f8f-b1b4-4d38950d210f",
|
||
|
|
"indicator--591897b2-3c9c-4db0-955f-4a28950d210f",
|
||
|
|
"indicator--591897b2-3398-4aa4-b128-43e8950d210f",
|
||
|
|
"indicator--591897b2-becc-4ec2-86e9-4ab6950d210f",
|
||
|
|
"indicator--591897b3-5e88-4250-9fea-4fd4950d210f",
|
||
|
|
"indicator--591897b3-bb64-49bb-a50a-4cb4950d210f",
|
||
|
|
"indicator--591897b4-4144-4539-abfc-4f98950d210f",
|
||
|
|
"indicator--591897b4-c9a8-4855-8ecb-4e77950d210f",
|
||
|
|
"indicator--591897b5-9690-4c44-828e-4c6b950d210f",
|
||
|
|
"indicator--591897b5-a6dc-4310-a145-404f950d210f",
|
||
|
|
"indicator--591897b5-4f3c-4718-af02-40dc950d210f",
|
||
|
|
"indicator--591897b6-12b8-4efa-a0bf-41a8950d210f",
|
||
|
|
"indicator--591897b6-64e4-4080-95d4-451f950d210f",
|
||
|
|
"indicator--591897b7-540c-41a2-b903-46dd950d210f",
|
||
|
|
"indicator--591897b7-1064-45a2-8865-4e11950d210f",
|
||
|
|
"indicator--591897b7-b144-4703-bae9-4a87950d210f",
|
||
|
|
"indicator--591897b8-e2ac-4d0b-a123-47c1950d210f",
|
||
|
|
"indicator--591897b8-0084-4a14-9b9e-4cc5950d210f",
|
||
|
|
"indicator--591897b9-a56c-4e35-aae6-4d41950d210f",
|
||
|
|
"indicator--591897b9-34b8-4dae-8813-4dba950d210f",
|
||
|
|
"indicator--591897ba-0404-470c-887d-4fef950d210f",
|
||
|
|
"indicator--591897ba-ad00-41b8-ac63-4f10950d210f",
|
||
|
|
"indicator--591897bb-a754-4b72-84d2-4849950d210f",
|
||
|
|
"indicator--591897bb-3638-43c0-9b08-4672950d210f",
|
||
|
|
"indicator--591897bb-efd4-47e2-a7be-4459950d210f",
|
||
|
|
"indicator--591897bc-45d4-4c83-a9d0-4a69950d210f",
|
||
|
|
"indicator--591897bc-f97c-4724-92dc-4111950d210f",
|
||
|
|
"indicator--591897bd-7698-489f-a9b4-4aa5950d210f",
|
||
|
|
"indicator--591897bd-20ac-434a-bbfc-4905950d210f",
|
||
|
|
"indicator--591897bd-38fc-4550-bc1c-44e0950d210f",
|
||
|
|
"indicator--591897be-9bd4-4a04-8dff-4c08950d210f",
|
||
|
|
"indicator--591897be-679c-432b-b388-4783950d210f",
|
||
|
|
"indicator--591897bf-42f4-4e45-8f13-4097950d210f",
|
||
|
|
"indicator--591897bf-cde8-4b82-8ec0-42c1950d210f",
|
||
|
|
"indicator--591897c0-0d88-4c97-9577-42e4950d210f",
|
||
|
|
"indicator--591897c0-c954-4aef-85bc-45f0950d210f",
|
||
|
|
"indicator--591897c1-23a0-4e4e-91a9-4bcd950d210f",
|
||
|
|
"indicator--591897c1-3bb0-4710-89cd-4652950d210f",
|
||
|
|
"indicator--591897c1-8380-42f3-b56c-48a2950d210f",
|
||
|
|
"indicator--591897c2-cdf8-4a91-aba9-4508950d210f",
|
||
|
|
"indicator--591897c2-630c-4a8d-a798-4650950d210f",
|
||
|
|
"indicator--591897c3-b554-476f-bd9d-4c04950d210f",
|
||
|
|
"indicator--591897c3-98a4-4f83-ba70-4b1c950d210f",
|
||
|
|
"indicator--591897c4-e7ac-462b-accf-46fe950d210f",
|
||
|
|
"indicator--591897c4-fca4-4e03-a4cd-4302950d210f",
|
||
|
|
"indicator--591897c5-30a8-47ae-8596-4e99950d210f",
|
||
|
|
"indicator--591897c5-c758-4845-bd22-4bf3950d210f",
|
||
|
|
"indicator--591897c6-f954-446e-b8c3-4a3f950d210f",
|
||
|
|
"indicator--591897c6-a2f8-4e7d-8bc1-42c0950d210f",
|
||
|
|
"indicator--591897c6-3be8-430a-8b2e-427f950d210f",
|
||
|
|
"indicator--591897c7-9398-420f-ac6c-4196950d210f",
|
||
|
|
"indicator--591897c7-bc80-4d98-be19-4aaf950d210f",
|
||
|
|
"indicator--591897c8-aca8-45be-a4d6-43b4950d210f",
|
||
|
|
"indicator--591897c8-35cc-445a-af0d-408e950d210f",
|
||
|
|
"indicator--591897c8-6e3c-41ad-ab3d-45e9950d210f",
|
||
|
|
"indicator--591897c9-8c04-4717-9d4e-4dff950d210f",
|
||
|
|
"indicator--591897c9-71c0-413a-a443-4a85950d210f",
|
||
|
|
"indicator--591897ca-e004-4f10-b776-4790950d210f",
|
||
|
|
"indicator--591897ca-9138-467e-b5ea-48ad950d210f",
|
||
|
|
"indicator--591897cb-7f38-4011-8d37-49a2950d210f",
|
||
|
|
"indicator--591897cb-05b0-4765-bff7-44f8950d210f",
|
||
|
|
"indicator--591897cc-2698-4f05-82c0-4965950d210f",
|
||
|
|
"indicator--591897cc-510c-4ba4-a3f9-4086950d210f",
|
||
|
|
"indicator--591897cc-8b50-4b54-bbb1-4e18950d210f",
|
||
|
|
"indicator--591897cd-404c-4584-b4b6-4466950d210f",
|
||
|
|
"indicator--591897cd-1984-4188-96c3-4bf2950d210f",
|
||
|
|
"indicator--591897ce-ec4c-4890-85c3-470c950d210f",
|
||
|
|
"indicator--591897ce-d9f8-4b1b-ac5d-4464950d210f",
|
||
|
|
"indicator--591897cf-9e24-4077-80da-4c58950d210f",
|
||
|
|
"indicator--591897cf-7b50-4f56-b79a-4dc8950d210f",
|
||
|
|
"indicator--591897d0-93ac-42a0-ae64-480c950d210f",
|
||
|
|
"indicator--591897d0-1b60-416a-bdba-4d0d950d210f",
|
||
|
|
"indicator--591897d1-e820-46b9-b004-4ce2950d210f",
|
||
|
|
"indicator--591897d1-fd50-4088-9117-47d1950d210f",
|
||
|
|
"indicator--591897d1-026c-4068-aefc-4899950d210f",
|
||
|
|
"indicator--591897d2-81f4-442b-939d-4a01950d210f",
|
||
|
|
"indicator--591897d2-8ee0-4dc8-bc5c-4bc6950d210f",
|
||
|
|
"indicator--591897d3-dd40-499c-a619-414b950d210f",
|
||
|
|
"indicator--591897d3-74c4-4f9e-b27f-4fa8950d210f",
|
||
|
|
"indicator--591897d4-7940-4434-98e7-4cd1950d210f",
|
||
|
|
"indicator--591897d4-b2cc-4f6d-87ff-415c950d210f",
|
||
|
|
"indicator--591897d5-3ba4-4c91-a880-4540950d210f",
|
||
|
|
"indicator--591897d5-72c4-4457-a6f1-4b47950d210f",
|
||
|
|
"indicator--591897d5-04c4-40da-9bfc-4cb1950d210f",
|
||
|
|
"indicator--591897d6-afcc-49a5-a326-4048950d210f",
|
||
|
|
"indicator--591897d6-e4b8-4637-9642-4a91950d210f",
|
||
|
|
"indicator--591897d7-6584-4971-a1be-484b950d210f",
|
||
|
|
"indicator--591897d7-a144-401c-8378-449f950d210f",
|
||
|
|
"indicator--591897d8-f2e0-4bc6-9a58-40c3950d210f",
|
||
|
|
"indicator--591897d8-5ffc-40bd-827d-4d78950d210f",
|
||
|
|
"indicator--591897d8-3aa8-4c6e-be53-47f8950d210f",
|
||
|
|
"indicator--591897d9-ba20-4fa8-8420-4d74950d210f",
|
||
|
|
"indicator--591897d9-ffb0-4757-a4f1-4f70950d210f",
|
||
|
|
"indicator--591897da-23c4-41ca-8f76-4516950d210f",
|
||
|
|
"indicator--591897da-ea94-4ba9-b2e6-4b34950d210f",
|
||
|
|
"indicator--591897db-00fc-44a5-881e-493f950d210f",
|
||
|
|
"indicator--591897db-b57c-45a7-8362-423e950d210f",
|
||
|
|
"indicator--591897dc-d1d4-43bc-9e1b-4bb7950d210f",
|
||
|
|
"indicator--591897dc-dc98-440e-a93d-4291950d210f",
|
||
|
|
"indicator--591897dd-8340-4437-a268-4c87950d210f",
|
||
|
|
"indicator--591897dd-b2b0-4804-aa55-4d10950d210f",
|
||
|
|
"indicator--591897dd-1834-4d93-b14f-438f950d210f",
|
||
|
|
"indicator--591897de-3db0-4e57-be13-4371950d210f",
|
||
|
|
"indicator--591897de-fb00-497d-aa85-41ae950d210f",
|
||
|
|
"indicator--591897df-a124-43f8-acd5-4989950d210f",
|
||
|
|
"indicator--591897df-c730-4d67-b2aa-4e1c950d210f",
|
||
|
|
"indicator--591897df-a00c-4fb9-9a5d-40a6950d210f",
|
||
|
|
"indicator--591897e0-5890-4d58-8ea4-4ca8950d210f",
|
||
|
|
"indicator--591897e0-0bfc-4857-86f8-42e4950d210f",
|
||
|
|
"indicator--591897e1-f394-4cdf-8576-4f4d950d210f",
|
||
|
|
"indicator--591897e1-9054-463c-9a21-454c950d210f",
|
||
|
|
"indicator--591897e1-43c0-48e1-a1e5-4b79950d210f",
|
||
|
|
"indicator--591897e2-1778-49a2-801f-448c950d210f",
|
||
|
|
"indicator--591897e2-0ef0-4e0a-bf8e-4d14950d210f",
|
||
|
|
"indicator--591897e3-f768-40ae-a70b-4a4e950d210f",
|
||
|
|
"indicator--591897e4-632c-4753-84ec-4912950d210f",
|
||
|
|
"indicator--591897e4-2ce0-4583-9e33-4db0950d210f",
|
||
|
|
"indicator--591897e5-e3b0-4226-bfe3-47cd950d210f",
|
||
|
|
"indicator--591897e5-e7e0-485a-bdd9-4b5d950d210f",
|
||
|
|
"indicator--591897e5-4d44-450a-9b2e-40b0950d210f",
|
||
|
|
"indicator--591897e6-3f9c-48cb-acb2-4621950d210f",
|
||
|
|
"indicator--591897e6-6b44-4e1e-8368-4c31950d210f",
|
||
|
|
"indicator--591897e7-0248-4a91-92af-4881950d210f",
|
||
|
|
"indicator--591897e7-e314-46e0-a835-41f8950d210f",
|
||
|
|
"indicator--591897e8-e968-4515-8cc7-4533950d210f",
|
||
|
|
"indicator--591897e8-76b8-4dde-9fad-4256950d210f",
|
||
|
|
"indicator--591897e8-cd84-4cd0-894a-4dab950d210f",
|
||
|
|
"indicator--591897e9-e548-4bb9-ace9-4253950d210f",
|
||
|
|
"indicator--591897e9-fc8c-48c8-834d-4474950d210f",
|
||
|
|
"indicator--591897ea-b2e4-4a56-96f6-4cbb950d210f",
|
||
|
|
"indicator--591897ea-e4bc-4e76-aca5-4d06950d210f",
|
||
|
|
"indicator--591897ea-5940-49f6-a96c-4f0b950d210f",
|
||
|
|
"indicator--591897eb-7cc4-44a5-8923-402a950d210f",
|
||
|
|
"indicator--591897eb-8000-469f-a14e-42f3950d210f",
|
||
|
|
"indicator--591897ec-5e78-405c-82d4-4855950d210f",
|
||
|
|
"indicator--591897ec-cfdc-46bc-b4e9-4490950d210f",
|
||
|
|
"indicator--591897ed-a374-4208-962c-4a9f950d210f",
|
||
|
|
"indicator--591897ed-6de8-4f30-b1b5-498c950d210f",
|
||
|
|
"indicator--591897ed-0a10-4656-9c8a-495e950d210f",
|
||
|
|
"indicator--591897ee-5b98-470d-b459-4a29950d210f",
|
||
|
|
"indicator--591897ee-080c-4647-9103-4c20950d210f",
|
||
|
|
"indicator--591897ef-5254-4215-837e-4654950d210f",
|
||
|
|
"indicator--591897ef-97b4-4499-80c3-4f31950d210f",
|
||
|
|
"indicator--591897f0-9368-4440-bb2b-4bae950d210f",
|
||
|
|
"indicator--591897f0-59f4-47b5-8456-490f950d210f",
|
||
|
|
"indicator--591897f0-4500-449d-9114-42e1950d210f",
|
||
|
|
"indicator--591897f1-c934-4c6c-a65d-4dc6950d210f",
|
||
|
|
"indicator--591897f1-e25c-4112-b145-4562950d210f",
|
||
|
|
"indicator--591897f2-098c-401f-bf22-463b950d210f",
|
||
|
|
"indicator--591897f2-81bc-418f-b6fd-44f4950d210f",
|
||
|
|
"indicator--591897f3-93f4-43e6-9f28-4b89950d210f",
|
||
|
|
"indicator--591897f3-8bc4-41e5-960d-4b7e950d210f",
|
||
|
|
"indicator--591897f3-cce8-47d3-a51b-41ff950d210f",
|
||
|
|
"indicator--591897f4-35f8-417e-93db-4287950d210f",
|
||
|
|
"indicator--591897f4-c34c-423f-a6e1-4a4d950d210f",
|
||
|
|
"indicator--591897f5-e608-49de-9663-406a950d210f",
|
||
|
|
"indicator--591897f5-c370-4a53-ade0-40f1950d210f",
|
||
|
|
"indicator--591897f6-a6a8-451f-a3f3-4e52950d210f",
|
||
|
|
"indicator--591897f6-ce50-48cf-95ea-4649950d210f",
|
||
|
|
"indicator--591897f6-47e4-466a-8377-4b66950d210f",
|
||
|
|
"indicator--591897f7-518c-4412-bd72-4239950d210f",
|
||
|
|
"indicator--591897f7-66fc-426c-81e4-4fcc950d210f",
|
||
|
|
"indicator--591897f8-b630-4849-a8f5-4e0d950d210f",
|
||
|
|
"indicator--591897f8-1768-43b7-82fc-42ad950d210f",
|
||
|
|
"indicator--591897f8-90e4-40ba-b4ca-49d4950d210f",
|
||
|
|
"indicator--591897f9-f818-40e4-a61d-44cb950d210f",
|
||
|
|
"indicator--591897f9-f3c4-4f0c-90dc-4edf950d210f",
|
||
|
|
"indicator--591897fa-5b64-45b5-903d-4da5950d210f",
|
||
|
|
"indicator--591897fa-aa84-4e9b-9872-44e5950d210f",
|
||
|
|
"indicator--591897fa-c730-44ae-a3ce-4d18950d210f",
|
||
|
|
"indicator--591897fb-805c-4dd9-8fad-4504950d210f",
|
||
|
|
"indicator--591897fb-ef24-4234-ab4e-4af8950d210f",
|
||
|
|
"indicator--591897fc-fb18-49bc-86af-4da0950d210f",
|
||
|
|
"indicator--591897fc-5b38-4dfc-acb4-44e4950d210f",
|
||
|
|
"indicator--591897fd-1a1c-4c39-8826-403a950d210f",
|
||
|
|
"indicator--591897fd-cbc8-496f-8536-4df2950d210f",
|
||
|
|
"indicator--591897fd-14b8-4b32-a53c-4565950d210f",
|
||
|
|
"indicator--591897fe-932c-45e9-b57d-413c950d210f",
|
||
|
|
"indicator--591897fe-5388-4561-8de7-4de6950d210f",
|
||
|
|
"indicator--591897ff-0a48-4eb0-b35b-474f950d210f",
|
||
|
|
"indicator--591897ff-df74-4db3-84ef-4a96950d210f",
|
||
|
|
"indicator--59189800-cd48-4883-ba4e-48e9950d210f",
|
||
|
|
"indicator--59189800-224c-44d6-a70d-48d2950d210f",
|
||
|
|
"indicator--59189800-2f58-4ddb-acac-4148950d210f",
|
||
|
|
"indicator--59189801-9cd0-459c-b7f7-42dd950d210f",
|
||
|
|
"indicator--59189801-fa18-414e-8314-45ad950d210f",
|
||
|
|
"indicator--59189802-d51c-4dfc-8452-496e950d210f",
|
||
|
|
"indicator--59189802-9c64-4dff-8152-47ab950d210f",
|
||
|
|
"indicator--59189802-636c-4d94-bfb1-4477950d210f",
|
||
|
|
"indicator--59189803-6f78-44c2-977b-4826950d210f",
|
||
|
|
"indicator--59189803-7c6c-41cf-be2d-4a2e950d210f",
|
||
|
|
"indicator--59189804-84e0-42e4-b185-4be0950d210f",
|
||
|
|
"indicator--59189804-8950-429f-a833-4dc5950d210f",
|
||
|
|
"indicator--59189805-7470-4e8e-bacc-4960950d210f",
|
||
|
|
"indicator--59189805-75c4-45fe-a812-43a8950d210f",
|
||
|
|
"indicator--59189805-3df4-4818-83f1-488e950d210f",
|
||
|
|
"indicator--59189806-db28-40a7-8413-441e950d210f",
|
||
|
|
"indicator--59189806-c170-45c1-a2b9-4337950d210f",
|
||
|
|
"indicator--59189807-7f40-4273-a4f8-44b6950d210f",
|
||
|
|
"indicator--59189807-c2dc-4614-90f9-4219950d210f",
|
||
|
|
"indicator--59189808-899c-4f50-93c8-4fa9950d210f",
|
||
|
|
"indicator--59189808-1650-46ee-acb8-44d5950d210f",
|
||
|
|
"indicator--59189808-df1c-4bef-8f2e-49c2950d210f",
|
||
|
|
"indicator--59189809-b768-4bb2-8167-4cd5950d210f",
|
||
|
|
"indicator--59189809-c644-4bb5-a84e-4981950d210f",
|
||
|
|
"indicator--5918980a-2628-4605-b91b-4659950d210f",
|
||
|
|
"indicator--5918980a-4160-40e3-94e1-4f99950d210f",
|
||
|
|
"indicator--5918980a-ba0c-4823-905b-4e14950d210f",
|
||
|
|
"indicator--5918980b-27c4-4676-97cc-4aba950d210f",
|
||
|
|
"indicator--5918980b-7274-4660-953c-4e7b950d210f",
|
||
|
|
"indicator--5918980c-ab08-49e9-80cd-4a00950d210f",
|
||
|
|
"indicator--5918980c-211c-4024-8ba5-42b5950d210f",
|
||
|
|
"indicator--5918980d-161c-4668-ad80-4964950d210f",
|
||
|
|
"indicator--5918980d-f584-496b-acd9-4f98950d210f",
|
||
|
|
"indicator--5918980d-2390-4584-9223-4904950d210f",
|
||
|
|
"indicator--5918980e-928c-4d37-ab7f-4f45950d210f",
|
||
|
|
"indicator--5918980e-c358-4d44-b2d3-4139950d210f",
|
||
|
|
"indicator--5918980f-bbe8-45dc-8208-442a950d210f",
|
||
|
|
"indicator--5918980f-d5cc-4d9c-a426-4177950d210f",
|
||
|
|
"indicator--59189810-96c8-4abc-9d08-456e950d210f",
|
||
|
|
"indicator--59189810-4a04-42a0-a54e-44b6950d210f",
|
||
|
|
"indicator--59189810-d310-46bf-aafb-4ee5950d210f",
|
||
|
|
"indicator--59189811-8174-4346-adbc-4aa4950d210f",
|
||
|
|
"indicator--59189811-c730-4079-aa10-41c0950d210f",
|
||
|
|
"indicator--59189812-5854-4d68-90c0-48ef950d210f",
|
||
|
|
"indicator--59189812-9438-4b19-8b9d-40d9950d210f",
|
||
|
|
"indicator--59189813-cbc8-4d42-b776-4d5e950d210f",
|
||
|
|
"indicator--59189813-1b98-4b75-9eff-43ff950d210f",
|
||
|
|
"indicator--59189813-5d98-4721-bf2d-4f1a950d210f",
|
||
|
|
"indicator--59189814-ca54-42c4-a558-4d9c950d210f",
|
||
|
|
"indicator--59189814-b06c-4b74-ae21-4531950d210f",
|
||
|
|
"indicator--59189814-1f74-47e8-bf68-4cf6950d210f",
|
||
|
|
"indicator--59189815-efb8-4311-8be8-4727950d210f",
|
||
|
|
"indicator--59189815-4fec-473e-8da6-4672950d210f",
|
||
|
|
"indicator--59189816-8844-4036-b49a-4bab950d210f",
|
||
|
|
"indicator--59189816-4a08-440d-b4bf-40d0950d210f",
|
||
|
|
"indicator--59189816-50c0-4209-a8f5-4fbf950d210f",
|
||
|
|
"indicator--59189817-c790-4307-8b1a-4ab6950d210f",
|
||
|
|
"indicator--59189817-430c-4eaa-8037-415c950d210f",
|
||
|
|
"indicator--59189817-07fc-4129-ab61-45b5950d210f",
|
||
|
|
"indicator--59189818-4c98-4caa-b5c8-431e950d210f",
|
||
|
|
"indicator--59189818-16a4-4224-a16a-421c950d210f",
|
||
|
|
"indicator--59189818-3b4c-42eb-aaa9-4b6c950d210f",
|
||
|
|
"indicator--59189819-4730-47e2-b581-427e950d210f",
|
||
|
|
"indicator--59189819-8188-4203-8855-46f4950d210f",
|
||
|
|
"indicator--59189819-8920-4f02-9faf-49c3950d210f",
|
||
|
|
"indicator--5918981a-60e4-4320-98c0-42cb950d210f",
|
||
|
|
"indicator--5918981a-b6f8-4af8-a688-49df950d210f",
|
||
|
|
"indicator--5918981a-2964-4cb7-889a-47e3950d210f",
|
||
|
|
"indicator--5918981b-a4b8-4616-8c9c-4a2b950d210f",
|
||
|
|
"indicator--5918981b-7c98-4720-a1d9-49ee950d210f",
|
||
|
|
"indicator--5918981c-df18-4215-ad72-45ce950d210f",
|
||
|
|
"indicator--5918981c-82c4-43cd-89c2-4e55950d210f",
|
||
|
|
"indicator--5918981c-8954-4217-964c-4d79950d210f",
|
||
|
|
"indicator--5918981d-3558-4d0f-8951-4e68950d210f",
|
||
|
|
"indicator--5918981d-5c0c-4314-b33b-4d41950d210f",
|
||
|
|
"indicator--5918981d-1f90-4f2c-888c-4e18950d210f",
|
||
|
|
"indicator--5918981e-2214-4320-82e3-4c03950d210f",
|
||
|
|
"indicator--5918981e-e038-40b8-849a-4e69950d210f",
|
||
|
|
"indicator--5918981e-39b0-462e-8d82-44bc950d210f",
|
||
|
|
"indicator--5918981f-5470-4a10-bf41-419c950d210f",
|
||
|
|
"indicator--59189820-de78-450a-9be4-4cfa950d210f",
|
||
|
|
"indicator--59189820-9908-4766-88a2-4674950d210f",
|
||
|
|
"indicator--59189820-dd04-47ab-a28c-4142950d210f",
|
||
|
|
"indicator--59189821-5810-4ad2-93fd-47f5950d210f",
|
||
|
|
"indicator--59189821-a974-49a9-a07e-4d7f950d210f",
|
||
|
|
"indicator--59189822-ce5c-4b31-ae59-45f6950d210f",
|
||
|
|
"indicator--59189822-7d0c-4d78-9aa2-47d5950d210f",
|
||
|
|
"indicator--59189822-9870-4141-9bd3-41ef950d210f",
|
||
|
|
"indicator--59189823-2878-493e-b4bc-4ded950d210f",
|
||
|
|
"indicator--59189823-0650-4c60-8696-4e2c950d210f",
|
||
|
|
"indicator--59189823-022c-48d7-9a82-4f54950d210f",
|
||
|
|
"indicator--59189824-62e0-47a6-bce3-481e950d210f",
|
||
|
|
"indicator--59189824-a034-4731-8173-4206950d210f",
|
||
|
|
"indicator--59189825-8090-45c0-93f5-4ce6950d210f",
|
||
|
|
"indicator--59189825-e1d0-4b64-897b-4348950d210f",
|
||
|
|
"indicator--59189825-e14c-47ce-9ede-437f950d210f",
|
||
|
|
"indicator--59189826-297c-42aa-a709-4b67950d210f",
|
||
|
|
"indicator--59189826-71b4-40b1-8fb3-4a6c950d210f",
|
||
|
|
"indicator--59189827-01d0-4584-b28b-42ad950d210f",
|
||
|
|
"indicator--59189827-0b64-4d39-9ddf-4713950d210f",
|
||
|
|
"indicator--59189827-0d40-47ae-9477-4d66950d210f",
|
||
|
|
"indicator--59189828-2eb0-419b-a12b-4f68950d210f",
|
||
|
|
"indicator--59189828-e938-443e-8b60-401b950d210f",
|
||
|
|
"indicator--59189829-ed84-44a7-8c02-446b950d210f",
|
||
|
|
"indicator--59189829-f9fc-4703-80e2-4ace950d210f",
|
||
|
|
"indicator--5918982a-b338-4ec4-bb13-4805950d210f",
|
||
|
|
"indicator--5918982a-3b10-493b-8756-4a1d950d210f",
|
||
|
|
"indicator--5918982b-77f4-492a-9719-49bd950d210f",
|
||
|
|
"indicator--5918982b-6334-452a-a2be-4ffc950d210f",
|
||
|
|
"indicator--5918982c-35ec-499c-90b2-48a3950d210f",
|
||
|
|
"indicator--5918982c-4790-479e-9574-4b3c950d210f",
|
||
|
|
"indicator--5918982c-92b0-4a6e-9e9b-459d950d210f",
|
||
|
|
"indicator--5918982d-ea78-4a31-ba0f-455c950d210f",
|
||
|
|
"indicator--5918982e-1a8c-43b3-ae6a-47e1950d210f",
|
||
|
|
"indicator--5918982e-5b80-40ca-9e4a-4002950d210f",
|
||
|
|
"indicator--5918982e-4ac8-48b8-9139-43d1950d210f",
|
||
|
|
"indicator--5918982f-6c14-4e57-8d6b-4ce9950d210f",
|
||
|
|
"indicator--5918982f-1834-4290-a5d8-4ebf950d210f",
|
||
|
|
"indicator--59189830-26a4-41bf-94a1-4cb3950d210f",
|
||
|
|
"indicator--59189830-d454-444a-968e-4493950d210f",
|
||
|
|
"indicator--59189831-af18-4216-8ab7-4099950d210f",
|
||
|
|
"indicator--59189831-17d8-454e-97ef-46e8950d210f",
|
||
|
|
"indicator--59189831-591c-4707-bd8b-466a950d210f",
|
||
|
|
"indicator--59189832-f098-45c6-891a-435a950d210f",
|
||
|
|
"indicator--59189832-d4d0-4ee7-b330-4051950d210f",
|
||
|
|
"indicator--59189833-b914-421f-a027-4c6e950d210f",
|
||
|
|
"indicator--59189833-f250-4ea7-b9b3-464e950d210f",
|
||
|
|
"indicator--59189833-71a4-4a0d-b30f-40a8950d210f",
|
||
|
|
"indicator--59189834-0838-4bd7-8de2-4025950d210f",
|
||
|
|
"indicator--59189834-2d0c-41c1-8299-44a4950d210f",
|
||
|
|
"indicator--59189835-cfec-4543-8567-40b2950d210f",
|
||
|
|
"indicator--59189835-4ab4-48d1-8978-4fd5950d210f",
|
||
|
|
"indicator--59189835-2088-46dd-ab89-4629950d210f",
|
||
|
|
"indicator--59189836-f0e0-4d23-b943-4eae950d210f",
|
||
|
|
"indicator--59189836-3648-4146-a915-482e950d210f",
|
||
|
|
"indicator--59189837-ea8c-44b9-83f1-4082950d210f",
|
||
|
|
"indicator--59189837-d838-4b1e-af46-45ac950d210f",
|
||
|
|
"indicator--59189837-5ba0-455e-9a4f-40f8950d210f",
|
||
|
|
"indicator--59189838-92cc-4eab-b305-4ac9950d210f",
|
||
|
|
"indicator--59189838-1578-4677-acd6-45f6950d210f",
|
||
|
|
"indicator--59189839-8128-4aed-a597-48fe950d210f",
|
||
|
|
"indicator--59189839-2ef8-4299-8a8e-4640950d210f",
|
||
|
|
"indicator--59189839-740c-4340-b377-4427950d210f",
|
||
|
|
"indicator--5918983a-8878-46a3-83e4-4673950d210f",
|
||
|
|
"indicator--5918983a-6664-43e9-9956-4873950d210f",
|
||
|
|
"indicator--5918983b-a568-46f2-851c-474e950d210f",
|
||
|
|
"indicator--5918983b-8a50-4ba3-97f5-40a4950d210f",
|
||
|
|
"indicator--5918983c-b6cc-4a1a-86d7-4966950d210f",
|
||
|
|
"indicator--5918983c-ef88-4ff2-be7a-4334950d210f",
|
||
|
|
"indicator--5918983d-f9c4-4fa2-85ca-44e3950d210f",
|
||
|
|
"indicator--5918983d-c898-4bfe-93af-4acc950d210f",
|
||
|
|
"indicator--5918983e-c768-4d6a-904f-4e3b950d210f",
|
||
|
|
"indicator--5918983e-6ab8-4a5a-b16d-477e950d210f",
|
||
|
|
"indicator--5918983f-a218-426c-889f-44f6950d210f",
|
||
|
|
"indicator--5918983f-7334-4832-9da3-4c26950d210f",
|
||
|
|
"indicator--59189840-1508-48f7-839d-4b27950d210f",
|
||
|
|
"indicator--59189840-ff94-44f3-8dcb-4042950d210f",
|
||
|
|
"indicator--59189840-f49c-4689-baeb-47f1950d210f",
|
||
|
|
"indicator--59189841-9db4-4f18-9aa5-4cb2950d210f",
|
||
|
|
"indicator--59189841-01e8-4c8d-ab98-4630950d210f",
|
||
|
|
"indicator--59189842-5fe8-4206-95af-4b65950d210f",
|
||
|
|
"indicator--59189842-ad50-40e5-8313-4c14950d210f",
|
||
|
|
"indicator--59189842-5db0-4a2d-8b21-4bae950d210f",
|
||
|
|
"indicator--59189843-55f0-414a-a925-4494950d210f",
|
||
|
|
"indicator--59189843-d744-4989-af27-446d950d210f",
|
||
|
|
"indicator--59189844-ef74-40cc-bb42-4034950d210f",
|
||
|
|
"indicator--59189844-5980-4b37-b4bf-4d50950d210f",
|
||
|
|
"indicator--59189845-1d68-47a2-9849-40c8950d210f",
|
||
|
|
"indicator--59189845-c010-4021-b3ca-4719950d210f",
|
||
|
|
"indicator--59189845-9454-49d6-be0d-4f07950d210f",
|
||
|
|
"indicator--59189846-7a38-4d81-a048-408a950d210f",
|
||
|
|
"indicator--59189846-19a0-4cf5-9146-4474950d210f",
|
||
|
|
"indicator--59189847-0a70-4a17-a088-4a71950d210f",
|
||
|
|
"indicator--59189847-cb84-45d5-9eda-4c6b950d210f",
|
||
|
|
"indicator--59189848-4e70-424c-8e8c-47fb950d210f",
|
||
|
|
"indicator--59189848-e7c8-4aac-8d6b-4f75950d210f",
|
||
|
|
"indicator--59189848-abd8-4dd0-b469-426e950d210f",
|
||
|
|
"indicator--59189849-7710-49e9-a98c-4055950d210f",
|
||
|
|
"indicator--59189849-36fc-4300-aed6-4adc950d210f",
|
||
|
|
"indicator--5918984a-d1e0-44f4-af3b-4f5c950d210f",
|
||
|
|
"indicator--5918984a-3ab8-4fe0-b0a2-4825950d210f",
|
||
|
|
"indicator--5918984b-7758-4ee1-a254-4790950d210f",
|
||
|
|
"indicator--5918984b-6668-46a4-a706-4c7b950d210f",
|
||
|
|
"indicator--5918984c-4fd8-4c9f-9f28-4562950d210f",
|
||
|
|
"indicator--5918984c-83bc-4993-baf9-4076950d210f",
|
||
|
|
"indicator--5918984d-9154-45a0-ae94-446d950d210f",
|
||
|
|
"indicator--5918984d-3db0-4d29-83c9-46d1950d210f",
|
||
|
|
"indicator--5918984d-5b18-48d5-a246-4b30950d210f",
|
||
|
|
"indicator--5918984e-af14-4ab3-9882-4947950d210f",
|
||
|
|
"indicator--5918984e-b0a4-4c44-9294-414a950d210f",
|
||
|
|
"indicator--5918984f-821c-474a-9cb1-4d9a950d210f",
|
||
|
|
"indicator--5918984f-e7f0-4d29-8049-4cce950d210f",
|
||
|
|
"indicator--59189850-4860-44d2-9d01-4149950d210f",
|
||
|
|
"indicator--59189850-a314-405a-8127-4a1a950d210f",
|
||
|
|
"indicator--59189851-abdc-4eb1-a542-43ff950d210f",
|
||
|
|
"indicator--59189851-e108-4d65-8740-4373950d210f",
|
||
|
|
"indicator--59189851-70c4-4b78-8527-496d950d210f",
|
||
|
|
"indicator--59189852-4d28-4338-981c-42d5950d210f",
|
||
|
|
"indicator--59189852-0e68-4b20-8cd0-484b950d210f",
|
||
|
|
"indicator--59189853-6038-46b9-bd80-4dea950d210f",
|
||
|
|
"indicator--59189853-6bd8-4265-a108-414b950d210f",
|
||
|
|
"indicator--59189854-e66c-4107-b9f5-4abe950d210f",
|
||
|
|
"indicator--59189854-1a78-4b28-9216-4e60950d210f",
|
||
|
|
"indicator--59189855-da00-4da1-aa34-4922950d210f",
|
||
|
|
"indicator--59189855-ee50-4b78-88d4-424c950d210f",
|
||
|
|
"indicator--59189856-7b50-4106-9e84-47ae950d210f",
|
||
|
|
"indicator--59189856-86a4-4ac3-aba7-4116950d210f",
|
||
|
|
"indicator--59189856-198c-4b29-92c5-4756950d210f",
|
||
|
|
"indicator--59189857-e48c-43a2-a198-495b950d210f",
|
||
|
|
"indicator--59189857-17a0-4cc3-804d-4b12950d210f",
|
||
|
|
"indicator--59189858-ac0c-4ec1-ad92-4efc950d210f",
|
||
|
|
"indicator--59189858-74dc-486e-9d27-4433950d210f",
|
||
|
|
"indicator--59189859-84d8-4016-9f2e-4981950d210f",
|
||
|
|
"indicator--59189859-3fcc-4066-b714-4512950d210f",
|
||
|
|
"indicator--59189859-29dc-46ed-90e3-468e950d210f",
|
||
|
|
"indicator--5918985a-d38c-4c54-8d8c-4301950d210f",
|
||
|
|
"indicator--5918985a-c88c-4807-a0fc-4095950d210f",
|
||
|
|
"indicator--5918985b-d46c-4731-9f03-49a5950d210f",
|
||
|
|
"indicator--5918985b-4de8-4011-b69a-4be7950d210f",
|
||
|
|
"indicator--5918985b-efd8-4a87-9aaa-46c5950d210f",
|
||
|
|
"indicator--5918985c-a3ac-4808-8267-4915950d210f",
|
||
|
|
"indicator--5918985c-1d10-4c4c-9921-457a950d210f",
|
||
|
|
"indicator--5918985d-6350-4f4f-8489-4569950d210f",
|
||
|
|
"indicator--5918985d-3ff0-4260-aed1-4e33950d210f",
|
||
|
|
"indicator--5918985d-8364-4d75-b479-4358950d210f",
|
||
|
|
"indicator--5918985e-cab4-42e2-9a70-4f9e950d210f",
|
||
|
|
"indicator--5918985e-1ed4-4f24-9c20-46dc950d210f",
|
||
|
|
"indicator--5918985f-9760-443a-9552-4624950d210f",
|
||
|
|
"indicator--5918985f-55b0-40ae-9616-4126950d210f",
|
||
|
|
"indicator--59189860-48f4-48ca-9a89-4ad0950d210f",
|
||
|
|
"indicator--59189860-1e40-4f42-8152-4d74950d210f",
|
||
|
|
"indicator--59189861-0078-432e-b7e2-4f21950d210f",
|
||
|
|
"indicator--59189861-6f64-4b0d-9ac7-4c97950d210f",
|
||
|
|
"indicator--59189861-e3a4-404d-a00b-4c6c950d210f",
|
||
|
|
"indicator--59189862-7250-494d-bd22-450e950d210f",
|
||
|
|
"indicator--59189862-3f14-41ae-924b-4e24950d210f",
|
||
|
|
"indicator--59189863-35f8-4a64-abde-425f950d210f",
|
||
|
|
"indicator--59189863-053c-4186-a62f-4b7f950d210f",
|
||
|
|
"indicator--59189864-c3c0-4230-a396-4c49950d210f",
|
||
|
|
"indicator--59189864-f74c-494a-8c2a-46be950d210f",
|
||
|
|
"indicator--59189864-6178-49a6-91cd-4861950d210f",
|
||
|
|
"indicator--59189865-fea4-43f4-ba64-490a950d210f",
|
||
|
|
"indicator--59189865-0984-4dc2-adf0-42d2950d210f",
|
||
|
|
"indicator--59189866-7148-4314-8fbd-461a950d210f",
|
||
|
|
"indicator--59189866-0c7c-4f81-be28-42a6950d210f",
|
||
|
|
"indicator--59189866-7ca4-4dfd-86e5-4d81950d210f",
|
||
|
|
"indicator--59189867-f2b4-4b3d-8bae-4cdc950d210f",
|
||
|
|
"indicator--59189867-6bcc-4794-9b10-418c950d210f",
|
||
|
|
"indicator--59189868-11f4-4e61-8496-4c90950d210f",
|
||
|
|
"indicator--59189868-db10-43f4-a4db-41e4950d210f",
|
||
|
|
"indicator--59189868-21e8-48c8-81a6-4373950d210f",
|
||
|
|
"indicator--59189869-9d40-4d99-a5ee-489f950d210f",
|
||
|
|
"indicator--59189869-6448-41f6-864e-4e03950d210f",
|
||
|
|
"indicator--5918986a-4794-4fef-a149-487d950d210f",
|
||
|
|
"indicator--5918986a-d748-4b52-bd3d-4c7c950d210f",
|
||
|
|
"indicator--5918986a-eb70-4755-ab06-4124950d210f",
|
||
|
|
"indicator--5918986b-c200-4c9d-a061-4a74950d210f",
|
||
|
|
"indicator--5918986b-0c80-4f1d-bf62-4ad6950d210f",
|
||
|
|
"indicator--5918986c-78c4-4c60-9080-4446950d210f",
|
||
|
|
"indicator--5918986c-3e90-4762-a3e3-4f7c950d210f",
|
||
|
|
"indicator--5918986c-2ca8-47d7-bce4-4058950d210f",
|
||
|
|
"indicator--5918986d-3dd0-4390-930b-4083950d210f",
|
||
|
|
"indicator--5918986d-04f8-42b7-83af-4c85950d210f",
|
||
|
|
"indicator--5918986d-d86c-465d-8b64-4193950d210f",
|
||
|
|
"indicator--5918986e-280c-4d8e-873e-4761950d210f",
|
||
|
|
"indicator--5918986e-94e4-43e4-9ce1-431d950d210f",
|
||
|
|
"indicator--5918986f-4c40-44a4-8841-4904950d210f",
|
||
|
|
"indicator--5918986f-3670-49a7-a7c6-4a3d950d210f",
|
||
|
|
"indicator--5918986f-b018-4865-a637-430b950d210f",
|
||
|
|
"indicator--59189870-a21c-47f8-8b92-4a18950d210f",
|
||
|
|
"indicator--59189870-8414-40e6-8e2f-4263950d210f",
|
||
|
|
"indicator--59189871-d0a8-4313-ba24-4052950d210f",
|
||
|
|
"indicator--59189871-f930-4f51-b528-4bd7950d210f",
|
||
|
|
"indicator--59189872-123c-48b6-b9a4-44a0950d210f",
|
||
|
|
"indicator--59189872-a048-4c4c-97cf-4bdc950d210f",
|
||
|
|
"indicator--59189872-05a4-4644-bfa3-4289950d210f",
|
||
|
|
"indicator--59189873-f998-4eb1-b33d-43cc950d210f",
|
||
|
|
"indicator--59189873-d800-4032-974e-47bb950d210f",
|
||
|
|
"indicator--59189874-d4e8-417d-9bed-43bb950d210f",
|
||
|
|
"indicator--59189874-ab3c-45fc-a4b2-44c6950d210f",
|
||
|
|
"indicator--59189875-05d8-4c67-af6e-481c950d210f",
|
||
|
|
"indicator--59189875-8354-4beb-bb13-44b2950d210f",
|
||
|
|
"indicator--59189875-ff78-42b5-89be-49b8950d210f",
|
||
|
|
"indicator--59189876-81ac-49f7-8275-482e950d210f",
|
||
|
|
"indicator--59189876-db90-41e3-8bbc-4356950d210f",
|
||
|
|
"indicator--59189877-ca30-452d-b655-49e3950d210f",
|
||
|
|
"indicator--59189877-c910-40bd-8416-44a9950d210f",
|
||
|
|
"indicator--59189878-310c-498e-84f5-4669950d210f",
|
||
|
|
"indicator--59189878-0958-456e-b957-4685950d210f",
|
||
|
|
"indicator--59189878-c4d8-46c9-80c9-478b950d210f",
|
||
|
|
"indicator--59189879-a1d4-4a51-b858-4cc7950d210f",
|
||
|
|
"indicator--59189879-2678-4720-9a4c-4947950d210f",
|
||
|
|
"indicator--5918987a-bcf8-413a-ab12-461c950d210f",
|
||
|
|
"indicator--5918987a-3708-4ca2-b60d-4a64950d210f",
|
||
|
|
"indicator--5918987b-8db0-484f-bfe3-45b6950d210f",
|
||
|
|
"indicator--5918987b-73d8-4153-9305-4c89950d210f",
|
||
|
|
"indicator--5918987b-86e0-467d-9f7e-46c8950d210f",
|
||
|
|
"indicator--5918987c-69e4-4865-ab49-426b950d210f",
|
||
|
|
"indicator--5918987c-77a4-4926-83ba-40d3950d210f",
|
||
|
|
"indicator--5918987d-5c70-47bd-a9d9-4663950d210f",
|
||
|
|
"indicator--5918987d-fc34-403d-8177-4d33950d210f",
|
||
|
|
"indicator--5918987d-eac0-4f2a-97f9-4e0f950d210f",
|
||
|
|
"indicator--5918987e-a4b4-4ad6-bac9-4cec950d210f",
|
||
|
|
"indicator--5918987e-69a4-440f-abab-400c950d210f",
|
||
|
|
"indicator--5918987f-c038-4854-88de-4e6b950d210f",
|
||
|
|
"indicator--5918987f-f718-4f05-a88d-495d950d210f",
|
||
|
|
"indicator--5918987f-9d98-4523-b5ed-4fc4950d210f",
|
||
|
|
"indicator--59189880-996c-4248-a29a-4eb0950d210f",
|
||
|
|
"indicator--59189880-a5e8-47fb-857e-43f2950d210f",
|
||
|
|
"indicator--59189880-5874-4814-ba66-4018950d210f",
|
||
|
|
"indicator--59189881-de60-43ba-a85c-46de950d210f",
|
||
|
|
"indicator--59189881-2230-454f-aa21-44ce950d210f",
|
||
|
|
"indicator--59189882-5344-4d84-951c-4b58950d210f",
|
||
|
|
"indicator--59189882-81e8-4c53-b8ce-492f950d210f",
|
||
|
|
"indicator--59189883-2c4c-450f-b1be-46bd950d210f",
|
||
|
|
"indicator--59189883-8fa0-429f-b515-4bd8950d210f",
|
||
|
|
"indicator--59189883-e318-4c97-949d-4ee9950d210f",
|
||
|
|
"indicator--59189884-3e28-44cb-bafe-4ddf950d210f",
|
||
|
|
"indicator--59189884-63d8-4604-8499-49e9950d210f",
|
||
|
|
"indicator--59189884-6ef0-419b-8c6e-4ba2950d210f",
|
||
|
|
"indicator--59189885-d578-469a-aeeb-4ead950d210f",
|
||
|
|
"indicator--59189885-e198-4b11-b5e2-4f16950d210f",
|
||
|
|
"indicator--59189886-37f4-48d6-8cc5-4ad6950d210f",
|
||
|
|
"indicator--59189886-08f0-402e-89a2-49dd950d210f",
|
||
|
|
"indicator--59189886-7d94-4804-a6ea-4ec0950d210f",
|
||
|
|
"indicator--59189887-3ee0-407e-96f1-4784950d210f",
|
||
|
|
"indicator--59189887-718c-4b42-9e7a-4efb950d210f",
|
||
|
|
"indicator--59189888-3194-4120-85aa-4d50950d210f",
|
||
|
|
"indicator--59189888-c5f0-4096-ad35-4484950d210f",
|
||
|
|
"indicator--59189888-bb90-4b56-a1bc-41db950d210f",
|
||
|
|
"indicator--59189889-4c84-45ed-b296-4e5e950d210f",
|
||
|
|
"indicator--59189889-26f0-401b-93d6-46c8950d210f",
|
||
|
|
"indicator--59189889-76c4-4e50-9c40-4299950d210f",
|
||
|
|
"indicator--5918988a-48ec-4871-842e-4979950d210f",
|
||
|
|
"indicator--5918988a-0f80-43c9-b947-4631950d210f",
|
||
|
|
"indicator--5918988b-125c-4d1f-b14a-40f9950d210f",
|
||
|
|
"indicator--5918988b-496c-4cc8-b685-4e07950d210f",
|
||
|
|
"indicator--5918988c-3ee4-45da-a78d-4641950d210f",
|
||
|
|
"indicator--5918988c-7510-4f1a-b27e-46f4950d210f",
|
||
|
|
"indicator--5918988d-f754-4f61-9525-4c58950d210f",
|
||
|
|
"indicator--5918988d-fe2c-48da-8d47-42b6950d210f",
|
||
|
|
"indicator--5918988e-81f4-42c9-b4dd-465f950d210f",
|
||
|
|
"indicator--5918988e-74e0-44ab-90e1-44c8950d210f",
|
||
|
|
"indicator--5918988f-fd80-42c9-bbbb-480d950d210f",
|
||
|
|
"indicator--5918988f-5198-4208-acc4-4cf0950d210f",
|
||
|
|
"indicator--5918988f-d53c-4092-aca2-4965950d210f",
|
||
|
|
"indicator--59189890-5d78-404f-b4f1-458f950d210f",
|
||
|
|
"indicator--59189890-7660-4bda-a855-449f950d210f",
|
||
|
|
"indicator--59189891-c770-4ea1-b981-4c71950d210f",
|
||
|
|
"indicator--59189891-8200-49a4-aa45-4cae950d210f",
|
||
|
|
"indicator--59189892-03b0-4a38-aa6c-485e950d210f",
|
||
|
|
"indicator--59189892-3aa8-4f54-97fc-4125950d210f",
|
||
|
|
"indicator--59189893-a1a4-42e6-9e50-4770950d210f",
|
||
|
|
"indicator--59189893-a41c-4705-a768-4ffa950d210f",
|
||
|
|
"indicator--59189893-8e7c-44b8-925b-46d0950d210f",
|
||
|
|
"indicator--59189894-1f68-44f0-bd64-42c2950d210f",
|
||
|
|
"indicator--59189894-0af4-44ba-a8ab-4d3c950d210f",
|
||
|
|
"indicator--59189895-e460-4341-953e-4d8b950d210f",
|
||
|
|
"indicator--59189895-4448-4b7d-9946-45b9950d210f",
|
||
|
|
"indicator--59189896-1fe4-4751-ba2f-46cf950d210f",
|
||
|
|
"indicator--59189896-0294-49b2-98c5-45e3950d210f",
|
||
|
|
"indicator--59189897-a0f8-45d4-9226-4e0a950d210f",
|
||
|
|
"indicator--59189897-1174-40cc-a314-402e950d210f",
|
||
|
|
"indicator--59189897-ddb0-4c2b-ac73-4a8e950d210f",
|
||
|
|
"indicator--59189898-b43c-4911-93bc-4759950d210f",
|
||
|
|
"indicator--59189898-f0cc-4a81-9607-4db3950d210f",
|
||
|
|
"indicator--59189899-769c-4d7c-a001-4635950d210f",
|
||
|
|
"indicator--59189899-2308-4a20-949e-453a950d210f",
|
||
|
|
"indicator--5918989a-6254-4821-a1b2-447b950d210f",
|
||
|
|
"indicator--5918989a-ce3c-4fa5-bef5-4749950d210f",
|
||
|
|
"indicator--5918989b-3f8c-4051-9df9-4cc0950d210f",
|
||
|
|
"indicator--5918989b-a3d8-4779-9f72-4502950d210f",
|
||
|
|
"indicator--5918989c-f544-4b2b-8322-4333950d210f",
|
||
|
|
"indicator--5918989c-a22c-43f0-8c03-42c4950d210f",
|
||
|
|
"indicator--5918989c-72ec-4a14-9c60-4bed950d210f",
|
||
|
|
"indicator--5918989d-fa04-43a5-b46f-4d30950d210f",
|
||
|
|
"indicator--5918989d-d518-4a3c-a734-4129950d210f",
|
||
|
|
"indicator--5918989e-0890-4898-a6da-43f0950d210f",
|
||
|
|
"indicator--5918989e-8040-4ca9-bf18-4069950d210f",
|
||
|
|
"indicator--5918989e-6584-4a9a-9c47-40ed950d210f",
|
||
|
|
"indicator--5918989f-10f4-4a0f-8db1-463d950d210f",
|
||
|
|
"indicator--5918989f-7980-433b-9337-4c2f950d210f",
|
||
|
|
"indicator--591898a0-9380-44b2-a6a7-4175950d210f",
|
||
|
|
"indicator--591898a0-d240-4110-b6e8-415b950d210f",
|
||
|
|
"indicator--591898a1-796c-4a53-aee3-4cd3950d210f",
|
||
|
|
"indicator--591898a1-8b30-4bd7-8b76-4e53950d210f",
|
||
|
|
"indicator--591898a2-b060-44cb-bf15-4849950d210f",
|
||
|
|
"indicator--591898a2-320c-4793-8853-475c950d210f",
|
||
|
|
"indicator--591898a2-38b8-4a9b-a9d3-4bbe950d210f",
|
||
|
|
"indicator--591898a3-7f48-4a94-b90e-4bf8950d210f",
|
||
|
|
"indicator--591898a3-4750-46a2-aa9d-4ab6950d210f",
|
||
|
|
"indicator--591898a4-1f40-41ed-96eb-44ff950d210f",
|
||
|
|
"indicator--591898a4-7038-4e0a-a277-4cdc950d210f",
|
||
|
|
"indicator--591898a5-fab8-410e-905c-4cce950d210f",
|
||
|
|
"indicator--591898a5-b9a4-408f-a52f-4c06950d210f",
|
||
|
|
"indicator--591898a6-3ac4-4843-93a7-4f84950d210f",
|
||
|
|
"indicator--591898a6-8f4c-4668-8349-44f9950d210f",
|
||
|
|
"indicator--591898a7-3424-4ca8-bb8f-4ef5950d210f",
|
||
|
|
"indicator--591898a7-5400-4fda-b9d1-45ef950d210f",
|
||
|
|
"indicator--591898a8-f494-46fb-866f-440b950d210f",
|
||
|
|
"indicator--591898a8-9748-4c19-b986-4df3950d210f",
|
||
|
|
"indicator--591898a9-f4b0-4234-ba02-4781950d210f",
|
||
|
|
"indicator--591898aa-7d50-46db-bf74-4159950d210f",
|
||
|
|
"indicator--591898aa-7cb4-4987-9c83-4eb3950d210f",
|
||
|
|
"indicator--591898aa-9840-4929-90b8-4573950d210f",
|
||
|
|
"indicator--591898ab-1108-451e-bbe5-44c5950d210f",
|
||
|
|
"indicator--591898ab-8568-4287-bef5-4a07950d210f",
|
||
|
|
"indicator--591898ac-f4ec-4490-bad3-44cf950d210f",
|
||
|
|
"indicator--591898ac-e208-4694-ab1e-4c47950d210f",
|
||
|
|
"indicator--591898ad-72ec-4d56-913c-4c73950d210f",
|
||
|
|
"indicator--591898ad-775c-4572-9398-4a4d950d210f",
|
||
|
|
"indicator--591898ad-a254-4e98-8f04-4ae5950d210f",
|
||
|
|
"indicator--591898ae-23e4-433d-92d7-410c950d210f",
|
||
|
|
"indicator--591898ae-2abc-4329-af04-45d6950d210f",
|
||
|
|
"indicator--591898ae-9600-4d4d-9083-4594950d210f",
|
||
|
|
"indicator--591898af-e2e0-4ecc-9fd5-48fb950d210f",
|
||
|
|
"indicator--591898af-2900-450b-b0f1-4510950d210f",
|
||
|
|
"indicator--591898b0-103c-4af7-8dac-46e3950d210f",
|
||
|
|
"indicator--591898b0-c9f4-48ce-88be-4939950d210f",
|
||
|
|
"indicator--591898b0-4c40-43d6-b472-43aa950d210f",
|
||
|
|
"indicator--591898b1-d634-4ed4-b231-4787950d210f",
|
||
|
|
"indicator--591898b1-dc40-45e8-8ce4-4ab9950d210f",
|
||
|
|
"indicator--591898b1-be48-4260-9d12-4e75950d210f",
|
||
|
|
"indicator--591898b2-60cc-4e03-acd4-4f08950d210f",
|
||
|
|
"indicator--591898b2-92d4-4cf6-bc26-4c17950d210f",
|
||
|
|
"indicator--591898b3-1994-4c1b-a22e-491c950d210f",
|
||
|
|
"indicator--591898b3-6748-47ef-aad2-4a66950d210f",
|
||
|
|
"indicator--591898b3-f0b8-4e1b-8a27-43ec950d210f",
|
||
|
|
"indicator--591898b4-fd78-427d-b2bc-458b950d210f",
|
||
|
|
"indicator--591898b4-09f0-4d26-8c41-4d9d950d210f",
|
||
|
|
"indicator--591898b5-4de4-4fd3-b316-4c68950d210f",
|
||
|
|
"indicator--591898b5-82bc-47ce-bd3c-4ac3950d210f",
|
||
|
|
"indicator--591898b5-9068-4333-ba5d-4667950d210f",
|
||
|
|
"indicator--591898b6-db24-4b2c-86dd-48ee950d210f",
|
||
|
|
"indicator--591898b6-41fc-4352-9bb4-4058950d210f",
|
||
|
|
"indicator--591898b7-aa94-4eef-a479-4fb2950d210f",
|
||
|
|
"indicator--591898b7-6dd8-4c05-87d1-470c950d210f",
|
||
|
|
"indicator--591898b7-c824-451e-87d4-4bf2950d210f",
|
||
|
|
"indicator--591898b8-c6a4-4793-ad96-4398950d210f",
|
||
|
|
"indicator--591898b8-cf78-4414-9174-4f40950d210f",
|
||
|
|
"indicator--591898b9-4c54-49d0-b8a6-4318950d210f",
|
||
|
|
"indicator--591898b9-398c-4339-b4ec-475f950d210f",
|
||
|
|
"indicator--591898b9-e228-4a19-82d1-4da1950d210f",
|
||
|
|
"indicator--591898ba-1d40-43da-9cfa-4546950d210f",
|
||
|
|
"indicator--591898ba-cb64-471d-958e-430c950d210f",
|
||
|
|
"indicator--591898bb-777c-4c86-bece-498e950d210f",
|
||
|
|
"indicator--591898bb-91b4-4150-9ee4-4207950d210f",
|
||
|
|
"indicator--591898bb-7c94-441d-a93b-464e950d210f",
|
||
|
|
"indicator--591898bc-9718-4bb9-94b3-416a950d210f",
|
||
|
|
"indicator--591898bc-8944-4992-829d-49e5950d210f",
|
||
|
|
"indicator--591898bd-581c-4719-86a2-4e9c950d210f",
|
||
|
|
"indicator--591898bd-39bc-4d8f-9674-4efa950d210f",
|
||
|
|
"indicator--591898be-0a64-4e03-97cb-4acf950d210f",
|
||
|
|
"indicator--591898be-30cc-466c-8ffc-4711950d210f",
|
||
|
|
"indicator--591898be-8794-4572-aca0-4655950d210f",
|
||
|
|
"indicator--591898bf-f298-4292-8e56-43af950d210f",
|
||
|
|
"indicator--591898bf-27c0-4f87-b24d-43c5950d210f",
|
||
|
|
"indicator--591898c0-d090-40b7-be48-4e90950d210f",
|
||
|
|
"indicator--591898c0-acf0-48c0-ba98-4063950d210f",
|
||
|
|
"indicator--591898c1-62c0-4ffc-8799-4195950d210f",
|
||
|
|
"indicator--591898c1-5ff8-4c83-99e7-458c950d210f",
|
||
|
|
"indicator--591898c1-f7bc-446d-b4ce-4f2e950d210f",
|
||
|
|
"indicator--591898c2-2bb0-451d-8b4b-45ce950d210f",
|
||
|
|
"indicator--591898c2-08fc-4860-b281-4b73950d210f",
|
||
|
|
"indicator--591898c3-293c-4288-993d-4244950d210f",
|
||
|
|
"indicator--591898c3-5840-486c-8d04-4c4d950d210f",
|
||
|
|
"indicator--591898c4-d938-46c1-b4b8-44d5950d210f",
|
||
|
|
"indicator--591898c4-1ab4-420f-9cc4-4f4e950d210f",
|
||
|
|
"indicator--591898c4-b050-4f20-8579-4e42950d210f",
|
||
|
|
"indicator--591898c5-8b60-4bc3-b681-4dfa950d210f",
|
||
|
|
"indicator--591898c5-a790-49c9-b69b-4714950d210f",
|
||
|
|
"indicator--591898c6-3cc0-4109-81d3-460c950d210f",
|
||
|
|
"indicator--591898c6-638c-4063-9dcb-499e950d210f",
|
||
|
|
"indicator--591898c6-d9ec-4462-a1a2-4236950d210f",
|
||
|
|
"indicator--591898c7-5b54-4d5b-9b76-4dcf950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"osint:source-type=\"blog-post\"",
|
||
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
||
|
|
"malware_classification:malware-category=\"Ransomware\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59189558-6554-4458-960f-4c9e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:39:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:39:05.000Z",
|
||
|
|
"first_observed": "2017-05-14T17:39:05Z",
|
||
|
|
"last_observed": "2017-05-14T17:39:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59189558-6554-4458-960f-4c9e950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59189558-6554-4458-960f-4c9e950d210f",
|
||
|
|
"value": "http://blog.talosintelligence.com/2017/05/jaff-ransomware.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5918956c-0b44-4e78-8f14-4449950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:39:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:39:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Talos is constantly monitoring the email threat landscape and tracking both new threats as well as changes to existing threats. We recently observed several large scale email campaigns that were attempting to distribute a new variant of ransomware that has been dubbed \"Jaff\". Interestingly we identified several characteristics that we have previously observed being used during Dridex and Locky campaigns. In a short period of time, we observed multiple campaigns featuring high volumes of malicious spam emails being distributed, each using a PDF attachment with an embedded Microsoft Word document functioning as the initial downloader for the Jaff ransomware. While Cisco customers were already automatically protected against this threat, we decided to take a deeper look at this threat and its possible implications across the threat landscape. We have outlined the infection process and additional relevant information regarding this threat in detail below."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918958a-08d4-4f91-887a-48b9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:36:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:36:10.000Z",
|
||
|
|
"description": "C2 Server",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '108.165.22.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:36:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918958b-5474-41c6-8764-4126950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:36:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:36:11.000Z",
|
||
|
|
"description": "C2 Server",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '27.254.44.204']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c3-7ef4-492f-be54-4713950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:29.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = '5hdnnd74fffrottd.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c4-9854-4f56-8299-481b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:30.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'babil117.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c4-6cf4-4ff9-89d7-426d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:30.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'balprodukt.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c5-5ab8-436f-8420-429c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:31.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'bellevillenorfolkterriers.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c5-b0cc-4913-8341-404e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:31.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'biolume.nl']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c6-2b88-4a17-88a8-4d48950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:32.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'bitsslab.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c6-7ac0-4d4e-96ec-44d0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:32.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[url:value = 'bitsslab.com/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c7-f1a8-413c-bd1c-4286950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:33.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'boaevents.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c7-882c-47f9-a765-4e05950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:33.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'byydei74fg43ff4f.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c7-70c8-4434-a3e1-434d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:34.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[url:value = 'byydei74fg43ff4f.net/af/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c8-99cc-44cc-83e3-44d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:34.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'demelkwegtuk.nl']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c8-b17c-411c-b947-4eba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:34.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'diejosch.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c9-91d4-4279-a60d-4713950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:35.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'domainway.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c9-0500-4a41-863c-44ef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:35.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'easysupport.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895c9-7690-46b9-ad64-4f63950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:35.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'edluke.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895ca-e578-48de-b15f-4d76950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:36.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'enboite.be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895ca-7e78-4bbc-ad06-477d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:36.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'etadjewellery.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cb-3d04-4683-8b18-4b7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:37.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'geo-zamer.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cb-2d44-4d2b-8716-4e32950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:37.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'jisrcenter.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cb-7468-46bc-8284-4a2d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:38.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'jomajaco.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cc-eb34-42f7-995a-4008950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:38.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'julian-g.ro']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cc-ea68-491a-b9a8-4018950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:38.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'kbelgesi.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cd-b9a8-4f3c-9b68-4662950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:39.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'kitchenandgifts.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cd-2d5c-4bcf-b50a-4845950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:39.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'koreancars-club.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cd-984c-4d81-8e9b-4604950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:40.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'monowheels.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895ce-02ac-43f2-9250-492e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:40.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'oklahomagunlawyers.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895ce-2a3c-4f86-a34e-43a8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:41.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'outback-cycles.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cf-beb8-4d4d-9ed8-491c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:41.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'panaceya-n.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cf-f8a4-476f-a513-46d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:41.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'pgringette.ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895cf-66ac-44bb-9348-4aec950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:42.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'phinamco.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d0-e49c-4da7-b2a8-456c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:42.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'prystel.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d0-7f74-49ac-a478-4213950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:42.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'taddboxers.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d1-6518-48d3-9c70-412f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:43.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'takanashi.jp']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d1-6358-48ec-bb02-479c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:43.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'takipediliyoruz.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d2-e148-4825-816c-4a5c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:43.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'techno-kar.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d2-063c-4aa1-964e-497a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:44.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'tending.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d2-4904-49c5-8a29-4e5d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:44.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'thegoldclubs.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d3-5c1c-4ca2-a4fb-4c9f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:45.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'tiskr.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d3-bc0c-4642-a459-422e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:45.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'trans-atm.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d4-b548-4d59-9ad7-4403950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:45.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'trebleimp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d4-a0d4-474a-9a64-42e7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:46.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'trialinsider.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d5-7c60-4dab-9752-41b3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:46.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'villa31.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d5-f94c-4a66-b27d-46e2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:46.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'volley-bal.be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d6-be74-4de3-ac6f-4b36950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:47.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'vscard.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d6-92e0-481e-8148-4a8e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:47.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'wipersdirect.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591895d6-72c8-46ed-9802-43ea950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:38:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:38:47.000Z",
|
||
|
|
"description": "A list of distribution domains associated with these campaigns",
|
||
|
|
"pattern": "[domain-name:value = 'ws.osenilo.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:38:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"adversary:infrastructure-status=\"compromised\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189648-2bc4-4840-a880-4c1a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:39:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:39:20.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '03363f9f6938f430a58f3f417829aa3e98875703eb4c2ae12feccc07fff6ba47']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:39:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189794-80d0-4673-bdbd-4a12950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:52.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '00136f2ef4a46c3934f745fff98230edbe0a7bd09912d2d9a94e35014d10269b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189795-1e00-4ef8-93b3-44ed950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '008db7f39caecfa9d600dfa5c13576fea5bb768c528c7596580ac63e75944b4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189795-360c-4edf-9dec-4bbc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '023f84f948d909590c89ffba8ab9e0ece55ebfd6439c74c88ed333e3405ffed5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189795-a7b4-4499-aad5-4fad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '029b2708e8dba2e9a3077bed43ab17445d8ce96704d1a8507ed3b711e12d8074']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189796-a39c-475f-bcad-48ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:54.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '02a23973058afba05e5610fdf6e62a0ce36e892952bcaa1025fa2d9ee6ff0e60']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189796-1290-4d2b-b14d-45a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:54.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '03b250c951a7c543614d897fef7354b042b67d537bf3681ea5bd6ed4945f3d77']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189797-0234-4503-b4c7-4f72950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:55.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '03e8853d9ddadcc88a4b2449d0871ec40d4b23c550950bb597f589c65b578fe6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189797-0f80-47fa-9084-4563950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:55.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '03fb458ce5a5a6a34e1e31900527c69c0f1b7246692a0efad8b5dc90743f000d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189798-2580-4ee9-845e-4bfc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:56.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0426b461e88b71fa67ea1125649f9fd1d831455f2f7d30c067a0269f8b6e9ad1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189798-81c4-49d6-9a66-402f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:56.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '048ba1ec391a697d70dc70b3405f2665359cf80b99bcfbf0261604e5f49c718b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189799-c848-461b-9230-4ca5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:57.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '049d8d416acd37b9897eb6d917d6c6508080ff3056bfdb66b07eb11ebb03ed92']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189799-fd5c-49d5-aea0-4d00950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:57.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '04a424393bf753dec745d20f7bcb5ed00283d0748b5e7108a8dcbebd4caac00b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189799-763c-4d56-996b-4230950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:57.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '064bd2fef5ffe9496964fcc8f92a54a47e4395526488aba5f30454ee54027598']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979a-8bb8-49e1-8a81-49ae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:58.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0708c5fc97f3125fe98b1afe10801b0798eb76d5fea2c895d9dfab8394aebc04']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979a-4470-4f01-a442-419f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:58.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0742fee1f450eb7668950b49ecfbf2cc4a5084493f71ae2b7a4849cfcdf7ebe9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979b-def0-4711-a170-4dbd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:59.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0750ca9d836fe1d0906aa8894b0a2b1f47c9ed85da503b7cd77b3e6225a6d9e0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979b-267c-4978-a0a2-4164950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:59.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '07c7f31f49a80220787f67a8f7de5966509cde051927a880e6eb411b39b8221f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979b-2b10-4452-8b71-4fda950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:44:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:44:59.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '07fdcf21160fd28a3b8fabc7e111e9be0b1f504e5132b22df3e2e97c1056322c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:44:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979c-bb4c-422a-824d-45ae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:00.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '084acb544da2110240ba9a840380ed93d03f176db21276d0f94572be10a9c106']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979c-f130-4c12-9900-4f94950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:00.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0875b9db933c2424af1d156afb3128ac4291a5e7e8c79d2159aae4f20817abd2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979d-3d78-4a2c-8f7e-40d4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:01.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '08bd9e64ccce13fc9f8fdc31bb9a3a5c8881dabb646f3872aa12ed5578c2773b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979d-8404-4e5c-a980-4ca8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:01.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0952e2b15ba26bf8a5644d8bdbe37a4d58f5719a93e82618328aa5b871b3c42e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979e-692c-42d2-ab0d-4768950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:02.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '09dfc6f71b6d8521140be1f7022b318658289f19f7badd417b5e7a68f498ac2c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979e-f7f8-47b6-a29b-4616950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:02.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0a265c366932405a3247508a1a1a65241681e9d698acf31c828f0b6c68a04be0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979f-7a44-4d79-a185-43ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:03.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0b8a8e3affd0ef8f4e39cb6e6716ddf6ddb005aeeeeb8c1a2a636e3a83df2f85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979f-2c44-4f5a-8a2a-4971950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:03.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0bd70c3b36c4dfdea0266b5a623c208f1946e606cbf8a956cdb5f7e28f3b1045']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918979f-a550-4caa-8c1a-48b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:03.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0beae5470cb7cc940d7317263abdc2547be97fa01d62e534afd4625b5f724d52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a0-a528-4e5e-bf72-48a0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:04.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0bf25f6d9e6112129c885173e5992b2928216c8bc2685c17e1148e8573013a09']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a0-0ec4-40e0-8e7f-462b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:04.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0c4d23d1107c2a3cc03bec4bcf750b00fd0e7f9683af7803ca17b090da2241c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a1-12b0-430a-ac93-4241950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:05.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0c757b679fb35212d2fddf40527b02b0a794c41c9086b150b2f3344fb9f3979c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a1-616c-4583-87a7-42fa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:05.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0ce14b19737a7a06bbcb8e667e0adda705ccc18e2cd14d5dc2a88e6560999862']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a2-ca38-4972-91f3-40e4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:06.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0ce321d0a42bb8724728cb8187d21a8c8652403a6e3c55e203a66c18fec7b51d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a2-9974-46de-90c9-4891950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:06.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0d2fb8d7a1879471420762dc33828deb136ceeae0d5b86acba2bf2a65dffd3ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a3-b4e4-45bc-aace-4277950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:07.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0dad9416cedde6873f4567cf97451dd97a1f215d7049799bcf4fc88bfe7b6944']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a3-c3f8-440b-8981-41e1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:07.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0de95f41aed114e79967b8ff331e7f2349ecaf8c9e3021525652b790df531963']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a3-834c-4b5c-afc6-4604950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:07.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0df80e03c12333354e1fa31571d34372d075a9ab64daebf4b79cb08e7f9a8c50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a4-1fc0-4ff5-842a-4015950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:08.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0e48e647a7a18364c7c431f668efb8c334c6ab3df29c76b82c118c522a61f4d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a4-a280-4ab0-8b35-4cc1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:08.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0e5b4118b1c27806b59557f7a9d6f694f7b083d5f20e1023ab5164692594c703']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a5-382c-40af-a19d-4eca950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:09.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0ee0b1352929433076754e60b81e02f52210221587014192f0b5eb8ce764754e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a5-52e8-464c-92c6-42ef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:09.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0f4c55895cceeb7353cbd072d618a3efd8bdde615eb13b17970a375f7c91f532']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a5-5eb0-4ee8-8149-4eed950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:09.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '102f1977d6ccb787a432e8abffedef7bb7229b37708c731216f510104ff6a8e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a6-b67c-4df2-85bc-45c2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:10.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '103cc2e1f5817b5530911574dcbd820a08a2b3f6c2b70bf8e4a9776b2958b581']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a6-20d4-4a92-ae65-4aba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:10.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1100f0d5e11ef9177c6b45b58999f86a2f1451668721ae6b2e73135cf3e487c8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a7-b09c-4278-924c-4724950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:11.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '11cfcc90e9fe9f8226e8c150415646ff2d4dc758c39ec71dc523732c673dab93']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a7-fe08-4f95-9916-4c46950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:11.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '130f82b2a7bb375ef235bac01e977d11c527cb1a2fa56bc0b4847313f800fad8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a8-f654-4df4-b167-4fd6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:12.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1310a9864ddb73423d25ded3df88d170b6cb6af227f0c62a68356797dbfce005']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a8-f784-4ec9-aaa4-4e66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:12.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '135336980495cf1f99f2db4dfc4714688b7b024cca07b4d3516518bc2c16b54a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a9-a8e0-49a8-aefb-4f05950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:13.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1542289c8dbb80116223c1089813a31a864dd807dba44e5e1e74bc578182aeb5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897a9-1e6c-4e84-a3ce-47dd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:13.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '154ea9793fde61aeec2519584a6c51b5d273428aaa62790528bbb1b7b73cb850']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897aa-8780-4cc7-b2c9-49a1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:14.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '15dfb4a999f1798f7a40907fd657adb1cf1e06c28ba3d04531d480dfa2cc8836']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897aa-d83c-4329-86d3-4bdb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:14.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '17179d618474c6fb652ef5057402aff445fe1b898c961b52d106d1b873608217']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897aa-0088-4fc3-933b-4eb7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:14.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '175db28b693f315d018363038f9d91b286671ad89518546c83a8bbcb3da940fd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ab-1270-48fa-bca2-441a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:15.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1825e9b2494886905f81b96d066f3b5e916a8b16fc9945acd69f11237f5865cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ab-20cc-4d70-825c-4989950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:15.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1836679b61d113e71c1818f654742c18bc23d7a4c0208881163fbf612a39f3c2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ac-b340-498a-a58f-45a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:16.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '18481447f63a40d6996da50662aa461f0009e9920bfcd45c287b9655cdcaf8f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ac-ae34-4b6e-aa10-47ac950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:16.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '18906251b5706ff3a483d34e735508ce0387265ec30c8353fa3df3b1bd928275']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ad-4ed4-453c-b3bb-4559950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:17.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '18a58967e5b428c66d2e2f12d2fdb71d3c097c8acf330032dd7237f780a5f6bb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ad-12cc-46f7-8d5b-4bcc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:17.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1974877e8e2d740118c61720ab21a59fbf3d24ba5685b9f28406fe7735658dae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ad-027c-499d-9568-4424950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:17.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1980392f8268d1c09925ca0798dea370b244d24aaf8f448569ce207e609da42b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ae-66b8-4849-889e-4adc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:18.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '19c9e7769e8992538f4981cd5faa378bc1c0df4c9ff3d00b900843e4bcc77368']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ae-ece0-46cb-a080-427f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:18.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '19d2da9f9b249ab01dca1b030b951f91c8a6bc37139321bfe8ee3f8add78116d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897af-0c44-4c0b-98b2-4384950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:19.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '19eb30a38825394e1c2a9f69c01c14f6308a4394596ef8ca5e872223c29efcf4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897af-572c-41e9-94b8-4869950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:19.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1b255dbfa93e904973dca7a0fdaf9114c58b93fde1c217043701f4c553f40f28']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897af-c5e4-4ebf-b95b-4fe4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:19.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1b8885941d1351c13c7d2a2927487b7fd591eeeeeed3b30497435ecf4807e967']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b0-983c-415f-a3eb-4f55950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:20.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1bca8af418a7107d57f760f9a9c32e98ca4575b54a67fe6217d27024912b3424']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b0-dc78-4976-a08a-4e62950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:20.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1c0bae9217a5c49470eb1b8ad3de4ba48c3e4e9f40a66e38205fa1fab59f5511']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b1-dfe4-4354-be6c-4f40950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:21.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1c48626170d0b2024bbf46fb669bb46c7c67c0c2954239df99d4a0ead55e4423']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b1-41e0-4f8f-b1b4-4d38950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:21.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1c8baeb29306798f1d97f4d07abaf53aa552e6a5e1a73ab2e6c003b9befb9c12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b2-3c9c-4db0-955f-4a28950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:22.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1c98ba013060dbe38978086f42e73a77f1c4e6eb457d9dcfdcda99cd97e271e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b2-3398-4aa4-b128-43e8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:22.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1d0775f20ca2993e5053f5702c83da2d9410532aacb930fcc78913d702eb92d0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b2-becc-4ec2-86e9-4ab6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:22.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1e6f2b10965418c715619fe59233471668c09286dcd4eb92ee33ae6cb3dab4c7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b3-5e88-4250-9fea-4fd4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:23.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1ff22025d0807518e7516d82a40e8d8c5bbb553ccd2407b36fcaf73cef40315e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b3-bb64-49bb-a50a-4cb4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:23.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '20285887bdb027f464e4773e7068a1c65503c2883bc1d0cd0dd067cbfe52e47b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b4-4144-4539-abfc-4f98950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:24.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '20523cad645f862169e6bbcd55e20512299660031afa29b2ef5d183468b3f98f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b4-c9a8-4855-8ecb-4e77950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:24.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '20a93634d6cdad83f1cca78e58d00aca1f0083ee27cfe30fd63a571f1ee89777']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b5-9690-4c44-828e-4c6b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:25.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2268c4528df01a262bca2412ce0f71beea720aa46e09215c9fcc0b0c06592036']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b5-a6dc-4310-a145-404f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:25.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '23a340c75b1c2ac7e659feb3554d09f11e5fcab3ebc931a32790099ef5d5282f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b5-4f3c-4718-af02-40dc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:25.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '24726f720fdb276d6d70e5bec4efe309406f59c2b76cba3878ef5ff94ecc4983']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b6-12b8-4efa-a0bf-41a8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:26.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '259a335a524fb64e0d388f988f9455b49c1db679badfc57d06b2f826a2845b52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b6-64e4-4080-95d4-451f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:26.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '25d285c6040bb2bdf0afe940ec160668494e7d61f57a322e243c6aa034770418']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b7-540c-41a2-b903-46dd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:27.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '26e1959102f6058b0fa548a148c137a9543012c4ddb9bd641dfdaef42f25c7dc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b7-1064-45a2-8865-4e11950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:27.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '280e38a24102f419385c42f78b88c0801e35897b2edfc882b755b97b737e2b30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b7-b144-4703-bae9-4a87950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:27.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '285b46878fb498e8d3f38643425fbbf56d64a26109bd795da9c0b8f732d613b9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b8-e2ac-4d0b-a123-47c1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:28.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '28b38092b65f701cca794bea49a9db642e20c07286a2de847720aa472f2a907c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b8-0084-4a14-9b9e-4cc5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:28.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '28e9560313f6d68867d1e11adb71686b0767df6c1aec7e898bb43aed7b9d108f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b9-a56c-4e35-aae6-4d41950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:29.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2970e02bc4ed5c15885128eb6bed9b2e841e4616ee8e696c893fbe80c857897e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897b9-34b8-4dae-8813-4dba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:29.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '29ac9d13c4abfa93d0080f8c3b660395eef6e34238d786fc87356ce42ce589b9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ba-0404-470c-887d-4fef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:30.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2a04d31620ed7fc7927b67cca9882ba5eabd7b2602c23a8b55a19217c0cf9868']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ba-ad00-41b8-ac63-4f10950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:30.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2aab49b6c03877aceb8c881de7dba17313c163d0f86d815a41594e64bcaa9394']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bb-a754-4b72-84d2-4849950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:31.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2cd9024f8119656eb9ea6f5ae185a77070086fd92ea4d3aa61e5dae05fce006a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bb-3638-43c0-9b08-4672950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:31.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2cde409e41c7083f17f2f6637ff9d718631a653b3156b73a85f652eac232ce12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bb-efd4-47e2-a7be-4459950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:31.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2cf3abf88d9102fb1e65de85f6571c5f06a7e9c4ab4e3cf7b368442764838a44']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bc-45d4-4c83-a9d0-4a69950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:32.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2d013b714f9798a40f861d9aaf52721db9b0cc40bccdb39fc46531aeba64de1a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bc-f97c-4724-92dc-4111950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:32.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2d0c4a0c652cce563d97a64c5d664be3e91b3b230ff7a1ea552cdbd5b2a6af44']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bd-7698-489f-a9b4-4aa5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:33.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2d284674f8abf5f84b949a6875e10259306b361b71f67a040bbdc28eedc60b2d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bd-20ac-434a-bbfc-4905950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:33.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2da11d944260d7bfc028043035b9593e0f0241373f6ce4d88ed64fc27fe1e622']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bd-38fc-4550-bc1c-44e0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:33.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2dab2350a53934f1585025069d8242026df1d268eb9eef21701e058b985f22f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897be-9bd4-4a04-8dff-4c08950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:34.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2deaf47052e0dcf6f990a58df4cc450843f338912c221cc7d3c56c4cdf2e9f8d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897be-679c-432b-b388-4783950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:34.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2e190dae3185edf6917d73d39c6c9972fe61a4630978dc4ee68450fcaff769ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bf-42f4-4e45-8f13-4097950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:35.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2e89f29b217389ad6963588df4e32596ea441c7d3b8a4746fef30c2955fec6d6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897bf-cde8-4b82-8ec0-42c1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:35.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2ebfbe8caf1a4e5d57e8d14f3c957a1da8a70c93c2120b025a47ee0e51c36546']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c0-0d88-4c97-9577-42e4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:36.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2f2f23d89991b38c0dde6300ce5fa0aac13bf2b182c419e93f0d3c16fd5cb1b2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c0-c954-4aef-85bc-45f0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:36.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2f90ff0434e578734e5bf12ec6c247b7dd9c79fb0ee5433612240cc8625442f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c1-23a0-4e4e-91a9-4bcd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:37.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2fff3dd004496411c7b454d073511319ed832a86ef795a7f7d3de574843be392']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c1-3bb0-4710-89cd-4652950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:37.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '301d0cfdd0571e7b9ff134d8705bd9bac6dbd541d0cfd373b633a2a6a5b1109c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c1-8380-42f3-b56c-48a2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:37.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '302698a500ba26b628c03798f08a2d224a9977f5276935cc5823d424f0ec385f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c2-cdf8-4a91-aba9-4508950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:38.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3028117d9773d4f978abd6ac6d14f17593e69297efec757104c4098ea5ad1768']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c2-630c-4a8d-a798-4650950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:38.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '306ad3f85dc283c7d4b6ec370c9aa104552d3b3946c9ac5dc251f01e191e7da0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c3-b554-476f-bd9d-4c04950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:39.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '306b48a054cbb7928bae8133a7e9ffd64286d57bc1ea60816569fc8e120d21ee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c3-98a4-4f83-ba70-4b1c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:39.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '32b5616c618494ca8c21f0e0c462295c6e8faf89052d74b01673afeeb9a424be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c4-e7ac-462b-accf-46fe950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:40.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '32c1e23344b3d621badbb2da2306029455e27f586b02a7548285cf5ccade326a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c4-fca4-4e03-a4cd-4302950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:40.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '32f80738d9837c3728f8259dba0c1b1b2c0fc04668149d9de931acd82e2ec776']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c5-30a8-47ae-8596-4e99950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:41.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '32f83036275c0d62a69f598d64937372bb9e4fb5d87c7c497a828b2da3831224']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c5-c758-4845-bd22-4bf3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:41.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3310acda6513e57bad65e94ff0cfe8c3fccd0ed87c5fc68f86536ec19e5a5617']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c6-f954-446e-b8c3-4a3f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:42.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '334f8da1b5f68279d1fa0438a09e0693edc4f826c06b27b8b52abae6770490e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c6-a2f8-4e7d-8bc1-42c0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:42.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '343f7662a1efd77940a95daeeff112712a2de1ad692868f098117599072d3709']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c6-3be8-430a-8b2e-427f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:42.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3471093b24faa782374ce8761d6613e24b9c1fd8e2270849f0dac29cb9bd75d4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c7-9398-420f-ac6c-4196950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:43.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '34d8d93806c5bb661e6d02202830e9e936022b2494444df5c84e58527e334527']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c7-bc80-4d98-be19-4aaf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:43.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '34e697583003c42870cbd2d161997d550fb3a38fd8481d04bd8bd3fa977b55c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c8-aca8-45be-a4d6-43b4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:44.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '34fa4c41bdf35ed1057afcf627e69e73ac9499d9b92cca10b43b3ee199c1d338']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c8-35cc-445a-af0d-408e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:44.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '360668bcc39b460989f34aaaec5f35a56b7271f0440a49d56450c45ddeaa57ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c8-6e3c-41ad-ab3d-45e9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:44.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '36b669ba639ceb0d0fc0d5a17039b08e78ab1c5a595418672585a43643dedef1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c9-8c04-4717-9d4e-4dff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:45.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '37272242ce063ad034d9986f8f750e342b89211ecc1939d381ed6ec9abd6c3f2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897c9-71c0-413a-a443-4a85950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:45.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '372dd2660a3b8a8c22e1983814d9b2620d5fb59e5f5b9d8f44e9d22876682be0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ca-e004-4f10-b776-4790950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:46.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3748452515bce556a986017b027d1be541f6066a6fde4c1dc55926a1ec0a6a86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ca-9138-467e-b5ea-48ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:46.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3762cfc61b96b8e80ce287f427e1408c755d2c0adf1d43946e50adafad37c9da']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cb-7f38-4011-8d37-49a2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:47.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '376ecb060aa4830404ac519189279f7446360e07a5be743f3bbceb7b2914f940']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cb-05b0-4765-bff7-44f8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:47.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '37b0b3bbeedd0903475b48c42cefc7b32abd55fc2fb18bc710f23da750855b86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cc-2698-4f05-82c0-4965950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:48.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '37d51c1781c346627139c4b085aab447fa317f40d37bc87e6d52e95a10efbfe5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cc-510c-4ba4-a3f9-4086950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:48.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '38080df7476e90f4ff8b51a82e26e779fba07e289452829ca49f8d1fc71a872d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cc-8b50-4b54-bbb1-4e18950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:48.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3887418e9687a3a4d8c4a269ef842e25fd5f5cbb5d0663cf1fbcf42398b8ff03']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cd-404c-4584-b4b6-4466950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:49.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3891ba260898c4a93faf8d14eaa89917287aeeb86c0e910acc6d3175c305d1cd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cd-1984-4188-96c3-4bf2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:49.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '39b73c77d7ebb05d91055bb09864c32ebec54b562aa1c1e11ae4ac885f80190a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ce-ec4c-4890-85c3-470c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:50.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3a6561ae01e06f2eb392f1339df4e6d433d2e9ffa1328863dff28b2d68e4079d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ce-d9f8-4b1b-ac5d-4464950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:50.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3a6e371ee145421bfe9f1a1cb81ad1f2fc3b84f261c99a8076b84f90a893107d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cf-9e24-4077-80da-4c58950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:51.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3d9728ec88afe74e3ad5bee49c5c64a771f6d39b5f4b16fab280175b989d79a6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897cf-7b50-4f56-b79a-4dc8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:51.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3dab0b687c942996481e4892c59bc1dd6e5c765af2ab16298807c1dec0b9f2a5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d0-93ac-42a0-ae64-480c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:52.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3e24a4fa73b2ec8a3b768c486eb8fb7b87b961bda815bcda35de4ca7e61ab138']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d0-1b60-416a-bdba-4d0d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:52.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3e4aa8e608c43cd8ff018a14e4c87ae4f34071c5a424644187c8aff25b1518c8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d1-e820-46b9-b004-4ce2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3e9a76258bbe8c00ed7502f6fff93ea3b21b99f5dc0edb6d7b2ef7b660ff20a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d1-fd50-4088-9117-47d1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3ec65af6980912c524f39056cbe59ee36f8dbe3388b8dee6d8b96c26b0d93ac4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d1-026c-4068-aefc-4899950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3f9acbac030c3e8bb3e8cdc82106db5eac46bcbc9610237aebc4604315b0bfbd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d2-81f4-442b-939d-4a01950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:54.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3fa915554871a4685233dff0ffd847a8b156dc6995c2feea3316d6ae8fa7b08c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d2-8ee0-4dc8-bc5c-4bc6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:54.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '404de4cd2d2d0faf0d908b4dd1c9201345b55aada537c1becc3797effb9f929f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d3-dd40-499c-a619-414b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:55.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '408d0112a1ae90c064faa767267aa2fbdde14ef43dfce8a01ba84fc2a8f4400b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d3-74c4-4f9e-b27f-4fa8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:55.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '416ae805420b3b31707ae0df0c391be583bd415172855f4d80fb05449ca420d9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d4-7940-4434-98e7-4cd1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:56.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '41c2487ae5fadd0c0cb1cbbe6179f30d1cbf43b330e6356cd482420541f9b76e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d4-b2cc-4f6d-87ff-415c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:56.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '42198c66ce639bc5b796cf3edc247dacae42099f5c2cfee55c401888bf378c81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d5-3ba4-4c91-a880-4540950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:57.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4220adc8105eb09ff70b00e95a3ee531f4527c6963698f3b70f16e474dbd9aff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d5-72c4-4457-a6f1-4b47950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:57.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '426acb7a1b6716df9c19950d9288f092e33296e409013860098fc55f52ac4173']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d5-04c4-40da-9bfc-4cb1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:57.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '42cfc10a1dbc81978abcfa3e9b8916267edc144207e77724efaf985ea85a1214']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d6-afcc-49a5-a326-4048950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:58.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '432789ccc26d4aaa898f4faaab9f51c23d96bdba6bd1e00e61467fede25df888']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d6-e4b8-4637-9642-4a91950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:58.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4371f8ef8eb7d5114152e26f4f42c2617a0d41a9c5841e77841ed9aa1b3128a1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d7-6584-4971-a1be-484b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:59.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '44acfe1d5c7bcf508f5ca9c1c5307c419c244447ce6175bb300ac93b3f32f0b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d7-a144-401c-8378-449f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:45:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:45:59.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '457e2d96939f406788059ff882c759bc5101ac0eea34e5239c876a286b94ba62']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:45:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d8-f2e0-4bc6-9a58-40c3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:00.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '45d1a107b43797ddff5ea6a49a811fea295fd5fff82f25cf60b88eb49936de63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d8-5ffc-40bd-827d-4d78950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:00.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '47d846386e3b294f8ce89b399de6856e3b9ae82d8eee3ecbeccf54812bbfa039']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d8-3aa8-4c6e-be53-47f8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:00.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '47e81d1de081e4e435bdbdd0df2857055fffdf749ddf7c1bb1f2e0040241724f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d9-ba20-4fa8-8420-4d74950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:01.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4855c549b4ebab7f850bc2b10402e4e17b89cb772d0a5401e894fdaf973dd175']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897d9-ffb0-4757-a4f1-4f70950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:01.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '48e93bf6f676e39bdc258ca7751657da5f26c0976d89eb40a6f6f8ced7275017']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897da-23c4-41ca-8f76-4516950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:02.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4902c99a5d9363dc2132526582e980e47818a2f941c0105c1b6b7caf9de454c8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897da-ea94-4ba9-b2e6-4b34950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:02.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '493110cc25284836521cd65aed59b06221c91b3847d89e48908933dcd20a1774']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897db-00fc-44a5-881e-493f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:03.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '49b744904dbe7a7c748809fad8210f19c01f506271f6e0a5bd6b669bc5c3a811']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897db-b57c-45a7-8362-423e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:03.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4ab06e7d9dcc976770f30bb7ea80a417941fce0bf9122fec217d7c9a3ba9516a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897dc-d1d4-43bc-9e1b-4bb7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:04.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4ace494be0c9ef12cb66b0f508157a7e952d15713957374a237954af38ede63a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897dc-dc98-440e-a93d-4291950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:04.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4bca01029e0ef37831fcef7ce8f8b87f0c274ad12cb3df3e5280fcd0fc33ca85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897dd-8340-4437-a268-4c87950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:05.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4bf189efc54414683ef0ec6a0a6639d53c0430fefdbdffa69c151739b3aefa58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897dd-b2b0-4804-aa55-4d10950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:05.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4d61c8697e763887353ddf76d99ff6a88c8fed84a4c09814779b0535bfc201ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897dd-1834-4d93-b14f-438f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:05.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4df443a6850c516a367d23be3bf96621cb20f70e1afe4f1e5fe1384a422dc397']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897de-3db0-4e57-be13-4371950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:06.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4e3d504565b0e1e91452acbb752fd1427d1ce30994aea13daef427d9e68646fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897de-fb00-497d-aa85-41ae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:06.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4e42440d03584a73ad6676aab7c81a8fb1f4703a7e2ff8f5b8f70b69ac9f691b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897df-a124-43f8-acd5-4989950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:07.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4e5ba0fa7ed0793348e43a1bb9a166510ae7c4864f053d865ec93ceceddc26f7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897df-c730-4d67-b2aa-4e1c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:07.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4e88ff08a3d8ed5f842b86d4cf3e73a2da4d9b9f82e50a6dafe01d026c4686a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897df-a00c-4fb9-9a5d-40a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:07.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4ebbf99e943b898d5f99b78a336b70b62221cfd05bf33a98232cdfbab53a0f5e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e0-5890-4d58-8ea4-4ca8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:08.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4fb9f855a75d52e0c79a2f61478d5dbb740baf540fd746092763eebdc513b67f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e0-0bfc-4857-86f8-42e4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:08.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '50364014d02dfca214c6b53cbbcef6365ced928629e9ca382253e2c5798ae414']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e1-f394-4cdf-8576-4f4d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:09.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5065f466768ddae4129c560ae4105d5235de1a338f6cbeb98e446f2543a3f4b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e1-9054-463c-9a21-454c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:09.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '50b4b3b573882a64c93a4abc070a1ddea7b7532d6f96cc977b00e3221f3027b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e1-43c0-48e1-a1e5-4b79950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:09.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '50f740eaed28d05aa76821c4dac5840d81e284b7a7c7c663c75ffc196ed3e3e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e2-1778-49a2-801f-448c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:10.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '511c21ee29ace1a4f2c537436421b241ec12e826f4ec69dfe3d9d3e0cc0e8abf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e2-0ef0-4e0a-bf8e-4d14950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:10.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5183103a4148124c20daf8c94cdd9e4fad5002640a8904531e4600623cee1d16']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e3-f768-40ae-a70b-4a4e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:11.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '51a553134e21f2f426aad2608e64115ec48dbf6913407a43922e9bb665d24d29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e4-632c-4753-84ec-4912950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:12.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5281e92fce42d57bdf75f0d55bd40ebb057689efb33898231954004519f96cbb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e4-2ce0-4583-9e33-4db0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:12.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '53bc9e39fc707aefab8b837dd0d071a1ea3e93c38f306551fb3e75d0d254a565']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e5-e3b0-4226-bfe3-47cd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:13.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '54abcbf28fb730aed6bb7bf8d58732e3a2b0d6fde69acd117809ab4c89159294']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e5-e7e0-485a-bdd9-4b5d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:13.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '55dbe1f3ed7090b8de8fa6bcd3bd4bd44dc967bdbd7b91ca42f55d55b46b3d4e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e5-4d44-450a-9b2e-40b0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:13.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5718b807f3e6a90fb866b8ba49e588db06a08083bb054a095cc6d6abd27ad7f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e6-3f9c-48cb-acb2-4621950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:14.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5722daf5c0b91363808d46a2c5b93a8f70f0dadd94866148d1d77975ba04d211']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e6-6b44-4e1e-8368-4c31950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:14.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '57bfe19f9615f026765825689cdc26725f4f24f23123bdcc35aeddbdc5274fc4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e7-0248-4a91-92af-4881950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:15.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '57dc0470440b0d624ce4b4181644ca57c83c21d01fd0e6fa0497c1708b6cc09c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e7-e314-46e0-a835-41f8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:15.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5883fb8b2ce716f6b28449c5d049904225b075f3e42ffdb6351fd6ba56a342db']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e8-e968-4515-8cc7-4533950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:16.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5929b09521ec555deffce2e9f759bd3c807025e1885af5b06093581aa9282114']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e8-76b8-4dde-9fad-4256950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:16.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '59c87e676934b70672353cf39a1f1acba30b21143ca1bbde25cc424ddd08fd8d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e8-cd84-4cd0-894a-4dab950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:16.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5a25b7b34ed37b36a79c0a7e7379889f7208c9f0fc14ab7790a6f664f2e465c8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e9-e548-4bb9-ace9-4253950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:17.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b6d406deba26aef7d324621d8ebdda7f02994a677cd21562995c5766b63bda3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897e9-fc8c-48c8-834d-4474950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:17.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b7753602e7dcf54c315c2b797d10e7ea11e3c9480f814e20aefa11770669dc5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ea-b2e4-4a56-96f6-4cbb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:18.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5bd8352171880485bf06d2d089e39d4112e8540f28d0f84bb045ab58737ad6bf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ea-e4bc-4e76-aca5-4d06950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:18.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5bed084e53ca1f380f1f02820a2796b6911327c34dd8f3e2be71858e6be0ca33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ea-5940-49f6-a96c-4f0b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:18.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5c531e80c92d360831fb27604d3ed78d91f5aca410ef052c6bb2d3370ae29ddf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897eb-7cc4-44a5-8923-402a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:19.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5c6922ae1df26173400440b4d73a52adc3bccdb37c4a855bc8013d5882bdc7fa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897eb-8000-469f-a14e-42f3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:19.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5c8e21b1fcc297c85be6afa0ceac890fc96fb344c56daf0fe3bff90a05661407']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ec-5e78-405c-82d4-4855950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:20.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5ccd9959a80369a57bd6863788e66782f7f4c96186b5a1bc012e23ec2baec44d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ec-cfdc-46bc-b4e9-4490950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:20.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5d42f5711bb97943e1db064f27c1c69fc78fe5d583ce10feec2dca2c437e797d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ed-a374-4208-962c-4a9f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:21.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5d5f727163e7b3eccb434516a99c17002f636003dcdaeb4898f8d9fe8cef324b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ed-6de8-4f30-b1b5-498c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:21.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5d952bddeecee81804da446b271588ee89c2633c2af68864e72d63fe246de216']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ed-0a10-4656-9c8a-495e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:21.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5d9cb71c33d671e03929d9fa67b7a191128f62276d211c7922a5cc9cad7153ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ee-5b98-470d-b459-4a29950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:22.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5dd0adc1f15ea950fe4a894008014207862634c8d4da613a17a4a8a715e3f0bf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ee-080c-4647-9103-4c20950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:22.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5e3885f78220e181b338081c97f1aaf15278192856d1b6f068eb55c532b877a1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ef-5254-4215-837e-4654950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:23.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5e762a5031bb4cf74c559a37397c99d6f85bea423af17bd8f5dcea001453d878']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ef-97b4-4499-80c3-4f31950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:23.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5e931d45f93c1b2f8b9db7492a261acf4f4a4ed9ad2f77d0377314a1e6151355']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f0-9368-4440-bb2b-4bae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:24.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '603418eb1d633d3104bc8404b483b65409501af445dc6071d2c1de09adda6820']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f0-59f4-47b5-8456-490f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:24.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '60446bc37e8930607008e6cae80015c2a6619f202ad1d73eab21ef9efd1765ed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f0-4500-449d-9114-42e1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:24.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '607dc035818b66e1963b720a36d72ee3e87f74ce1e10fa9a355bb451c1f82e18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f1-c934-4c6c-a65d-4dc6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:25.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '61254131114c91210ac66a1b3d2ada471fc42f3211fdb12873fc5a95d9ee4f15']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f1-e25c-4112-b145-4562950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:25.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6146c9445b9a144a7c8f85f7755c5b5855133a4b3b7795c883710450b9e762ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f2-098c-401f-bf22-463b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:26.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6147fe1ead81ea570e3864500f203a9e3a0eb7c65e5f7a7ceaa74348c255e089']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f2-81bc-418f-b6fd-44f4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:26.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '62044dde72d734fe29b30693eeeb35a06507620a494c766814750cd02a9eaf2c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f3-93f4-43e6-9f28-4b89950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:27.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '628df77579c2f78ea1b5558f7383d6c53d4024a38504af165cf5a264777480ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f3-8bc4-41e5-960d-4b7e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:27.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '62c47850efb17be17cd4beecd205e74322cb4f5aa10a88f0994211dc2b5d54da']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f3-cce8-47d3-a51b-41ff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:27.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '63ed226c15febffcafd8d52558f4bbb3dc166e57b0c82c76cb9c0f5aa7e3365d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f4-35f8-417e-93db-4287950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:28.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6433af04cf20aa1ff1d504d501bf3cdc1f51fc10b80aee92f0d728118830a7cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f4-c34c-423f-a6e1-4a4d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:28.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '667cc087b80acc01125c383e57f5a981b3a35e3c59c44b69eeacba97501bbc0d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f5-e608-49de-9663-406a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:29.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '670700c4464512c264970c1f1d6470eddd18150ae4f453132792a48ccb371f3a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f5-c370-4a53-ade0-40f1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:29.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '674a160d3d05ab388f46a4b0e2333025b02b0b41ecd2d2675b7fd4938e3db8cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f6-a6a8-451f-a3f3-4e52950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:29.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '67c09991b9207a19a4002f363325f67bc14e9d9783cd4cd2f35763eddd588d1b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f6-ce50-48cf-95ea-4649950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:30.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '68917077f86bb11b0a0669e32cb7255e38dbc1a022911b54dbd13c9497c087ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f6-47e4-466a-8377-4b66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:30.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '68e83b982a64e990aba73b6807a1e81b978a9bf36b44b56d5292494212ae81d2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f7-518c-4412-bd72-4239950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:31.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '68fe72dba5ddb929e6cf129cd44b02971daed6f5999bd082256251f0d58dc10b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f7-66fc-426c-81e4-4fcc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:31.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6984385dbe03444b9b50733e2d8307216035e8c453f5603fb856733614a599b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f8-b630-4849-a8f5-4e0d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:32.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6b92c15f9cc03b3ddf2c5b93fc8b8fbbb759fb799bd8a4e95e5c9cb1e0a93a92']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f8-1768-43b7-82fc-42ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:32.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6c6cd04e7c198a70b3eadd732e0b85be1d06600feecc93ec26315fe7d3592741']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f8-90e4-40ba-b4ca-49d4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:32.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6d26ea00657cc91df2d7db486972266bec1e2cb55e1f8d5ef8c04382946d5326']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f9-f818-40e4-a61d-44cb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:33.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6daa84a19c6455e6900ae46d07e1c9e3f6cae58abe59cb027371656e90d4efba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897f9-f3c4-4f0c-90dc-4edf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:33.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6e096b5543bc79d110235a678aa87483d9847d7548a935f6498cfe7604e573ff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fa-5b64-45b5-903d-4da5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:34.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6e2b4a15d133a62c95c1633d5cbf8a25fb165eb2bd38ffbcd049d0db14d0c33c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fa-aa84-4e9b-9872-44e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:34.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6ed2c9a987004ab981b3ee9166c54ff5f527a77503d2ebc108d5c9fb3e8517c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fa-c730-44ae-a3ce-4d18950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:34.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6f65446cd4dc8a2e01f349f479ab6c240d90492f308fe8c4ed4e707bb55df7b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fb-805c-4dd9-8fad-4504950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:35.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6f9bf6aeb18156dcf6a3ba9313e28328a6a291d9b600c23c468b069099eadf03']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fb-ef24-4234-ab4e-4af8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:35.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '70853e71c70e84a0cba452cc394da8f259ae3d9cc4cfb2a66f55714e038bd8dd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fc-fb18-49bc-86af-4da0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:36.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '709d1109d8d956c1a50170e715c0a6dbc99ce7fac04d7293943a2c34bbdb810b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fc-5b38-4dfc-acb4-44e4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:36.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '71318ad02df0c12cdb95bc8bafc7a4938e95fa6ae0be0a1d1f0ddb92f884f5de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fd-1a1c-4c39-8826-403a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:37.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '728c142860a615f017b4e1aa049afff9d5a25e9c619e8fdfe28316b0a7004bbf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fd-cbc8-496f-8536-4df2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:37.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '72b79a6375db7a01df374015effdf754e66a6c11f889d2bed7c799bd80a1fcd1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fd-14b8-4b32-a53c-4565950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:37.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '73fe6ddb18fc0b019dd7e98576333b9906c46d78fa8f5772b449cac709bd6a95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fe-932c-45e9-b57d-413c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:38.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '74dab7dc8b8b0d4d7814dc81744eae1b294ae016c697c1abb28722c24cec8a1c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897fe-5388-4561-8de7-4de6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:38.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '75fa1ca754782e47f44effdb96d280d85602942064d811db15c79988bb1c8ac6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ff-0a48-4eb0-b35b-474f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:39.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '778df4fc34dae8f7611a5c95b14c8b7b2d574de754a5589054fb7453fd86de1e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591897ff-df74-4db3-84ef-4a96950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:39.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '78f8d3476cddb57fc50831e7b4905f3d88db7d371a52bcaf77e452aa10923544']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189800-cd48-4883-ba4e-48e9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:40.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7966c203183e53ca3710f3c5fa350f6b712aca0083be93aefc2d55bdb8b54682']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189800-224c-44d6-a70d-48d2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:40.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7ab5bd0a4c6349db5bb1affa1dca2eea507cd89f9d8fd4f2148e9d44ab811684']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189800-2f58-4ddb-acac-4148950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:40.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7b08db817d51a6747ffe60d39fea1bd76caa9bec2fdd838d7a8178abb164c748']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189801-9cd0-459c-b7f7-42dd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:41.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7b0cf85242ab9f32e3d96590464ae291816f660e5ebf1a2c5fff8be35e669b30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189801-fa18-414e-8314-45ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:41.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7c053208778d5fbdc0a95a4885411290fb9dd2a9f3abc37bdd69acaf83311b3c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189802-d51c-4dfc-8452-496e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:41.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7c94d1b76129f821418cb21e81e35faab44fed9606fe6efea8b20e0ebc0204b6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189802-9c64-4dff-8152-47ab950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:42.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7db086337ac3f213507be56737f27bedf9e11470598088cf9d8afd7fadca4bfc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189802-636c-4d94-bfb1-4477950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:42.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7dc20a63367d64cfa013042d6412aa1e6e7b28dd2b0861f4cb240945a98e3158']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189803-6f78-44c2-977b-4826950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:43.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7e1c7a840fba639eb08ac57efbd74f2ceaddc7986de598ecc45e0362232923c8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189803-7c6c-41cf-be2d-4a2e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:43.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7ea9d1818bbc625b6e8c0b5a7615e1dacae47483ae198e3b28de50aacc197e7a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189804-84e0-42e4-b185-4be0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:44.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7ed2d5a5ad51af676ed1f5eea101ae91764164262a051fa4876f3811cad2f279']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189804-8950-429f-a833-4dc5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:44.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7ed57a03b038c5275b4c1bb79ee46ab83372ef0ec461806e3ba5aaaa366d0862']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189805-7470-4e8e-bacc-4960950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:45.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '808b2b4daaafcf96e27d1e14ae56032fee9e3601b92c86164361fc3683189a10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189805-75c4-45fe-a812-43a8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:45.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '81102748a9a991ce9e3f10b710856f041e3d4ef9a52c23a84f1632a9e760d32f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189805-3df4-4818-83f1-488e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:45.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8124cc274ff6a7810852ea22fd0e1723aa33b96fad57e4efb83bb5cdb797e6e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189806-db28-40a7-8413-441e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:46.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '821482d21b1937913f9b7f4fad50b32cb5b90e26fb3b8936189cb261975fc344']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189806-c170-45c1-a2b9-4337950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:46.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '82613ed39215c774212264a15e6b682a71bb3fea98c05201c32c44c56801e5e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189807-7f40-4273-a4f8-44b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:47.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '829ab089cda21556c370f0e0099f842965bfb8ec13ac7ae141ff3aef7ec8f914']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189807-c2dc-4614-90f9-4219950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:47.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '82b39749e374b7e1e14408332646f767ce875f9690af50ced0d6be34de81fcd7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189808-899c-4f50-93c8-4fa9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:48.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '83063d25d2e6d7a293aa437ca9854e236690ec11d8078d6bda8eb249500ae7b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189808-1650-46ee-acb8-44d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:48.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '833031a02f6a7b7f980c9ba7a556b616902bd51f225568924681fe931372b9b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189808-df1c-4bef-8f2e-49c2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:48.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '83405077ce318df7c02cd182e8ace91ba5c0158f8071bc92774a9fa4df0446f8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189809-b768-4bb2-8167-4cd5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:49.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8351e656b790c439bbc11f46685a9de7c3a2511f195d8379cfe6eac29746159c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189809-c644-4bb5-a84e-4981950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:49.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '83eb78af0b8697fcc6950a6f971245ba3ecf4a3182f5420b4f95d4e32840d0f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980a-2628-4605-b91b-4659950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:50.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '84de8062f33235aec72aeae42e61bf195673f35dc167789eb2805dea9728b27a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980a-4160-40e3-94e1-4f99950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:50.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8588846828086aa5c2107235535caeb7a7f689d0d9ae240d931de48092ed4f9e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980a-ba0c-4823-905b-4e14950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:50.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '85a988409aae4b710f479f8cead9e80115e5c5edd54f3c9f6d36fe2bdf5b3f67']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980b-27c4-4676-97cc-4aba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:51.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '85c1872c944e68061acccffd5e3c9496a31ba0cf9b39d98fe6d00ffc38d95cbc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980b-7274-4660-953c-4e7b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:51.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '85ca766ab3a34e0dc6fbd213d0f5c2109e557367a52ea12ab9b40cc13400f837']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980c-ab08-49e9-80cd-4a00950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:52.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8621d4e024fb9690793f1ebe7a9bf13d738135f50a2e85f36902c3744e3225c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980c-211c-4024-8ba5-42b5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:52.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '86b3edf1b8354417659d31ce3c018395bf47b0bf8dc71b8aa8f51a82ea018f5f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980d-161c-4668-ad80-4964950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '86ef1e9802c527cada38aeec7283ad102947ef24593756411886c126e7f40793']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980d-f584-496b-acd9-4f98950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8721f3c7aa692649a4ee2ed6308a7d5df20881b25c5dca4ced0becd48fb05aee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980d-2390-4584-9223-4904950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:53.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '879140774271493776bbe4249f99ffeaa2370c586febcbb7c21f8f6750ac411f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980e-928c-4d37-ab7f-4f45950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:54.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8793679ebabc18744b0850518a151f2689696d679d84d425d1e31147137f0dcf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980e-c358-4d44-b2d3-4139950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:54.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '87bfde4c31856c289caea5a7dad9ecc1336ccc77aa2f97d366f5791861ba7ea0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980f-bbe8-45dc-8208-442a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:55.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '87d5c641422a6de6d4171e5c83b6db60c25562edfb4ba6c0d2d6f3f6df294b29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918980f-d5cc-4d9c-a426-4177950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:55.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '89e713514be63cc160086f7214c3eba1944b41ed592d5b7cea02263164711c4b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189810-96c8-4abc-9d08-456e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:56.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8d30019af407f3c43938e2d4ebbb37020d592e99e6a5258f7aa46211006f00fe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189810-4a04-42a0-a54e-44b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:56.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8d95827c90a8645c9680723ad3eae917de84eb8be39f12164e46bf5607e3b24d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189810-d310-46bf-aafb-4ee5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:56.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8db160ab89792353e24d125c4729de2e945b12b0c6883bde3cd43e960ec62680']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189811-8174-4346-adbc-4aa4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:57.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8dda1f70628c52e0a283fdc004404187ad463e348c12567d5aee9d2246f0d081']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189811-c730-4079-aa10-41c0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:57.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8e25fd13bcbaec69dd2a8d5c9c01fb01182f8bc5962f0e295f323a12eec5cfc5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189812-5854-4d68-90c0-48ef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:58.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8ef2ffe04272267a5c8dc7aa7ea52f482925082dff81daabe3520846eff587ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189812-9438-4b19-8b9d-40d9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:58.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '916b3af53b5ad3d43d579aa6bea90a1a93f019dcc23adcba6be6196ee816e1de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189813-cbc8-4d42-b776-4d5e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:59.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '922a287c4408189722bd10da625f8fde78ed9ac8d76f927b831abbaaf764a0f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189813-1b98-4b75-9eff-43ff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:59.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '92568b567a246e8a12ecbcf6a67b85c785fb903200f03ac10d382aa927fc0870']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189813-5d98-4721-bf2d-4f1a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:46:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:46:59.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '928122dd0517bffee0b47e8506c39cbf18683e582003385d09baeea7ece6b2b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:46:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189814-ca54-42c4-a558-4d9c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:00.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '92f2c315450a805fa886b673a2d8b60dcde860fff6be595fb44c849d7f3aa0de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189814-b06c-4b74-ae21-4531950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:00.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9396cca16bc30b70d175e6ff276b5fb94c1b7fdebe7b1d55ef2c59485eb4b9ed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189814-1f74-47e8-bf68-4cf6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:00.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '93cb379093c78181c6185833a3284176e63cf8109a16b3dd3dbcb206ef92d515']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189815-efb8-4311-8be8-4727950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:01.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '93d91bae2d0a371f235f7ca99b5be8cca79a14b41d06f612060c288f98e0c195']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189815-4fec-473e-8da6-4672950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:01.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95aa45dfdbfea1810f6ea00c03fbe07de3f27dd243caed5521109c1a470edecb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189816-8844-4036-b49a-4bab950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:02.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '01ca29131548b2976283109bed691d2fc8655b5225d0b2a8f9193a32e1e5be6c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189816-4a08-440d-b4bf-40d0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:02.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95f04f3ec1234f0aa6f3ca4bbd3e10914cbc683d22e8f23a4118cc18be8a79b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189816-50c0-4209-a8f5-4fbf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:02.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '025431a842958b7f544daafabd596fb5e10cd334010e119626c27f18a1948631']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189817-c790-4307-8b1a-4ab6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:03.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '96f92025ffd5d4101b342a66d654c7a9cfe61f2b3928a13e05ee8326d433bf91']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189817-430c-4eaa-8037-415c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:03.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '025629052423791917d8a7b98ce34d4dea6d33852c39e27326cd7026dff3f795']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189817-07fc-4129-ab61-45b5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:03.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '97cbe3eca86b48561688a802685c428190b128c7ddf4b15d45e4d9b66728b5c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189818-4c98-4caa-b5c8-431e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:04.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '02a09e2bd039ff2b59af342e321245eba902c0eaad8a3a590a7fdf6dd1fea9c6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189818-16a4-4224-a16a-421c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:04.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '98cc0f43df0de0d94ffb88bc4bd82d1bbaf06c9b380e2fb14a0d6be6abae147c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189818-3b4c-42eb-aaa9-4b6c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:04.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '034c29569fa5cd264aac51ee3f466c03f4194152af5bfe35059d6d845ec484c8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189819-4730-47e2-b581-427e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:05.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '98d02959a054a74d4fb9e374e4368c8935acf750e53a146a1cc7075ee44bbe67']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189819-8188-4203-8855-46f4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:05.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '03527e0b8a6f1a0e845f362b1648ae5da53341783175498fa814da3f8bd0a158']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189819-8920-4f02-9faf-49c3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:05.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9a298bd87da1136206566e7e3f007f38b46f4659ac8a4a9f350a92da32fc2860']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981a-60e4-4320-98c0-42cb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:06.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '035d851dd65966133e7f454fa744ba7ea8568b9959d61295dd9aa1059dc85011']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981a-b6f8-4af8-a688-49df950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:06.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9a2faa9b6d22185389ad62a3e9c47b0b850e2371786735892a653363a9a6b3e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981a-2964-4cb7-889a-47e3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:06.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '04ab3194edfe05688fb409f9522ead271154588be98db80d6aecf15cd5a53c31']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981b-a4b8-4616-8c9c-4a2b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:07.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9b219872e60519daa13a84b1d012f4a259e6cb7faebe140ee8fddb5bb330a1b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981b-7c98-4720-a1d9-49ee950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:07.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '05123ece27bb4035cf154c25b03cb1c31b7e3594101db6f6acaadfd4fe236edd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981c-df18-4215-ad72-45ce950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:08.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9c266190dfa5e10d51c60620903016fb9b402235972c06e0b3f9f06fd0416676']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981c-82c4-43cd-89c2-4e55950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:08.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '053257a1d26717f8c1502a22b88e61e98df210a74fb46f34f4b810c1644077c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981c-8954-4217-964c-4d79950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:08.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9c420719082cfdc66bf96788b24142d02f584a40e29f9c68032484a6da8cce4f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981d-3558-4d0f-8951-4e68950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:09.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0930f276338c7c4356e3cddd6964a2bc2b85c89afb51bea5e440839cedf477d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981d-5c0c-4314-b33b-4d41950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:09.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9dfb1529cdcad4f407eabecb1eebf2a6ae960eb4f215f2d1f032befc5df3e872']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981d-1f90-4f2c-888c-4e18950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:09.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '093cabe877a9c72f953d0e010cf2ea32e547696c6129dfd153c9f37afedbbd0e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981e-2214-4320-82e3-4c03950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:10.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9f32c3bf6ff73f50ffdd28b9d820a40d3324162d81367022dec0f8f883a51fc4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981e-e038-40b8-849a-4e69950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:10.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0a3b3a7f724ef9b00fbc95a7f464a30573be2440b8bebda479a7f31479bf6405']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981e-39b0-462e-8d82-44bc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:10.000Z",
|
||
|
|
"description": "attachment hashes associated with this campaign",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9fee7be4a882aeda323c8ca4dbceea7498d582da462d0f303db334e26a60d898']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918981f-5470-4a10-bf41-419c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:11.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0ae3329bd7d8a4f61b28508194139115176be6bc546a682663993f12683a00e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189820-de78-450a-9be4-4cfa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:12.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0bd5451caee1f603dbc4af50b77d046781e6750c4cea02ee34065e8ba2712169']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189820-9908-4766-88a2-4674950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:12.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0d3cb131b55fd5b8fe1c96ebc55d48e860686bde7b96eb85681e6645df583faf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189820-dd04-47ab-a28c-4142950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:12.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0d944dd6d24cc9a948ca3915b3ec8df2d0c1e1c6f33d78fe833a4e166db4ff56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189821-5810-4ad2-93fd-47f5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:13.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0e5566887154fb94a967cfcd3f99aa7f59bc67c6af7383800fdea5e665211795']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189821-a974-49a9-a07e-4d7f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:13.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '129bfb9cfc698c8f4c243d80484612fe69a6bd85f894fcbc9e7b8a7c40059bb2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189822-ce5c-4b31-ae59-45f6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:14.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '135e0720fb756017e2c1677028927413e2a3f272d62a096c3d643d4cdecca653']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189822-7d0c-4d78-9aa2-47d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:14.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '141d87664c97c4688ecd692edb08b4b3bbd634db8b6f8aa07064dbb7a4b769d1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189822-9870-4141-9bd3-41ef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:14.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1494437cea86e0f2cec2aba7c8255f6f17fbf19e4833930b73d56ad4a3baef4b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189823-2878-493e-b4bc-4ded950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:15.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '14dc8a259bb6f578daa912b3381f33019350749d55cd0c3ae4cf4d3ef90725df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189823-0650-4c60-8696-4e2c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:15.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1516909b1d3b14e631bdc4741deadc5ee9af4fe99cecef2d14fbb4e17bac0db4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189823-022c-48d7-9a82-4f54950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:15.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '164b669ddf0797dcb41fa0d0a07d1fa3b9b47ba985c76d83160178bd768c7c83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189824-62e0-47a6-bce3-481e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:16.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '169d73a97c5f767f31d9b23a5199039b81bf6e4779f7971d19ea4633fe619b02']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189824-a034-4731-8173-4206950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:16.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '17415bfb9c958e62837eeac5c50c56afa0fdf36e4867ac4e0f031ba7aff50285']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189825-8090-45c0-93f5-4ce6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:17.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1878fcf31544481f40f0d4c6b26eb43d24f818544c6e6d56e96d6ffc0cb7605e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189825-e1d0-4b64-897b-4348950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:17.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '18e0e325445bc7fb1c01ecadd27c0c4557e59ae9d5f4e2baab6dff712db42439']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189825-e14c-47ce-9ede-437f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:17.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1993afcca49c52bc927514bd9c6644fd85359ea176c6af7bebf4f13c29cb4e83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189826-297c-42aa-a709-4b67950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:18.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1dca00311c1689d13e40251a9672ae7bcc6ad39b76e57f2ba097372eba90cdcc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189826-71b4-40b1-8fb3-4a6c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:18.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1df864eb3ec567cb982aad3044595056f9b3d615c9a6600cc55cdd28151e3270']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189827-01d0-4584-b28b-42ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:19.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1e0c4d5c54be63d4e583b5cb2e93d26ff3542fc1f66a1fe71a62fd0e52b769f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189827-0b64-4d39-9ddf-4713950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:19.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1e51e460aae0bef07a42a5200de30aa32441926dbcd1b955c75f75c7f202ef4b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189827-0d40-47ae-9477-4d66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:19.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1eace1b8a08301347dafe2a7b0e288101d9a96df3bf5b38896639c608989fce9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189828-2eb0-419b-a12b-4f68950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:20.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1ec76540fc0395a9c95d11f357e1c208ba74667d8d1f34a17d1be7dddcc3ad5a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189828-e938-443e-8b60-401b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:20.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1ed0b4f9692e1a8273ada86f93f18fc1dd774531683be443a2346cedb6c8313c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189829-ed84-44a7-8c02-446b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:21.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '200b481043d983b97a3ed0ab8aec5d7a60188547fc8d639d9c320267a40b61f4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189829-f9fc-4703-80e2-4ace950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:21.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '205375472d357bd8557ff9f68fbc2ee387c2743f9a84ae0bdce7bb9de56911af']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982a-b338-4ec4-bb13-4805950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:22.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2292265039f4e97ef22385c9e33709934d1ed7fa96008b103f3289d400cf4a0d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982a-3b10-493b-8756-4a1d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:22.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '22d3b97d929c8639f6ea265f2c30e6db1bb5b8d3b54ff6466790f9fef35b4789']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982b-77f4-492a-9719-49bd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:23.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2549efcf2db5afedecabe65554be832330340367b4dc158258deb1a23c03bac3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982b-6334-452a-a2be-4ffc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:23.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '258f9ea35cea38987d3b217a9a3d53ee83cdc1f811f2f4184411e9da1b4c8369']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982c-35ec-499c-90b2-48a3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:24.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '25c110474f2755f35dcabaa684c6f33275eaf9da140413e426ccbb9341a155be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982c-4790-479e-9574-4b3c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:24.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '26c949f56b1090b04854fe3b625d72a00f15c79f12b24d5d714c58ded791f4e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982c-92b0-4a6e-9e9b-459d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:24.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '272d81d413c1490da6b243a055b3cc290db00e30a6c1fe1cde58c1af1b5feb2a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982d-ea78-4a31-ba0f-455c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:25.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2801762571f8b2fc47e1ecccaba3e2a8ec264fe0c238107d888407e0253fda32']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982e-1a8c-43b3-ae6a-47e1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:26.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2a7af397c7ced4413a8bd729a8cf91856e442adcefee6bf8f675349346def6fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982e-5b80-40ca-9e4a-4002950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:26.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2a7cd2a962c6e27e31aaa0cc379b0878a28f364e9cead4404c2bdbb368a36d11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982e-4ac8-48b8-9139-43d1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:26.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2b1a2307eaead79ce3d2ed0387c92cd3163075afb42ebb329e4bbe0cb251df7d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982f-6c14-4e57-8d6b-4ce9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:27.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2bc07707e6f14d5664e4d8e2ffe946cf003056e8216861b19ca5945d54e906b3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918982f-1834-4290-a5d8-4ebf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:27.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2f12e20cf5235a2ca2dfa47aca472c408dae48b352a7504b6f50a26cb569843b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189830-26a4-41bf-94a1-4cb3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:28.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '32fa4c285ce8fc3ba6e706769a7ec671bdc4bf0ae711325f5dae15879929469e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189830-d454-444a-968e-4493950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:28.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '351b1dc722da253e008c08108a5564d5b1f141a8b3c7de13610b99af227260ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189831-af18-4216-8ab7-4099950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:29.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3703104f55cfc3d57cba0b1ba55d8827404ad4331e813db96b0fd6005561903f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189831-17d8-454e-97ef-46e8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:29.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '37d371d29911742fc2d6e4c2d8e2c81326ec96021b86b6211fc5cc9f32bb687a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189831-591c-4707-bd8b-466a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:29.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3812e645ef99761e853380730d87084f4df747aabcb376889ad32d6a073851d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189832-f098-45c6-891a-435a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:30.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '38d71019073e16975e3f53e5ae96d94376062afe4d9f793b93b7380e18d695ed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189832-d4d0-4ee7-b330-4051950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:30.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '398dab1cf3444a5b89ce5b848ce4d771b019b36c35995a53d3c26ec94b5f2d82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189833-b914-421f-a027-4c6e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:31.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3a2c012e4d86184331c71c2df238c51f5874e32a03f0dc6af10da7cbf8e02ef6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189833-f250-4ea7-b9b3-464e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:31.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3a6fa48a07abcf61fe91085b3de545cd51039f6a214b87049b618b5c7a12630f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189833-71a4-4a0d-b30f-40a8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:31.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3ab7295de1eb58e5a3f689e7de96c1a462b4c8a1e127b729c522972b8f696d0d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189834-0838-4bd7-8de2-4025950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:32.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3ac136c4bb488171e22f5c24a029f39eee13ddfbed1e65e9270bbb75905a684d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189834-2d0c-41c1-8299-44a4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:32.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3b6e8ca7a1ba1468eaecacba7fac5ed75336a87568336bf744808d6de6c26cd3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189835-cfec-4543-8567-40b2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:33.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3b9d4b3175ccca522e9a2ceb32044af14fc64c73d69cfa213607c8f77d7d2cc0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189835-4ab4-48d1-8978-4fd5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:33.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3c16f6cd3ec0f9cfe0c9d4b1fe209d7d53ac0a1c588682e36755fbf23ed2741a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189835-2088-46dd-ab89-4629950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:33.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3c47d548523d28abc1e0eb1d73ed8471f16e7528a1a5ae959a49f59b5ab1e156']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189836-f0e0-4d23-b943-4eae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:34.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4002498a91623643d5eddf34654c00f1f0ed6c7e4c1fd47fb3c65fecfe40cc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189836-3648-4146-a915-482e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:34.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '408694df9913135246a1052920e9d74a92934bf25387b27fe25f63b86cee00dd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189837-ea8c-44b9-83f1-4082950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:35.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4096fb1aea32cbfc0cdf2dde64896e97a5468d7bdf9daa515e361c0344bf22ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189837-d838-4b1e-af46-45ac950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:35.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4118da796cb2d04d7b6200e7307b99ae662cbb77e7a7eb32af113b778781067c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189837-5ba0-455e-9a4f-40f8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:35.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '41d523be062786726ee15a18353389b6d6643705bf5f012c515c90e86cf76ea4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189838-92cc-4eab-b305-4ac9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:36.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4204d0a1fb6ce6b089da679fc2b41590ac03a35ad70225180704af4c1b5c0a17']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189838-1578-4677-acd6-45f6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:36.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '44e0e1075a833987c66874c647952d8f1ccaa06752320d79511248ac73075efa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189839-8128-4aed-a597-48fe950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '45175888edc461a68a32497a8c3733fd5cd12624b51c7d5ebb7be50903d0ed6e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189839-2ef8-4299-8a8e-4640950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '452eb3972758400e002a93317a75f22448a1cad197f417c2ff7f7d24cdadf810']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189839-740c-4340-b377-4427950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '458af580426c2ae6fa0156db3b2b4d00f6bb242f504e8c3240483bd0c4ff4dd7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983a-8878-46a3-83e4-4673950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:38.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '45fc5e1f9917c1226b16c95007fde731c9f45f628dced84817aec9b399831cc3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983a-6664-43e9-9956-4873950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:38.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '46b7a3be21579fc6cb87ac71cee6cd27196791ef531a20d9e5678b96035611d0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983b-a568-46f2-851c-474e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:39.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4a50b4cd46ec546ead5f6482a4b64ffb26fbf95ad8bb63c659296f42238033e1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983b-8a50-4ba3-97f5-40a4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:39.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4c4580f7b858d06afd0eb9505cca1d5a5ae9600682ac485a267335797deb8a6b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983c-b6cc-4a1a-86d7-4966950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:40.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4cf13570f9c70cd86248eef6b6f7de1fb8a4d893d2511137323545ea1d0646d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983c-ef88-4ff2-be7a-4334950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:40.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4d7d348c05e907d71617346002623b603f759b4cdc0e31314acd9bb1f612f024']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983d-f9c4-4fa2-85ca-44e3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:41.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4e4cb9c0b77cde912b91beefdc65e91db03f8ce222f1f9962dc1e712a8672e8e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983d-c898-4bfe-93af-4acc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:41.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4f44a3a368ae27c09756188b4b9ec7ec443461417a407bbca8d2a6db9b4066e4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983e-c768-4d6a-904f-4e3b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:42.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '502ecd2a99c5ff8be383075d980befbc31ce0f5493ea3617a78560b3778a1c34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983e-6ab8-4a5a-b16d-477e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:42.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5256ea395b6148824c85ac1ef9ade8d0a05db27c977a90ff33d05fc7e869184f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983f-a218-426c-889f-44f6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:43.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5348427ac09f6039032b20809b96ee34aab6bae9923cfe99fd0a3b92bf45ccb5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918983f-7334-4832-9da3-4c26950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:43.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5356f458a2959b4b5d88b7a71e33cd6cacb151b33481c7289c37eb4301f28289']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189840-1508-48f7-839d-4b27950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:44.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '53ab1a4eb3bfb21cfe2cb1038511c97b119499218f00f6c87592aab1e935fb01']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189840-ff94-44f3-8dcb-4042950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:44.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5448ff86fe86b786574988770cdb0d399be0c9eec7e9d6994ac5c09e4881f806']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189840-f49c-4689-baeb-47f1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:44.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '56a53f8f98b304540ca3fdaf6460049a098e051c8f4f56aa032a9f913d9a0c5d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189841-9db4-4f18-9aa5-4cb2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:45.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '570f4305346ef69fbba42ebf4212f6f89e7dbd3b05ed18e6a12b79e07f493f5a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189841-01e8-4c8d-ab98-4630950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:45.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '57b6477a0431fe6b041928c51b3e7a3bc9a08bfe58f6728816dd7800ad40b6db']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189842-5fe8-4206-95af-4b65950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:46.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '59c981df683707b92ac80eae65ac10bf9354bf12d9900b2099dda803920c8dc6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189842-ad50-40e5-8313-4c14950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:46.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b5f67becf9ad7b1557eaeffd7481bbba8be92e34acf7b4adb1e7fe13eaac453']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189842-5db0-4a2d-8b21-4bae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:46.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5c1ac408c9ba091a6849f8e3ac494c1e40c7225da88959aad5895f0c83a2b1a3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189843-55f0-414a-a925-4494950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:47.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5d05ad36580cab0f73a2b6e0c660c48e7d684b00a217c55e4baf6b68db2f56a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189843-d744-4989-af27-446d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:47.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5df9911ed6ea68ff8140d418c177535a2fb15378f4d0900976938b184e901838']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189844-ef74-40cc-bb42-4034950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:48.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5ece37cc7ae78ad097fa98f8b8a4efb8e124ddb1e062acb3dea7c5f8452fc9cd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189844-5980-4b37-b4bf-4d50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:48.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5fc1e9b7592742375f6f82865fdfafaa11280cc58d990bc8046a4fc35c622d77']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189845-1d68-47a2-9849-40c8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:49.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '617c552ddb4104e6a05ad982aadeb0bd39221f7ac7ed0f5d1a038b8358f1bc86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189845-c010-4021-b3ca-4719950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:49.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '62c62120ae1a8f3d800c1a77bb2fe91588c8d0417b8796c42fd17d8ee7e2175f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189845-9454-49d6-be0d-4f07950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:49.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '63b908d044688bca54f157e01ac85c7e93450390c57d790a5a518c00a3ff7482']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189846-7a38-4d81-a048-408a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:50.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6554bc28d08ca6d63731ced6262d0c3fd7b8ad4a3adfbc2b43910abc2515d258']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189846-19a0-4cf5-9146-4474950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:50.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '66ede73e7043dc89e029247ad65661905c5bc028b838b441d140058d3cf983eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189847-0a70-4a17-a088-4a71950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:51.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6919742e35d580522389bde230a61dbd368c3b6b1d2091ca8067c05e7abb45cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189847-cb84-45d5-9eda-4c6b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:51.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '69ce039dd7f0cbedec8474d68bd28bdad216f500cdb65619e244c91751a980ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189848-4e70-424c-8e8c-47fb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:52.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6a67e7142bc57a4b5d4d79d4a055358c2a5e3a4a41be3dc17a1ec41a0a596f53']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189848-e7c8-4aac-8d6b-4f75950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:52.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6df8d902728327e25ded2a0a743e09ca223c09b64b5e628c3d60c2fe28f1b232']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189848-abd8-4dd0-b469-426e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:52.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6e754b5cf86b4435b6e4bc5e972ccd3d3fbd3717885fdfc07d946875409d1fa8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189849-7710-49e9-a98c-4055950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:53.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6ee3b7e3baea221c541d237c4a697216c5df122ee561249a0ca26241529b0809']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189849-36fc-4300-aed6-4adc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:53.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6eee4a6d1f66deeb3af3e1970218be8127c975a1fa3617d394aed74f6b29210b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984a-d1e0-44f4-af3b-4f5c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:54.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '702d7bf29796f5e8993d35bbc1fc93a3393c154f9c4365cb6c2fca243fee619c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984a-3ab8-4fe0-b0a2-4825950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:54.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '704dc606f4e0211f7bbba99c8ec4d136bd67b3895f9bde9270172550710b6594']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984b-7758-4ee1-a254-4790950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:55.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '70dfb7be77a2f8b2a49a20cd0734d80ba5944203614521ed1441d12047cd2677']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984b-6668-46a4-a706-4c7b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:55.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '71d749c252af3a1eea54ae2c8a5846acaa49c541bc3f991e7d9d2c3e7d352d32']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984c-4fd8-4c9f-9f28-4562950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:56.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7228b63c6cd62c226305d747684a11cda59771f7d773cd20db8383804ba12547']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984c-83bc-4993-baf9-4076950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:56.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '72537be19a4a8877533ec80301310121543aca30778138b9312863bcd5afb852']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984d-9154-45a0-ae94-446d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:57.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '72c8f42dec78755026805bdcf00e53c4afeff4927784be996f5ebd1a75c88d28']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984d-3db0-4d29-83c9-46d1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:57.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '73afc0d041d762a92753759787b59be4ccd9754e06df68b0875df490c9a01709']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984d-5b18-48d5-a246-4b30950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:57.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '74a03708304d6d324ce123b6081b98690c446592b7cb1e924c0a09516c4f2e16']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984e-af14-4ab3-9882-4947950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:58.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7578a161b6a1d36769778796c8cd42e11aeb17a7e8f2645efb8e9b5bf5892f17']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984e-b0a4-4c44-9294-414a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:58.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7706e5741f3e6a688008e4c79f1f1ed288c21ed73bfefac159c3b7eaffd28ea7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984f-821c-474a-9cb1-4d9a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:59.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '78bc8161b867a0a99e7bde94de2ad84b56913d9d4ef2896a93a3abcbb32f9653']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918984f-e7f0-4d29-8049-4cce950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:47:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:47:59.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '794fd6e2899692c4f0f455f19a182a0d83d1f8645a3d88e222f343df6cb18034']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:47:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189850-4860-44d2-9d01-4149950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:00.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7998ef2d11a0cda931688ccce40f4a03ae7a56a615d37fa64c292ec87e3a308a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189850-a314-405a-8127-4a1a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:00.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7b3726dbe2d9c6ca2cfd0c9480e78c2a7d131d0128c226164b4b3eb84af927f3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189851-abdc-4eb1-a542-43ff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:01.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7bd8d3d35411d907b348a9792a5d36763ee805750e645edb27a103a8196347ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189851-e108-4d65-8740-4373950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:01.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7d45d0bba8b785aafbd3511796ecece67d6136647ec29ad7335d732f470a6d70']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189851-70c4-4b78-8527-496d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:01.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '804b655dc5755066850b68d3cf2aa847ff1cc0ac6949e2f42ffa19527dd03738']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189852-4d28-4338-981c-42d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:02.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '807fc9f07ea3922d40d3f853165427329c995ae5f2e220e86b6ec7f0d6ff13f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189852-0e68-4b20-8cd0-484b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:02.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8267a627b1cb9747365c175a31bb1cbd450c07f5dc32a8849c7023a3918a6ede']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189853-6038-46b9-bd80-4dea950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:03.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8313b2667364d01205451ad6181639a36b4701f03ad9bee02aac13bb4a4d8fb3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189853-6bd8-4265-a108-414b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:03.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '84e730b3a66e93f63abe94df52f715be2eb891acd65e9e703024163950a83d35']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189854-e66c-4107-b9f5-4abe950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:04.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '85c3f02f3050d064b6d69a6cd7c441f5d3c3dda2b32d7185ad479abfd5d6131d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189854-1a78-4b28-9216-4e60950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:04.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '86786cdf1dbb68a4d3a2cb9e842f5f27e846cc460550d56b4be39329e74d9774']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189855-da00-4da1-aa34-4922950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:05.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8809e0c1a8db184ceb152e013e530edf82f4c07bf0123f861a9d4ca41ddaec88']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189855-ee50-4b78-88d4-424c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:05.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '882e0087eb43b08150bdb0873612e0c55d4b931648b76c2149622b5ff8624122']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189856-7b50-4106-9e84-47ae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:06.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '895f03b834d1a51031e5afd484bd5a55451579595e15123b31357ece281dfd1c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189856-86a4-4ac3-aba7-4116950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:06.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '896727eb0c5f5cd981a3586238ac65528fa0d2f58c9b9095c95a34900c20152c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189856-198c-4b29-92c5-4756950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:06.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8b08c6b260b059fc134e58a4d2be14a4336d006de0c63ec24b2f46a7c3e500e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189857-e48c-43a2-a198-495b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:07.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8b0cdf2d2cf8f74a663b13d518d1e88d39d509cb0712d82a7c14e9de633e8ea9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189857-17a0-4cc3-804d-4b12950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:07.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8bd17544e39080e34796f5ae3d5ab0dfa755f401444911c7f219bf191147f84b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189858-ac0c-4ec1-ad92-4efc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:08.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8bdfa4650cd3341c0b602b3447da18657f789488f5cd8ec5447d3b15afa035f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189858-74dc-486e-9d27-4433950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:08.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8be3c3ad667e179da06841147282f0f7c7dc69e8b063dd2bacaaecf87009d560']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189859-84d8-4016-9f2e-4981950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:09.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8cacec10b089f43b745424a6631901ee10e08ef04f9915df35d3c30211c7fecd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189859-3fcc-4066-b714-4512950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:09.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8d6a7e3412a1855b6a686cbf096457b7c2a81d9640b500164c434a68c2d79d0a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189859-29dc-46ed-90e3-468e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:09.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8dcf22c5e506cb4903e1da7414b43dddd261512e8231196e1a1a74df7c735d07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985a-d38c-4c54-8d8c-4301950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:10.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8de30cd7f87f9bede6ea9ff7756fc9b2f3473ab465c8b700558416363b3266f0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985a-c88c-4807-a0fc-4095950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:10.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8e2e7da85ddd5abbbaa60298f0381f7c07b540278a476f2c364e5d7b4995f14b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985b-d46c-4731-9f03-49a5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:11.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8f1dfb34bbd2eb5a847074f3db610824ef9aca97f1cc82fbb0665c0ecf7dc19e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985b-4de8-4011-b69a-4be7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:11.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8f8c02596a217b4eb1611886b857e553551eb4aed68a5a76197b66388e40de19']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985b-efd8-4a87-9aaa-46c5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:11.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9079097870109236f499e6a7568f178240676d37609ae0ca243485e1189ed792']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985c-a3ac-4808-8267-4915950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:12.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '90f7d176a7071b8e237d78e1b16c8325c4542dceaaab6cb7c9d1caf453fe45ed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985c-1d10-4c4c-9921-457a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:12.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9254a841530e9cdd926ba63a22d2653d2bdd704a1068453d8d3b8d79c2cefece']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985d-6350-4f4f-8489-4569950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:13.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9325ae0d6c5e8e37fe3c4689179912047fb1985f3445288bd934d229ad97e8e0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985d-3ff0-4260-aed1-4e33950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:13.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '932a46ec8594f5e515b68b00143fd67fc4b78495b4950b70675e4915e771ffa7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985d-8364-4d75-b479-4358950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:13.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '934aba05fe6e628728d1b3dcb048c287b6fcec19f0f6bb8429cf499db418056a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985e-cab4-42e2-9a70-4f9e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:14.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '946a1d6dceb7144626cda2846c96d298ccfbd5f729e5909158d2ab7d7d2ce784']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985e-1ed4-4f24-9c20-46dc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:14.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9575f6494081cfacc918399d77d12b1d776664e524c688fecd240abc5c8fa6c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985f-9760-443a-9552-4624950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:15.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '957a81ee0299715f4fb2916dd326d3369036226be38a02c5b8653aa1224458ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918985f-55b0-40ae-9616-4126950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:15.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95969557bbd02752ec71a969141d1fa1b6bacc641a4200cb00261b440966febb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189860-48f4-48ca-9a89-4ad0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:16.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95eaa6a6ff70507ea4397f310f30af93f90423d75388ad15e4c30cac9929d3df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189860-1e40-4f42-8152-4d74950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:16.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '966a08677e45d3c6658eb0505f59e8ccd1179cdcd943b71a8c937b6a9b3e1dc8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189861-0078-432e-b7e2-4f21950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:17.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '96ddfb5115510e84a92f41b60999fcf8f1ffc871258012efee3b97c6d48894c6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189861-6f64-4b0d-9ac7-4c97950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:17.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '98a5815532f03ea9e9d994bf1414f560cc0c040f5aa67cd44549c5471313cfa3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189861-e3a4-404d-a00b-4c6c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:17.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '99903c6638a52cd4e1103ebf4b065a76c5cae52c09d8d99333536cc5bffd63a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189862-7250-494d-bd22-450e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:18.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9b2c435aa49de98337bb8f4a26c41d975b79d94f2003929a3dc4b816d5c20dd2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189862-3f14-41ae-924b-4e24950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:18.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9b3f118b274dd642c805ed75f323c68d86fad0e3c6420e3aceaa64a541f9e58b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189863-35f8-4a64-abde-425f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:19.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9ba62e340ad7f79444b09656c1e1cef1363598269cfa6859d03ff7bd56e1c3e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189863-053c-4186-a62f-4b7f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:19.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9be1b3b4fe3966f0f67392a0a8fb24bf9cf2abd1ce835469535cabef705055ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189864-c3c0-4230-a396-4c49950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:20.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9c1b820e932c90bceeeaf23a64522ad66f6910217cb1e45ef1080d39d15c6969']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189864-f74c-494a-8c2a-46be950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:20.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9d2e761449f5523a86cd9608f38e6a8fee4341dbda284159a954d6c88306ceac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189864-6178-49a6-91cd-4861950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:20.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9e7db7546c31ea10fdc77e2f54cf82758b382aa0065993e57ea692e7cad8bf3b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189865-fea4-43f4-ba64-490a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:21.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9f004176dcfe96c96b4dcbbd2412c92a643b5bf3dc95a5f2c252fc6975eb1669']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189865-0984-4dc2-adf0-42d2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:21.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9fb848726d72e990a787f29ba811f8c16223dc734ac84ce7a7a0c0540b3445ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189866-7148-4314-8fbd-461a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:22.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ff3a443a382887e424dbab35cb1a0e8b7f22fbde58b2b51fbc1eba7114a2fb06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189866-0c7c-4f81-be28-42a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:22.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a109d41f11a65f282775c0f6631162b6894cc169c28562416519bdf36ead93ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189866-7ca4-4dfd-86e5-4d81950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:22.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a142fc6d10733e7d57974f903f2e3213fc45f1326e3bfcb796333e62b0aa0c8d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189867-f2b4-4b3d-8bae-4cdc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:23.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a164fc852b14fdf8395b9b5bb7334014b60cf5b27c4891b1cbae0a81f9806532']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189867-6bcc-4794-9b10-418c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:23.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a1c1a26cc6908b35719422d4d21f9017116b991c33b7f3c482659a566471a8b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189868-11f4-4e61-8496-4c90950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:24.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a26b5116f338439dc9b107d47243aa846d7e12554304bce31641af3947fdf1cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189868-db10-43f4-a4db-41e4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:24.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a30642ba1c8826549e675c26d8184da67dc9e946ed644868eff3a82655248757']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189868-21e8-48c8-81a6-4373950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:24.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a38d0dd8810bf88ae88384d95c3b6db53226536a2cc6ccce88bee8dba658af69']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189869-9d40-4d99-a5ee-489f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:25.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a3cf472573d363dfbb90780ef5e63cb0ab94a39973d230c120bc4138acac987e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189869-6448-41f6-864e-4e03950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:25.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a41af023647cee1e17a03a63de96885a605a7026bb0508cfa9d374c3f3cc7c8f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986a-4794-4fef-a149-487d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:26.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a4fbfba8438dd9ce58f89d9a0438b4d06904870992d7b0ba8d85536043d70317']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986a-d748-4b52-bd3d-4c7c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:26.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a4fd6245425fa23983153cda2d6b05b131c72843a26dcf66aca7fefb603675bc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986a-eb70-4755-ab06-4124950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:26.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a500e8c332291b9dfa54c228b01d16bd1a1bf481412970e5bd3121d71aadf56a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986b-c200-4c9d-a061-4a74950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:27.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a53901d231325c016ea584cb4e0f1076801de695690138a57500312573fbbc44']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986b-0c80-4f1d-bf62-4ad6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:27.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a6f97dc9c87a4cadbe5b1f029f0ea06b60a3bb5a72d712da0be08a5ce113e498']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986c-78c4-4c60-9080-4446950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:28.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a70256780c6a213bf737aa80307ad247391c4d35965b3e524ae48659d1558da3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986c-3e90-4762-a3e3-4f7c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:28.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a73526b2955c6e44bcabbbfd6c4d35e4a15059f0c47138220b09b7aeb0bcb352']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986c-2ca8-47d7-bce4-4058950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:28.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a777f1fa6e883c4a0b3ca138245c16d26645362292efcae27ccf911e3531217d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986d-3dd0-4390-930b-4083950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:29.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a7b494c501e8fca5bd1fd63fb2ee172af2c4c54a241eeac62517823e9283af11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986d-04f8-42b7-83af-4c85950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:29.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a8436588ebe6ea42d54177ff56fa7ccb7433d2f856f6fd7779b0b92f80d91253']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986d-d86c-465d-8b64-4193950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:29.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a848f23a7e02df752e06dbbc5b4eb768de785e7bd93f5b0f6950347e06b5b8e1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986e-280c-4d8e-873e-4761950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:30.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a8bdfb18ec5524182ad56fa2e6e874bd011c121de6d3f61f4557156372ea7953']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986e-94e4-43e4-9ce1-431d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:30.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a8c8f85d3e02b1df40249085daf6ae1eda2f7fff0123baf2fe87d0ced0fef55c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986f-4c40-44a4-8841-4904950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:31.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a90e032fa1b2f675f7da57fe8c800c5e37898871dd7eceb3f5b636c1ae51c80c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986f-3670-49a7-a7c6-4a3d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:31.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a93902e76c49523582907ba2511fadbb4def19a926349317ffe1ccbe788dd806']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918986f-b018-4865-a637-430b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:31.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a9521079bb52c7d5330de7758211ecc8a38863059f1dd2c3397c036652d1bb5c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189870-a21c-47f8-8b92-4a18950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:32.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aa1a65f4f6455264a59f5b0f1a4d7b2bfe2ab2c9ab349a98779b560e4f74d109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189870-8414-40e6-8e2f-4263950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:32.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aa21e9871c2c3d2f0df1a7206752f0551795532212cc64e52d6433dd64e21315']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189871-d0a8-4313-ba24-4052950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:33.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aa8400f49c23779833202b99533536472856a1c9eb1d2115a3747ccc3c408387']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189871-f930-4f51-b528-4bd7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:33.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ac86d7a41f5a15eee286edde750e2ff406bcf122f6a856f85c71cf581ad78190']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189872-123c-48b6-b9a4-44a0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:34.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ad389ece033f4226410d5dc838c37104e0ad9a282723cfd03170ce1846fd49df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189872-a048-4c4c-97cf-4bdc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:34.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ad8f8d5658d8d38dd1c5a5582593bf4c1fd37231d3ca0ceb0e9b3b6a1371883a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189872-05a4-4644-bfa3-4289950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:34.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'adb5f55fe2dda9d968ca33f7db0e0eb40e81f1fbc41994b87a43abe502ca556b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189873-f998-4eb1-b33d-43cc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:35.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ade11cf9110cfebeb5b1002972fd7dc833b6233d2a0731c24e458f1f9eeeb5c7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189873-d800-4032-974e-47bb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:35.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'adf2b1faae8aea47810242f9ddda10c357dafc76016ce5ecaf79f2dbeb9b1032']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189874-d4e8-417d-9bed-43bb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:36.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aebb426c10dfe7c2ee9ee832a4908914bda651384cf95ea6754936180e8f0af5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189874-ab3c-45fc-a4b2-44c6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:36.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aee5f0000993109a579c997d0cf46770256decfc26a7f16f77472480f5fd54e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189875-05d8-4c67-af6e-481c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'afab545955661be09984761e9deb68cf4a09efb608418eee0c1075213195b098']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189875-8354-4beb-bb13-44b2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b07efc25b6b1ce4f4d8283d76a658d9c54e971cfda861e2672af34dcba3592da']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189875-ff78-42b5-89be-49b8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b0fa5b0c6b6ab172c6414e469f48f22a6ca6a05d696a9a808cd12733b834b47c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189876-81ac-49f7-8275-482e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:38.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b172ba609c3e577ae2a7fe18a16900222a01a3b54e5549a406c18d703f6fa0ab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189876-db90-41e3-8bbc-4356950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:38.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b2ca047ff7267c80ccca9618e468ad827b4efe5974f4ed85e54522319156b004']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189877-ca30-452d-b655-49e3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:39.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b2cbcdcfbcde6af813ddfc4fe3d5fa6bf520e8e4e90512f965bf390be0e4181e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189877-c910-40bd-8416-44a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:39.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b328c59c7dfa15695ad096f51f99e55f1767afec87c929324ba7512ab8d3d3b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189878-310c-498e-84f5-4669950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:40.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b36e20301611d20db84259bcf195f420b0c90bf079e2c5586de7efadbba015a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189878-0958-456e-b957-4685950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:40.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b3715c1815ba5e8be31da4b19465868b07a204526007e6af1fd1051a5f04d2a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189878-c4d8-46c9-80c9-478b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:40.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b3a616c1ac9c2727732eb7d70af2f971c50f31733c77731883ab2125681b7ed6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189879-a1d4-4a51-b858-4cc7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:41.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b49c28d455aaa11573b83adde933ffae69cfdcb01a222e695a77b43352248076']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189879-2678-4720-9a4c-4947950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:41.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b55c16768ad097c13fabb0eccd99488a17034517991f67b3d79c1a9ab086b162']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987a-bcf8-413a-ab12-461c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:42.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b57a224b2bce1772fe6a6ef14ddf4cb73267c81067cf541699b8623bf40e9b6c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987a-3708-4ca2-b60d-4a64950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:42.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b60feb4c4bea0b3de40e4dff8332f9fd9de92a90e387f3438c7e53f0c1d2876f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987b-8db0-484f-bfe3-45b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:43.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b627d40d5a86fcb396498a12a410670ffda6a7f622ae6f2e9f66ad4e1e8c5e5c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987b-73d8-4153-9305-4c89950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:43.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b688ae699826ea2327e5c656376ddf9396db8db7e5a12ea4013a6d64eda5ba86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987b-86e0-467d-9f7e-46c8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:43.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b69db557cef503abdcc4682b7bb7db4d7b3cbb6d679d36c4712839b8b89f7eeb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987c-69e4-4865-ab49-426b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:44.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b6f1e3c05f19b3ee051c39b98264eb7a2a48ca03249b8709673c4f0171fe2098']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987c-77a4-4926-83ba-40d3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:44.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b797bb96f13ee61b658a9d3bf6e1f225f5c05d560c6788cd33be07299d2057f3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987d-5c70-47bd-a9d9-4663950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:45.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b797d8429cb8b591acd26c403af18162cd8a70944c2e3a206b40cbed97f4c9b6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987d-fc34-403d-8177-4d33950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:45.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b7c2d91d6cfe03c83abfa7ad70c58dac6b540741b3690db2d042fc7276545585']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987d-eac0-4f2a-97f9-4e0f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:45.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b809d0fa1f0a8c37896774104dad59bdba39b186a12fa7aec74f64cb0520ba24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987e-a4b4-4ad6-bac9-4cec950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:46.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b812c6622faec71e7053733630f9323ca6b1ba4c9da67bde5c4775a7a929c257']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987e-69a4-440f-abab-400c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:46.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b8995f41b658fef5254430865dd8b1e4bafeacf1ccb25a039afc6e8c28f21875']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987f-c038-4854-88de-4e6b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:47.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b8a5b15ea6ae0a8dbde70be1761bb44fe633daafa7e9c37f949b44ad59bf9aa1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987f-f718-4f05-a88d-495d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:47.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b9bc2a23d30b25600afc47973b4ebc19d23a3bb0dea580858ff92267efff96ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918987f-9d98-4523-b5ed-4fc4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:47.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bc306aa37ebe4c19b363c216087b0f3c470aa39b2595bc489e2777f6961cc407']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189880-996c-4248-a29a-4eb0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:48.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bc8ce9322d277bbd43147999a420de2aa5e1dc52588cd0d14c1585bcd29ca995']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189880-a5e8-47fb-857e-43f2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:48.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bd0858268b59b42da3f473c8b61042ecb9238edc70d9df4fa2b32d2c439606eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189880-5874-4814-ba66-4018950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:48.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bd1e353c99f37f323f95b3af4f622bf99b29e2d8cebdc358abd4326384dd78c1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189881-de60-43ba-a85c-46de950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:49.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bd96c26e434144803cc37ee80a00395865681d8379e6e755e6f7cf731f68126b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189881-2230-454f-aa21-44ce950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:49.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'be3d56e9ca7d7ecc38fe4eebfc4ee9bb4e0a859962250e9dc48c1119dc30c1b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189882-5344-4d84-951c-4b58950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:50.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bec71cd6e07006322c34d34a748f0c3f7ff84cd295fbf3abfbbe71d1c1358c1d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189882-81e8-4c53-b8ce-492f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:50.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bf27d6e3ccd5bfa0d330f89156e672929fe02a626dd1796968fc3ea2197abdb9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189883-2c4c-450f-b1be-46bd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:51.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bfc45875264c69668a830223966fa6348af729f44d687a21a6c65a028a612a1f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189883-8fa0-429f-b515-4bd8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:51.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c0902ba0312a79d84bd2800dd682b5f840c7aede16720c8da5a69657aeb2793c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189883-e318-4c97-949d-4ee9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:51.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c0b1b6de4b98eadd8c3ee2b173abebfa0596db1ab1123bb938f18aa0014979c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189884-3e28-44cb-bafe-4ddf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:52.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c0b5da2bcf91a6b49c1158cf47be5cbf03be24abb03916e447aeba9693756e6d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189884-63d8-4604-8499-49e9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:52.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c13e97795b2b802ca839b9f8b9b8851bb20cafa4463a5e33059e41b84cedec9d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189884-6ef0-419b-8c6e-4ba2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:52.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c284500746350029e00c691ebe1aeed356b5377fae2837f480248ba59d704162']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189885-d578-469a-aeeb-4ead950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:53.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c285b7c685a00c7ef6a8354d867bf4b744f0082bd6e7b1056e506b2f5d4d3ccf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189885-e198-4b11-b5e2-4f16950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:53.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c3dcd4a9228a0701b95e82e11ec6575f5f64ae1d2a15056628451551e2bc332f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189886-37f4-48d6-8cc5-4ad6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:54.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c477c30c0285cf1ea7ea3abde3aedca0c424740bdac1dab2403338f113e063fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189886-08f0-402e-89a2-49dd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:54.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c4875dfc4489263abf66b280a491c60e13d375c841906127e1bd541c01d67186']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189886-7d94-4804-a6ea-4ec0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:54.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c5c794f5918bb35563b057e6f7e78a13c4d63591f46c8fc1dd5ae625238be057']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189887-3ee0-407e-96f1-4784950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:55.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c60ab7157890bcc3d9819880a4d1f57ac9069c953953270d0730cab951edb6a0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189887-718c-4b42-9e7a-4efb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:55.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c64cd109c8f9ab18dd7fbc1e31e0ef092da36096370752abca289f7a32507923']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189888-3194-4120-85aa-4d50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:55.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c6a514cb8a4fe2d3242507777f200a58bed6237327a0253377155c5d3ea5617a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189888-c5f0-4096-ad35-4484950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:56.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c6cb6b3f4b26ece93038897bc67dee268a877c20e96a2ebef85646474035ae3f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189888-bb90-4b56-a1bc-41db950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:56.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c7299732b5bf0d10d2b86a0ff4a233823bb0a1515a44a5ff9aee2e4b94b9b565']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189889-4c84-45ed-b296-4e5e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:57.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c7766bcb18d4c4e6fe06a13215745ebdd5cc7f06120804d245400a08dfbd5891']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189889-26f0-401b-93d6-46c8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:57.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c868588e0207a9607eb4bc4fb77a43a6128ae3278eb2159fcda2eea727236842']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189889-76c4-4e50-9c40-4299950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:57.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c88d94c454481f0eadf9db495e14dfa567a6ed0baea96b5e90277502c4273faa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988a-48ec-4871-842e-4979950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:58.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c899ba547e547a873aca335a98611557330a403a29d236c3e9448b0e1c9559d9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988a-0f80-43c9-b947-4631950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:58.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c8e096a066e961e182bb2b76bdb5bd51cfaf5c46bf3aacdd87c209193a87598b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988b-125c-4d1f-b14a-40f9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:59.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c909851e9db95642c14a88c25630f8edd72541137b758edd4782493b41459a43']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988b-496c-4cc8-b685-4e07950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:48:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:48:59.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c929680a25b6f7461987d7ced356d5c7af08fbe1d584dab7444c0c559ca06c52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:48:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988c-3ee4-45da-a78d-4641950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:00.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ca0aae8486d0f3985fb0001ad364c4a842151b7dea233e1d2083d5582932dce1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988c-7510-4f1a-b27e-46f4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:00.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:00.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'caa011b39c6c945672f5fc71c5a5789d93538a6fb780a651851e4cf688875485']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988d-f754-4f61-9525-4c58950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:01.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cafd44d818cf55d5b287a74f3143048568fb4fef3bb0e0c32b471b4d4e327da8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988d-fe2c-48da-8d47-42b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:01.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:01.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cb112e7ff899ed0b75a9e7d2591ba41b3d4b14d2399cf0a50678f697b8e6ee7f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988e-81f4-42c9-b4dd-465f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:02.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cc631200a8c44beef23c16898b8dd5e4d32f3b652b248d26e6d20995800cc58a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988e-74e0-44ab-90e1-44c8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:02.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:02.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ccf13b6f6d65ee0ddbdbcf33e279b2ed278e0885dad95f45c33a05925dc10504']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988f-fd80-42c9-bbbb-480d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:03.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cdf7612e181a9f9c9fc3b97289394a84da7b7a40515ae234f3d89238714abdae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988f-5198-4208-acc4-4cf0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:03.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ce2cebcf28d8a89bd006fe09a81eae4ccc30b4ff3d908027e24d14e726fa1b53']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918988f-d53c-4092-aca2-4965950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:03.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:03.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ce39e93aaea402156ddf126be5e52e4299be114cf6a7921e6e079b763a284226']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189890-5d78-404f-b4f1-458f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:04.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ceb7a4eaf781a7ab1c2b613c8c32f63c26bfe5b95a5a491500fd68f445e9c817']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189890-7660-4bda-a855-449f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:04.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:04.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cf35c817f267a0c10d0337b0e1bcd03f1a8f60b6406ef273b56eaf3d873f03e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189891-c770-4ea1-b981-4c71950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:05.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cf936d38bffe4ec83750dac3e7c8694da1752e4253a39ec0ff9d82354bac61bd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189891-8200-49a4-aa45-4cae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:05.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:05.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd0015e7b48893513a8f28559b261154a14e1451794494dab4f338c6aae957ac7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189892-03b0-4a38-aa6c-485e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:06.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd03d8a743391fe26f92f9bf868ad033337d9819b8840b200a158729dd7bf2386']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189892-3aa8-4f54-97fc-4125950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:06.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:06.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd06b16693af904f18152db9074a2faf8e56e5a8b43626a3981368f7dfe89c6dc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189893-a1a4-42e6-9e50-4770950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:07.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd1865208faa0c58d99912578c65e83dda303616ec12ff0602808aab9dd31899e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189893-a41c-4705-a768-4ffa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:07.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd2731af6b4e494d1e5616e8fe41efe85ac1cbc25342c64229cc1e5affcd455d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189893-8e7c-44b8-925b-46d0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:07.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:07.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd2ce45abe3efdd633936e6bccf983b54595585c33f7930b5a4e2c8fb47eba66b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189894-1f68-44f0-bd64-42c2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:08.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd32820b4485bea167ccd5ec98d3266f86f3a9d30e447b69d1904ce1d003dc41c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189894-0af4-44ba-a8ab-4d3c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:08.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:08.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd38d191d8ae688b11459e1071a307c40c93b46d55f4441c0bbd823dd3fa42a02']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189895-e460-4341-953e-4d8b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:09.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd3c7f1fd4e6a095cf7ab4ab109db03d268ddfc131ccf09e98c85fcc971eb5a24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189895-4448-4b7d-9946-45b9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:09.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:09.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd3f25045e27804d63bb97eda28ebdfd66b4b9a8e60033263034c194b38909488']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189896-1fe4-4751-ba2f-46cf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:10.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd411b0be98e474a20734ef074c94559ec3c4e65a30be420050dc8ca554aed7ad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189896-0294-49b2-98c5-45e3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:10.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:10.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd42799435330ee65f089b25501519ffcdee3459ddd8c1ed6f7456158d01897a2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189897-a0f8-45d4-9226-4e0a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:11.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd443c30e68c20281193b5c49890284e61330ea8e3201c99b1b5a01e10b480228']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189897-1174-40cc-a314-402e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:11.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd49d9ecdd9b3257bcc850040cba0e5fe2db216eb51331760198ccb63cf6f2dfb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189897-ddb0-4c2b-ac73-4a8e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:11.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:11.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd587bfbcd78ca7bc5441299c9b79082c59f09cc1ee01dff0613b89ae77050da8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189898-b43c-4911-93bc-4759950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:12.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd5949d48b60a48789d53f5b5f5f3bc523d7412c830005904d81e7fcc37e86a9c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189898-f0cc-4a81-9607-4db3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:12.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:12.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd5ec99a3e6a65530f69317718c42f38fc245aa7d11f672a8a58671b1df94a7e0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189899-769c-4d7c-a001-4635950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:13.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd6069c54d2fbc9a5196359c803047dc17b1ac942d65aecd4d87c8ae5b0b0852f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59189899-2308-4a20-949e-453a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:13.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:13.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd644fea283c8821e39fa845284dd454678c036a2513fad9428474864f56f0e41']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989a-6254-4821-a1b2-447b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:14.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd6780382d076c0031450d1fc8214ce9a3fb0ede5271b4937ed3f928f6059ac4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989a-ce3c-4fa5-bef5-4749950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:14.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:14.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd67c5b7cde691f1c4dd6b2252ecee5d8545595cd33c5155c8eb0115b351807f8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989b-3f8c-4051-9df9-4cc0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:15.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd7124d53da7a3574d9923481fed36a771c396eab4d48cf686fd99e53493389d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989b-a3d8-4779-9f72-4502950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:15.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:15.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd75c4d50d420f2f3711d9a6116ad7987fedc4321fc0fce113ad424c2bef854f8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989c-f544-4b2b-8322-4333950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:16.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd82d5644f5e206690baffd53efce493baafe40ce84688d55ffd8446f4f6561ff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989c-a22c-43f0-8c03-42c4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:16.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd84832b25aedbfaf88253115d6d721540c0028c7e9db9665ccda995ec3a8816d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989c-72ec-4a14-9c60-4bed950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:16.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:16.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd8988df50e0815ac6c8bbc58945240e4e3731bf66d2001ffd7f68ddeeeae9b65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989d-fa04-43a5-b46f-4d30950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:17.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd8b1fa21348e534f9dab07100633fd4ce8801f04870f772fd23cbb8488fc1947']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989d-d518-4a3c-a734-4129950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:17.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:17.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd8c2b6edc3be26193bb2ec9083d1237d7414fb48f81d8e0963335a6700002c5f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989e-0890-4898-a6da-43f0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:18.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd919b6bd5939e1127a46e5dabd97823e430418fdd366a234425b7c62c0c830b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989e-8040-4ca9-bf18-4069950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:18.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd9831bb7edd3a33a39478db12cd5e8cdb1d8c3eb4f7bd99fd54ff3b048f0b670']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989e-6584-4a9a-9c47-40ed950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:18.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:18.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd9d2ee264fdf00dcfb89ee596f8d85f16a8221366a41db969012f9e0a5bd3b81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989f-10f4-4a0f-8db1-463d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:19.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd9dab150c52836aa2a8be25661ebdfa63418538a0cc4e2532cb16818d6271d92']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5918989f-7980-433b-9337-4c2f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:19.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:19.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'da4588478fa8c42ac3dc0aa9da8cf0e5269bf6ec01468ca6aba7b771bb0538ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a0-9380-44b2-a6a7-4175950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:20.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'da54ac24fe4cb28a8d7c71960eb6e4e8076fac307d1b7d8c2e28ec556083c78d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a0-d240-4110-b6e8-415b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:20.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:20.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'db32c1616542b333bdec4f99a28dc897137eb488a10f2bdbed48bc903d946030']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a1-796c-4a53-aee3-4cd3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:21.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'db50a703bee88decb3b2e775490c891aa37e185a218e9b3dc76c87a941dd51ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a1-8b30-4bd7-8b76-4e53950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:21.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:21.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dbe42b78c4333bbe9f74e3c56f766133bd7588f74847c8a28d148aeb1cd0e44c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a2-b060-44cb-bf15-4849950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:22.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dd227bcd211d251572cf942baaaa85e995bd5cf7847eff96ed5c16d317f5816f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a2-320c-4793-8853-475c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:22.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dd4b608488164a4382646b80cca336fbd324e079b374d4ae91b08d37ea7248b3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a2-38b8-4a9b-a9d3-4bbe950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:22.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:22.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dd88f945c0f0a9913142df851bd953a8d01d0c4fefea5178ba96f52b9d16b3a1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a3-7f48-4a94-b90e-4bf8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:23.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ddb999c01cfecc5c414c3a807d8edda2c352befa55d6c7f6450d7d8d8e51be30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a3-4750-46a2-aa9d-4ab6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:23.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:23.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'de8656197d2d60fdd87c545fc10991b3a711e20b654e8ebfafa097d698a2ffb6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a4-1f40-41ed-96eb-44ff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:24.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'de98939d3d9cd7e8abd603a6fef85d513d5954521a5dce285e953522697b4966']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a4-7038-4e0a-a277-4cdc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:24.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:24.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df733754f978ea0e6e0ab70c1336005606974089eb1d3a25b59fc5463485a4c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a5-fab8-410e-905c-4cce950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:25.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df92d3751d63e47efdfb05b02268a13029f11d82e8a6f4ce871f51089b585469']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a5-b9a4-408f-a52f-4c06950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:25.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:25.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df9be3616eae38fc383d0e44d19d8e655f6beee8337db2f53af10a1dd991ddad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a6-3ac4-4843-93a7-4f84950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:26.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e0445b78520551d2f51bcf745afc578b00511dbcf3e3981bf326e4ecaa58df3f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a6-8f4c-4668-8349-44f9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:26.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:26.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e063883793c00e4d4ad8962babcaac7dd548c5c639e73dbd06430647a71e0a3c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a7-3424-4ca8-bb8f-4ef5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:27.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e0ca84dafdaa5711ba9dfa358fff127e9c87072179d66be4643065dfbe67c2d2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a7-5400-4fda-b9d1-45ef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:27.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:27.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e2778af48ee921eba99acf95df48e1738248a95a450bb94785793090e4693b86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a8-f494-46fb-866f-440b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:28.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e2bbec5aa1bcf0a7c6da883aa07ece777a3e286198de34e56a32dfc35316483a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a8-9748-4c19-b986-4df3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:28.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:28.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e2bcc99e253558c8b31d1dfa1f22929122d28e24936c1fd259006f9c7f402218']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898a9-f4b0-4234-ba02-4781950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:29.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:29.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e2e9694742ded91c0a6cc086be899e4d39b0b722a2c21e1207515c11342bad50']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898aa-7d50-46db-bf74-4159950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:30.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e35ddea94f1b6fd721d12123c95d71319240f4e0a93b1ceef0fb151e5da7a733']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898aa-7cb4-4987-9c83-4eb3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:30.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e4061be8b9e839e4fb8cf794ca1ed0413b69deb65424a18f31771dd7429ff64a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898aa-9840-4929-90b8-4573950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:30.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:30.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e475b7c7a75c53b5b325d2de86c69c6c92d8ddd0fee92ee69f8e3028c06e9fd9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ab-1108-451e-bbe5-44c5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:31.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e4e850ff9b2c0668a9b246fbca437c0a9b2f225e720267d3a2a5f90f7cdb1412']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ab-8568-4287-bef5-4a07950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:31.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:31.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e576a581825fcefaa1f8976beff600a7fa841653cb30618519c960b76d52d775']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ac-f4ec-4490-bad3-44cf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:32.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e595fba9b7b8de8bc00572756931e81cb00f51bec33835aa4851e39b0ff5a2a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ac-e208-4694-ab1e-4c47950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:32.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:32.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e5cad19114ac376d9b47e8e69a5426c828d522987d0c3bad9bc7ce7fc3741996']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ad-72ec-4d56-913c-4c73950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:33.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e691b3f5dcb591819ab24731a7b18ae248babcf8ec0c607c51efce9bd3904bd2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ad-775c-4572-9398-4a4d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:33.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e70b66b26e5e9068e0a32fdd6ce1cefbefabb66031a7dc9828039d4fd3a9d541']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ad-a254-4e98-8f04-4ae5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:33.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:33.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e7ff79b9ae326e1669b1a4570b643d627bc908f9412a21b24af0871c09dee41e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ae-23e4-433d-92d7-410c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:34.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e84baf13c2f8a5b4dea01dde1b534993fd4feb07b3898486cab174c97d3eea42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ae-2abc-4329-af04-45d6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:34.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e90d1b2b0a7a9524ae26797b03c7a8feadb2153b7af329c1a7e14b4545e63260']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ae-9600-4d4d-9083-4594950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:34.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:34.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e91a43556e7b87629a5d2daf81874dc1dd7aa3d94f188821a819965ee4cf39b3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898af-e2e0-4ecc-9fd5-48fb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:35.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e92da02ff06fd1f7586ab56717dde27b8197d392a7d8671994dab005ac53203d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898af-2900-450b-b0f1-4510950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:35.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:35.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e95ada7eaa47b78e069cd2b78560d4e85b5ddfd27278234d9d38e6015a8734a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b0-103c-4af7-8dac-46e3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:36.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e99409f37020af6122c65e5d7205ecdd45f1facd68fd74a7074afd612f602717']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b0-c9f4-48ce-88be-4939950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:36.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e9a3752a69da87b78b17a799aee74a57c97cdc9fbe198e013a423de98f689f92']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b0-4c40-43d6-b472-43aa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:36.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:36.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e9a8e391643f6d740b45b73ebffabc75cda422f930e2f57be146ae818eb55c2c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b1-d634-4ed4-b231-4787950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e9d2edd67f1e2b8205c71ca01310d09940132bbed0860976256c63e2b5120f1e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b1-dc40-45e8-8ce4-4ab9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e9fc031270f0b99ed7adec8c18bb96d3fcf9aaf01739db4fe365c0ce131d0723']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b1-be48-4260-9d12-4e75950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:37.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:37.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eb0529d3ccd422c1950276ab5cdd4847b6384a92154c1ee4233e35a9a984342b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b2-60cc-4e03-acd4-4f08950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:38.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eb1a2de2674613ce9ccb7c520b56ca8205cfef65c4dfd6ff95e1ab4c94136f63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b2-92d4-4cf6-bc26-4c17950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:38.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:38.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ec033502fcebd8c230239a744af78b9d5f6349868620ff2aff66555ea54a777b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b3-1994-4c1b-a22e-491c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:39.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ecb21b593f8599f27dc58b1d761e816e93c2ba736ac8cf84126ead622020454a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b3-6748-47ef-aad2-4a66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:39.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ecc6b25d65ea374f176bfa83dc69fee9ff658a2c53db825ded59f83acbfc13f8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b3-f0b8-4e1b-8a27-43ec950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:39.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:39.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'edefc2dc9def6a7fa913dd3060a481157f39fd294e66eafb72514011121842b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b4-fd78-427d-b2bc-458b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:40.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'edfabd9f2622b7caec5e4f29dd9e2d927afa66b0193a86be0d557668c7a38009']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b4-09f0-4d26-8c41-4d9d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:40.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:40.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'edfbc73fac54e03d7b289ea6a2034046bb614e6875cc6300a7c91f970c461469']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b5-4de4-4fd3-b316-4c68950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:41.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ee27702107c77fe6b9567790f5c07b34df35f93655bb1f39642e3963bf68c799']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b5-82bc-47ce-bd3c-4ac3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:41.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eeb9a24b7c6bca4ebe024533bbb81e5e7d0289096a1980507038ffc5b6a704e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b5-9068-4333-ba5d-4667950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:41.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:41.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eebf7e304137faab5bad82c943b521ac036def21276933eac7359748180f8850']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b6-db24-4b2c-86dd-48ee950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:42.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eebfdc065b8257b1baaafc5ef954703d23299d8ab5dbb126fe21ec86b31ffed8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b6-41fc-4352-9bb4-4058950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:42.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:42.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eed0c35a9e62d158d3ec7efc42859e0a7ea7bdef335af28a25574583e5576dd4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b7-aa94-4eef-a479-4fb2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:43.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ef580118bc3456a493a5943b5200eb96ab541516b587fb4f00f854940e53c262']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b7-6dd8-4c05-87d1-470c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:43.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eff748571e417704306fc08b12db15e3b9d01e96d033f89b07b6bf78b65c6a36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b7-c824-451e-87d4-4bf2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:43.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:43.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f00449a8d7c83a097b84dfd32c1540611fe116ebf7397bccb93b86bef2c6cd8a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b8-c6a4-4793-ad96-4398950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:44.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f0b8d425b5e74239cb2e1cc0424c41cfffd9eb5aa59e242ea18556d3172bdc54']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b8-cf78-4414-9174-4f40950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:44.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:44.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f1183e7b98cb54db50c73d5550a65a81c32d1c4376426d27558096e337d82cfa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b9-4c54-49d0-b8a6-4318950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:45.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f158b3006f5f35d91bf47af176cc07642bf1a718664d4bace1b30516ec5ec2de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b9-398c-4339-b4ec-475f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:45.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f18c0c2b74187139e77ce079946d5251ef16f49b28d88c2b45b55256bf2ff18d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898b9-e228-4a19-82d1-4da1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:45.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:45.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f2516d799392f8445c6755ba76c40575dcfc227a299a9233b681664403e86465']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ba-1d40-43da-9cfa-4546950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:46.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f33fe03674043ae8124b22a8ce5ea9d420d56e6223243314241c075fe02ce01b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898ba-cb64-471d-958e-430c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:46.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:46.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f36d637fb8d2453e3a0570c0cf04b0ebf4d420653e74492aef012661878b4e56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bb-777c-4c86-bece-498e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:47.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f3e3fb714e31b4e06f30f177967087bd00f70eb39ffaa32aee257938d1eaf64a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bb-91b4-4150-9ee4-4207950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:47.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f4bacb044967269bc21af3ebe606bc708df071033f5d1149611c44f1b83006a2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bb-7c94-441d-a93b-464e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:47.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:47.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f4fea3e9f1cfdf2664b1113daa8a9b87a71442ba8c2f0267a82e8011cbf841af']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bc-9718-4bb9-94b3-416a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:48.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f51c157b7a410ebd29333363f095bcca768763e07e8869017616dd2a959be906']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bc-8944-4992-829d-49e5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:48.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:48.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f5936660bdc45761445b8a6551ef0073df38df1cb38239f840eaaa7f82c6199e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bd-581c-4719-86a2-4e9c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:49.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f5cdac801f7a2ca4ad4cfce02c3be08886b05176be276d8c99082e7f8ca00c36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bd-39bc-4d8f-9674-4efa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:49.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:49.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f66fd77a71cda6cdd60d1fc0bc3ab18b25337e2911f64f7f76a7f24d9cdb0045']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898be-0a64-4e03-97cb-4acf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:50.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f6a0c2f1ded168e1fe1c405c799996a538c80079da5d46e2e5e9b6e4db6fb1ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898be-30cc-466c-8ffc-4711950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:50.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f6f72091299ffa636555e00ab823eea9fe1ee2dba2b29b5095e3b1754dbf3ff9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898be-8794-4572-aca0-4655950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:50.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:50.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f7452a7912dec6e489e50b46f0afd00cf498f452e048675787d6c9d38e2302be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bf-f298-4292-8e56-43af950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:51.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f7aeb4b3730971bf70eb2e0ab3c2f59fe6841688729ecc3829df545123a991b6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898bf-27c0-4f87-b24d-43c5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:51.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:51.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f7b0648927a2b9bbab1f671619917e3bc8ff8e17c842a09a37aced772ca5c151']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c0-d090-40b7-be48-4e90950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:52.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f80ddfc4d890d8860b7cc40a4cdc6c461874ac548314944975b44225a6e3a550']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c0-acf0-48c0-ba98-4063950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:52.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:52.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f8bdf36a2822c3bf117188662eb01a5056d849c59320b2998a2d13f4db222bc0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c1-62c0-4ffc-8799-4195950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:53.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f8e096c931798cf42de220558a37b8c0bce7d8afeabb8683a8c7b50c40f641f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c1-5ff8-4c83-99e7-458c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:53.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f9e7839235b45d8779cb5d57030f79ea19986e3d0a539f8b1a2664cd770fe3af']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c1-f7bc-446d-b4ce-4f2e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:53.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:53.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fac50a249abdd7319046db8c8fa699cb9869bf2d2e67d4ee094ba18c68c6b477']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c2-2bb0-451d-8b4b-45ce950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:54.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fb0f6a7af73053e67a582747395d7c2cc767e6d47156077e6d757bbe1077992a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c2-08fc-4860-b281-4b73950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:54.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:54.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fb5023e61aeffbfa15b4508ad135a24f413d9989dc35e27cc5e2db92670a717f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c3-293c-4288-993d-4244950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:55.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fc17b235ffd61ad70942329a8faafe4a8f8b66e64a058625344740ff19a039a6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c3-5840-486c-8d04-4c4d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:55.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:55.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fc48c8fdb1280345ab6058d1425d9011c14dbc36fd5598ff5198f83d6a85c403']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c4-d938-46c1-b4b8-44d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:56.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fcba4cb383c40cface50ec91ca6f91b87c09e309d75766f9e41c488a062639f2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c4-1ab4-420f-9cc4-4f4e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:56.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fce813d5af12c57a0d24fcf49b2e4e6b17578bb3333cc9d4f656ae19a3624841']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c4-b050-4f20-8579-4e42950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:56.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:56.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fd028c9487451e2ab1d023a374cc920b34b20fbeeb6b816718dd2ec467a4898d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c5-8b60-4bc3-b681-4dfa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:57.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fdc7090d5b7c7600df86ee930d09778963a1f265fc9c211fb9b07d2067ec654c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c5-a790-49c9-b69b-4714950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:57.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:57.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fde8c72c601026c8558a6833ed80acaddab62dbb39b4f30463614a63974cef1b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c6-3cc0-4109-81d3-460c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:58.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fe6f5826759d201712d7363ca3faa2f4e94d98c9ccfc2abc5726be3cc1f5a070']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c6-638c-4063-9dcb-499e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:58.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ff66670b0ab937f33842c0977c2396d25933a8da7e4fa1931e0a9055dfeac9e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c6-d9ec-4462-a1a2-4236950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:58.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:58.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ff6b3a1124ba45231bcd2e7739325523692cfbd48e9326b67a51a9bc6754a880']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--591898c7-5b54-4d5b-9b76-4dcf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-14T17:49:59.000Z",
|
||
|
|
"modified": "2017-05-14T17:49:59.000Z",
|
||
|
|
"description": "hashes associated with the PDF-embedded Microsoft Word documents",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ffae67dec427357f80480c523dde98c14e4f8296f82bb9ea867e544bc229e009']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-14T17:49:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|