2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2016-05-25" ,
"extends_uuid" : "" ,
"info" : "OSINT - CVE-2015-2545: overview of current threats" ,
"publish_timestamp" : "1469608746" ,
"published" : true ,
"threat_level_id" : "2" ,
"timestamp" : "1469608718" ,
"uuid" : "57460863-76dc-4272-8116-4ea302de0b81" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#ffffff" ,
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
} ,
{
"colour" : "#004646" ,
"local" : "0" ,
"name" : "type:OSINT" ,
"relationship_type" : ""
} ,
{
"colour" : "#001cad" ,
"local" : "0" ,
"name" : "estimative-language:likelihood-probability=\"very-likely\"" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207497" ,
"to_ids" : false ,
"type" : "vulnerability" ,
"uuid" : "57460889-aeb0-4560-95a9-4f1802de0b81" ,
"value" : "CVE-2015-2545"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207574" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "574608d6-0abc-48d9-9b54-443502de0b81" ,
"value" : "https://securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-current-threats/"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207590" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "574608e6-2b38-4738-b31a-453902de0b81" ,
"value" : "CVE-2015-2545 is a vulnerability discovered in 2015 and corrected with Microsoft\u00e2\u20ac\u2122s update MS15-099. The vulnerability affects Microsoft Office versions 2007 SP3, 2010 SP2, 2013 SP1 and 2013 RT SP1.\r\n\r\nThe error enables an attacker to execute arbitrary code using a specially crafted EPS image file. The exploit uses PostScript and can evade Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) protection methods.\r\n\r\nThe exploit was discovered in the wild in August 2015, when it was used in a targeted attack by the Platinum group, presumably against targets in India. Over the following months, there was significant growth in the number of threat actors using the vulnerability as a primary tool for initial penetration, with both the attack groups and their targets located in South-East and Central Asia and the Far East.\r\n\r\nIn this research paper, we discuss examples of attacks using the CVE-2015-2545 vulnerability undertaken by some of these groups."
} ,
{
"category" : "Network activity" ,
"comment" : "SVCMONDR attacks" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207656" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "57460928-61e0-4a43-83f2-477202de0b81" ,
"value" : "59.188.13.204"
} ,
{
"category" : "Network activity" ,
"comment" : "SVCMONDR attacks" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207657" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "57460929-ad38-4a8d-9e38-45bb02de0b81" ,
"value" : "180.128.10.28"
} ,
{
"category" : "Network activity" ,
"comment" : "SVCMONDR attacks" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207657" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "57460929-61c0-4cb1-aa13-4f7e02de0b81" ,
"value" : "www.ocaler.mooo.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SVCMONDR attacks" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207658" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "5746092a-6dd0-420b-ba0c-4b4a02de0b81" ,
"value" : "www.onmypc.serverpit.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(svcmondr.ex, Taiwan) - SVCMONDR attacks" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207694" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5746094e-8e0c-489f-93bf-4b9502de0b81" ,
"value" : "8052234dcd41a7d619acb0ec9636be0b"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(svcmondr.ex,Thailand) - SVCMONDR attacks" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207695" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5746094f-cd60-4203-a6b2-467e02de0b81" ,
"value" : "046b98a742cecc11fb18d9554483be2d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Taiwan, 1-3\u00e8\u00aa\u00aa\u00e6\u02dc\u017d\u00e6\u00aa\u201d.doc - SVCMONDR attacks" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207768" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460998-5644-40f4-9db5-488702de0b81" ,
"value" : "d0533874d7255b881187e842e747c268"
} ,
{
"category" : "Payload delivery" ,
"comment" : "EPS - Taiwan - SVCMONDR attacks" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207819" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "574609cb-b624-4311-85cb-41ba02de0b81" ,
"value" : "98c57aa9c7e3f90c4eb4afeba8128484"
} ,
{
"category" : "Network activity" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207883" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "57460a0b-88c8-4d09-8a10-45ca02de0b81" ,
"value" : "74.208.4.200"
} ,
{
"category" : "Network activity" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207883" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "57460a0b-9768-43d3-bd39-4a3f02de0b81" ,
"value" : "74.208.4.201"
} ,
{
"category" : "Network activity" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207883" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "57460a0b-3c7c-4504-b6a3-488e02de0b81" ,
"value" : "180.150.227.135"
} ,
{
"category" : "Network activity" ,
"comment" : "Danti port 443" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207884" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "57460a0c-9ee4-4b9c-a7bb-44bd02de0b81" ,
"value" : "goback.strangled.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207884" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "57460a0c-3538-46c6-903b-472e02de0b81" ,
"value" : "carwiseplot.no-ip.org"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1469608718" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "57460a0d-e3d8-4ddc-b1b2-4d2a02de0b81" ,
"value" : "115.144.69.54"
} ,
{
"category" : "Network activity" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207885" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "57460a0d-d384-4108-99dc-43e602de0b81" ,
"value" : "newsupdate.dynssl.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207885" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "57460a0d-05f8-4769-9f57-41c302de0b81" ,
"value" : "dnsnews.dns05.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(dropper, from cab-archive) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207962" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5a-a738-4354-a28b-434902de0b81" ,
"value" : "6bbdbf6d3b24b8bfa296b9c76b95bb2f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(http.exe) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207962" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5a-4b44-4948-842e-42bf02de0b81" ,
"value" : "3fbe576d33595734a92a665e72e5a04f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(lsass.exe) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207963" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5b-9358-4317-9e00-451902de0b81" ,
"value" : "8ad9cb6b948bcf7f9211887e0cf6f02a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207963" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5b-a94c-4b80-af51-4d2802de0b81" ,
"value" : "9469dd12136b6514d82c3b01d6082f59"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(mshtml.dll) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207963" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5b-a1d8-4c40-afe6-448902de0b81" ,
"value" : "be0cc8411c066eac246097045b73c282"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207964" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5c-92c4-425f-8048-409402de0b81" ,
"value" : "bae673964e9bc2a45ebcc667895104ef"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(update.dat) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207964" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5c-6788-4cbb-a57b-467402de0b81" ,
"value" : "d44e971b202d573f8c797845c90e4658"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(potplayer.dll) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207964" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5c-040c-47b0-9e8a-424702de0b81" ,
"value" : "332397ec261393aaa58522c4357c3e48"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(appinfo.dat) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464207965" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460a5d-8bf8-4467-b032-4f6d02de0b81" ,
"value" : "2460871a040628c379e04f79af37060d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Potplayer - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208043" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460aab-7250-4e4e-a149-4f0802de0b81" ,
"value" : "f16903b2ff82689404f7d0820f461e5d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "RarSFX - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208068" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460ac4-b81c-4962-a877-4bd702de0b81" ,
"value" : "d0407e1a66ee2082a0d170814bd4ab02"
} ,
{
"category" : "Payload delivery" ,
"comment" : "RarSFX - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208068" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460ac4-848c-4f38-a3f5-455302de0b81" ,
"value" : "4902abe46039d36b45ac8a39c745445a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, from Mission list) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208145" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460b11-4d68-4fb9-a1a2-4ec202de0b81" ,
"value" : "07f4b663cc3bcb5899edba9eaf9cf4b5"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, HQ List) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208146" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460b12-3aa4-4416-8b50-4fd702de0b81" ,
"value" : "a90a329335fa0af64d8394b28e0f86c1"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, Hotels) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208146" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460b12-f4c8-44b4-a0b5-459702de0b81" ,
"value" : "b751323586c5e36d1d644ab42888a100"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(Holidays in India in 2016) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208146" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460b12-2e74-4080-ba7e-468402de0b81" ,
"value" : "8cd2eb90fabd03ac97279d398b09a5e9"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(Holidays in India in 2016) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208179" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460b33-0d18-47d6-b3c8-467102de0b81" ,
"value" : "d91f101427a39d9f40c41aa041197a9c"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (HQ List)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208238" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460b6e-9314-47e7-8f43-4aec02de0b81" ,
"value" : "c591263d56b57dfadd06a68dd9657343"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (Mission List)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208238" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460b6e-04e8-435c-9c6d-4afe02de0b81" ,
"value" : "aebf03ceaef042a833ee5459016f5bde"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (India\u00e2\u20ac\u2122s 10 Top Luxury Hotels)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208238" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460b6e-ca7c-43e4-9de2-419302de0b81" ,
"value" : "fd6636af7d2358c40fe6923b23a690e8"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(chancery@indianembassy.hu) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208310" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460bb6-e4d0-4c1f-b19a-4cc902de0b81" ,
"value" : "aae962611da956a26a76d185455f1d44"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(amb.bogota@mea.gov.in) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208310" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460bb6-5ed8-403c-bfc3-46d502de0b81" ,
"value" : "3ed40dec891fd48c7ec6fa49b1058d24"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(amb.copenhagen@mea.gov.in) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208311" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460bb7-8b94-4426-a516-465102de0b81" ,
"value" : "1aefd1c30d1710f901c70be7f1366cae"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, dsfsi@nic.in) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208311" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460bb7-5abc-41e9-8f48-471a02de0b81" ,
"value" : "f4c1e96717c82b14ca76384cb005fbe5"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, chumarpost@gmail.com) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208311" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460bb7-5dac-4821-b3cc-4c1102de0b81" ,
"value" : "1ba92c6d35b7a31046e013d35fa48775"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, Cabinet Secretary) - Danti" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208312" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "57460bb8-da3c-4092-b589-4f6d02de0b81" ,
"value" : "6d55eb3ced35c7479f67167d84bf15f0"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, Cabinet Secretary) - Danti - Xchecked via VT: 6d55eb3ced35c7479f67167d84bf15f0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208385" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c01-da8c-4831-a3b7-434d02de0b81" ,
"value" : "7f9495399da2782e0fef913fed25fa0e5a80f2f31b1d24018ca1f198132f396a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, Cabinet Secretary) - Danti - Xchecked via VT: 6d55eb3ced35c7479f67167d84bf15f0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208386" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c02-a9f0-4aee-86c3-4cc502de0b81" ,
"value" : "d12324a522b404b7949a971fbe767ae06b03c576"
} ,
{
"category" : "External analysis" ,
"comment" : "(India, Cabinet Secretary) - Danti - Xchecked via VT: 6d55eb3ced35c7479f67167d84bf15f0" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208386" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c02-add0-4029-8b6f-412e02de0b81" ,
"value" : "https://www.virustotal.com/file/7f9495399da2782e0fef913fed25fa0e5a80f2f31b1d24018ca1f198132f396a/analysis/1463177598/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, chumarpost@gmail.com) - Danti - Xchecked via VT: 1ba92c6d35b7a31046e013d35fa48775" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208387" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c03-e688-4ff9-a888-452a02de0b81" ,
"value" : "e60bd3259177f787718e940c1bb2196ffd3ea0d1f722cc644c85006ddb7a28f3"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, chumarpost@gmail.com) - Danti - Xchecked via VT: 1ba92c6d35b7a31046e013d35fa48775" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208387" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c03-ae98-4185-b4d4-405102de0b81" ,
"value" : "8f2b1de6ef70b1ac5ffb8f3aa77af6c402cfdf56"
} ,
{
"category" : "External analysis" ,
"comment" : "(India, chumarpost@gmail.com) - Danti - Xchecked via VT: 1ba92c6d35b7a31046e013d35fa48775" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208388" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c04-44e8-43e7-b23d-45a102de0b81" ,
"value" : "https://www.virustotal.com/file/e60bd3259177f787718e940c1bb2196ffd3ea0d1f722cc644c85006ddb7a28f3/analysis/1456743780/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, dsfsi@nic.in) - Danti - Xchecked via VT: f4c1e96717c82b14ca76384cb005fbe5" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208388" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c04-9008-43ba-9994-483102de0b81" ,
"value" : "5c28d82f10711adef0b6e04533c0e9170fa4ebe47c9530181239b21126b9c20b"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(India, dsfsi@nic.in) - Danti - Xchecked via VT: f4c1e96717c82b14ca76384cb005fbe5" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208388" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c04-ef20-4fd9-912d-493f02de0b81" ,
"value" : "c4830ed7558cff7abebc15e13fb0a9ad8d1edb71"
} ,
{
"category" : "External analysis" ,
"comment" : "(India, dsfsi@nic.in) - Danti - Xchecked via VT: f4c1e96717c82b14ca76384cb005fbe5" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208389" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c05-7538-4d64-ae0a-42c302de0b81" ,
"value" : "https://www.virustotal.com/file/5c28d82f10711adef0b6e04533c0e9170fa4ebe47c9530181239b21126b9c20b/analysis/1462540391/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(amb.copenhagen@mea.gov.in) - Danti - Xchecked via VT: 1aefd1c30d1710f901c70be7f1366cae" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208389" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c05-4b18-493f-9403-471102de0b81" ,
"value" : "1896d190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b717e51"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(amb.copenhagen@mea.gov.in) - Danti - Xchecked via VT: 1aefd1c30d1710f901c70be7f1366cae" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208390" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c06-8dbc-4313-baac-492302de0b81" ,
"value" : "6793228ee3b6bd1a4bc91f17460b89d12d347fc9"
} ,
{
"category" : "External analysis" ,
"comment" : "(amb.copenhagen@mea.gov.in) - Danti - Xchecked via VT: 1aefd1c30d1710f901c70be7f1366cae" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208390" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c06-c2e4-47eb-bdf2-4bfb02de0b81" ,
"value" : "https://www.virustotal.com/file/1896d190ed5c5d04d74f8c2bfe70434f472b43441be824e81a31b7257b717e51/analysis/1464092908/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(amb.bogota@mea.gov.in) - Danti - Xchecked via VT: 3ed40dec891fd48c7ec6fa49b1058d24" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208391" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c07-d200-400e-b3af-423602de0b81" ,
"value" : "de5060b7e9aaaeb8d24153fe35b77c27c95dadda5a5e727d99f407c8703db649"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(amb.bogota@mea.gov.in) - Danti - Xchecked via VT: 3ed40dec891fd48c7ec6fa49b1058d24" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208391" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c07-6844-4ad1-bba9-41ec02de0b81" ,
"value" : "0e2c603e23219598dc3432d94df6dfae147cceab"
} ,
{
"category" : "External analysis" ,
"comment" : "(amb.bogota@mea.gov.in) - Danti - Xchecked via VT: 3ed40dec891fd48c7ec6fa49b1058d24" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208391" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c07-2530-431c-b761-4dfa02de0b81" ,
"value" : "https://www.virustotal.com/file/de5060b7e9aaaeb8d24153fe35b77c27c95dadda5a5e727d99f407c8703db649/analysis/1464092543/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(chancery@indianembassy.hu) - Danti - Xchecked via VT: aae962611da956a26a76d185455f1d44" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208392" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c08-6cb8-4762-b60e-4f5102de0b81" ,
"value" : "4d5e0eddcd014c63123f6a46af7e53b5ac25a7ff7de86f56277fe39bff32c7b5"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(chancery@indianembassy.hu) - Danti - Xchecked via VT: aae962611da956a26a76d185455f1d44" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208392" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c08-4894-4a04-98d1-444102de0b81" ,
"value" : "8bed9000c2f6347e683beadb1a5d4dedaccbd21f"
} ,
{
"category" : "External analysis" ,
"comment" : "(chancery@indianembassy.hu) - Danti - Xchecked via VT: aae962611da956a26a76d185455f1d44" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208393" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c09-5318-4158-90c5-463502de0b81" ,
"value" : "https://www.virustotal.com/file/4d5e0eddcd014c63123f6a46af7e53b5ac25a7ff7de86f56277fe39bff32c7b5/analysis/1464093143/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (India\u00e2\u20ac\u2122s 10 Top Luxury Hotels) - Xchecked via VT: fd6636af7d2358c40fe6923b23a690e8" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208393" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c09-5ab4-4592-83ed-44b502de0b81" ,
"value" : "6a1706e1351cf911126b0ee57a11ed01135f7d42d911b4067f61067786407e7e"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (India\u00e2\u20ac\u2122s 10 Top Luxury Hotels) - Xchecked via VT: fd6636af7d2358c40fe6923b23a690e8" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208394" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c0a-d480-4a88-9eb0-41c802de0b81" ,
"value" : "415c13cfc0344303fc484c8465f973525975a338"
} ,
{
"category" : "External analysis" ,
"comment" : "Doc web archive - (India\u00e2\u20ac\u2122s 10 Top Luxury Hotels) - Xchecked via VT: fd6636af7d2358c40fe6923b23a690e8" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208394" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c0a-8b3c-4f04-8981-4e9d02de0b81" ,
"value" : "https://www.virustotal.com/file/6a1706e1351cf911126b0ee57a11ed01135f7d42d911b4067f61067786407e7e/analysis/1458811357/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (Mission List) - Xchecked via VT: aebf03ceaef042a833ee5459016f5bde" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208394" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c0a-0800-4d12-8383-401102de0b81" ,
"value" : "785e8a39eb66e872ff5abee48b7226e99bed2e12bc0f68fc430145a00fe523db"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (Mission List) - Xchecked via VT: aebf03ceaef042a833ee5459016f5bde" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208395" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c0b-4ab8-4de1-8259-487702de0b81" ,
"value" : "31b92f816c9f3f45aeb435d47b654cd02c07a633"
} ,
{
"category" : "External analysis" ,
"comment" : "Doc web archive - (Mission List) - Xchecked via VT: aebf03ceaef042a833ee5459016f5bde" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208395" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c0b-8fe4-4a00-9aef-47cb02de0b81" ,
"value" : "https://www.virustotal.com/file/785e8a39eb66e872ff5abee48b7226e99bed2e12bc0f68fc430145a00fe523db/analysis/1464092177/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (HQ List) - Xchecked via VT: c591263d56b57dfadd06a68dd9657343" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208396" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c0c-22e4-4fd4-a42b-45e602de0b81" ,
"value" : "eea3f90db41f872da8ed542b37948656b1fb93b12a266e8de82c6c668e60e9fc"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc web archive - (HQ List) - Xchecked via VT: c591263d56b57dfadd06a68dd9657343" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208396" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c0c-b8c0-4913-a3fa-4d8202de0b81" ,
"value" : "8c248daec675cb873a9ee850336e871dd4642c5b"
} ,
{
"category" : "External analysis" ,
"comment" : "Doc web archive - (HQ List) - Xchecked via VT: c591263d56b57dfadd06a68dd9657343" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208397" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c0d-7c3c-4b38-ab60-4f2402de0b81" ,
"value" : "https://www.virustotal.com/file/eea3f90db41f872da8ed542b37948656b1fb93b12a266e8de82c6c668e60e9fc/analysis/1464091843/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(Holidays in India in 2016) - Danti - Xchecked via VT: d91f101427a39d9f40c41aa041197a9c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208397" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c0d-9d08-4b8d-9245-49d402de0b81" ,
"value" : "ba0b721350a6fcc036b0b78cc13ecb154a4f11d221c1be763ee3c559ef544028"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(Holidays in India in 2016) - Danti - Xchecked via VT: d91f101427a39d9f40c41aa041197a9c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208397" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c0d-3bb0-42dc-994b-410302de0b81" ,
"value" : "9fcf5973260f0c5ca3f95570b76dbaab1a1c28d3"
} ,
{
"category" : "External analysis" ,
"comment" : "(Holidays in India in 2016) - Danti - Xchecked via VT: d91f101427a39d9f40c41aa041197a9c" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208398" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c0e-15b8-4410-8cb7-454d02de0b81" ,
"value" : "https://www.virustotal.com/file/ba0b721350a6fcc036b0b78cc13ecb154a4f11d221c1be763ee3c559ef544028/analysis/1460625569/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(Holidays in India in 2016) - Danti - Xchecked via VT: 8cd2eb90fabd03ac97279d398b09a5e9" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208398" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c0e-8c28-4313-a417-4f5702de0b81" ,
"value" : "bfe23053efd11dbe2d577e25f5d029c0e145f0ef1c14753e03010e95c1d1d910"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(Holidays in India in 2016) - Danti - Xchecked via VT: 8cd2eb90fabd03ac97279d398b09a5e9" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208399" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c0f-6ee4-46f4-8ca7-4a6402de0b81" ,
"value" : "81a82080da14b670a39d5b34728a9e79ba7ccbec"
} ,
{
"category" : "External analysis" ,
"comment" : "(Holidays in India in 2016) - Danti - Xchecked via VT: 8cd2eb90fabd03ac97279d398b09a5e9" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208399" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c0f-5548-4146-9105-42b602de0b81" ,
"value" : "https://www.virustotal.com/file/bfe23053efd11dbe2d577e25f5d029c0e145f0ef1c14753e03010e95c1d1d910/analysis/1463393903/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "RarSFX - Danti - Xchecked via VT: d0407e1a66ee2082a0d170814bd4ab02" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208400" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c10-81f0-4684-8c4c-49eb02de0b81" ,
"value" : "b75ab0079160d388f92e641789415566e0b9e276859ebe3b9d08f074d9d2fd74"
} ,
{
"category" : "Payload delivery" ,
"comment" : "RarSFX - Danti - Xchecked via VT: d0407e1a66ee2082a0d170814bd4ab02" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208400" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c10-ad14-451b-802e-44bb02de0b81" ,
"value" : "eeccda3083a268c377f65574a8e7ac8ceffed20a"
} ,
{
"category" : "External analysis" ,
"comment" : "RarSFX - Danti - Xchecked via VT: d0407e1a66ee2082a0d170814bd4ab02" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208400" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c10-0e94-4dc4-ad53-447202de0b81" ,
"value" : "https://www.virustotal.com/file/b75ab0079160d388f92e641789415566e0b9e276859ebe3b9d08f074d9d2fd74/analysis/1459200615/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Potplayer - Danti - Xchecked via VT: f16903b2ff82689404f7d0820f461e5d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208401" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c11-e8e0-4acd-a9b8-4cbe02de0b81" ,
"value" : "76da9d0046fe76fc28b80c4c1062b17852264348fd873b7dd781f39491f911e0"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Potplayer - Danti - Xchecked via VT: f16903b2ff82689404f7d0820f461e5d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208401" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c11-6bdc-461c-ace8-429802de0b81" ,
"value" : "58b6b5fd3f2bfd182622f547a93222a4afdf4e76"
} ,
{
"category" : "External analysis" ,
"comment" : "Potplayer - Danti - Xchecked via VT: f16903b2ff82689404f7d0820f461e5d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208402" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c12-eba8-4360-8fda-40b702de0b81" ,
"value" : "https://www.virustotal.com/file/76da9d0046fe76fc28b80c4c1062b17852264348fd873b7dd781f39491f911e0/analysis/1459917767/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(appinfo.dat) - Danti - Xchecked via VT: 2460871a040628c379e04f79af37060d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208402" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c12-0c68-4d35-9524-4a8102de0b81" ,
"value" : "904a005e253a723263274c46236739cc907471f597e333836e153da142c62dc1"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(appinfo.dat) - Danti - Xchecked via VT: 2460871a040628c379e04f79af37060d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208402" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c12-3f18-4de3-9ce6-47d002de0b81" ,
"value" : "1cabd426bc1b1825f045c21f6face31a9512a1fc"
} ,
{
"category" : "External analysis" ,
"comment" : "(appinfo.dat) - Danti - Xchecked via VT: 2460871a040628c379e04f79af37060d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208403" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c13-8078-42e0-bc53-4dc902de0b81" ,
"value" : "https://www.virustotal.com/file/904a005e253a723263274c46236739cc907471f597e333836e153da142c62dc1/analysis/1462190688/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(potplayer.dll) - Danti - Xchecked via VT: 332397ec261393aaa58522c4357c3e48" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208403" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c13-2428-4521-8a72-4fb802de0b81" ,
"value" : "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(potplayer.dll) - Danti - Xchecked via VT: 332397ec261393aaa58522c4357c3e48" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208404" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c14-88c0-4ff6-8f31-4c0002de0b81" ,
"value" : "6f10644a4509d6fc8bbefee04db855b43d9f91c5"
} ,
{
"category" : "External analysis" ,
"comment" : "(potplayer.dll) - Danti - Xchecked via VT: 332397ec261393aaa58522c4357c3e48" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208404" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c14-6d70-4035-aee1-4eb702de0b81" ,
"value" : "https://www.virustotal.com/file/705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a/analysis/1463384101/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(update.dat) - Danti - Xchecked via VT: d44e971b202d573f8c797845c90e4658" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208404" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c14-7924-4921-aad9-4fb902de0b81" ,
"value" : "f49bbd7f0ecfa75b134e2cf0acc9931872d79072069f35a49f6de1a0a2347e2a"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(update.dat) - Danti - Xchecked via VT: d44e971b202d573f8c797845c90e4658" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208405" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c15-0d08-4786-9fb2-403e02de0b81" ,
"value" : "af3ae8a6164e31b366ec372d699e1c89ad1b42fc"
} ,
{
"category" : "External analysis" ,
"comment" : "(update.dat) - Danti - Xchecked via VT: d44e971b202d573f8c797845c90e4658" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208405" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c15-2d38-4aae-8764-47ce02de0b81" ,
"value" : "https://www.virustotal.com/file/f49bbd7f0ecfa75b134e2cf0acc9931872d79072069f35a49f6de1a0a2347e2a/analysis/1459239370/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Danti - Xchecked via VT: bae673964e9bc2a45ebcc667895104ef" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208406" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c16-70c4-40f1-8327-4d9a02de0b81" ,
"value" : "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Danti - Xchecked via VT: bae673964e9bc2a45ebcc667895104ef" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208406" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c16-d238-476d-bbf8-4f0e02de0b81" ,
"value" : "f1f895aa6bdb7369525abfb86b4475241e9dbfbb"
} ,
{
"category" : "External analysis" ,
"comment" : "Danti - Xchecked via VT: bae673964e9bc2a45ebcc667895104ef" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208406" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c16-ac98-4a52-bbe2-489202de0b81" ,
"value" : "https://www.virustotal.com/file/67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed/analysis/1464058721/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(mshtml.dll) - Danti - Xchecked via VT: be0cc8411c066eac246097045b73c282" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208407" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c17-48ac-4f94-b9ee-4aa202de0b81" ,
"value" : "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(mshtml.dll) - Danti - Xchecked via VT: be0cc8411c066eac246097045b73c282" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208407" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c17-7b8c-46e3-bbb1-44a402de0b81" ,
"value" : "1a14cfdf652bcd1df572e47ed261abe453a41399"
} ,
{
"category" : "External analysis" ,
"comment" : "(mshtml.dll) - Danti - Xchecked via VT: be0cc8411c066eac246097045b73c282" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208407" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c17-75fc-4e71-bdab-4b7f02de0b81" ,
"value" : "https://www.virustotal.com/file/9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba/analysis/1464058857/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Danti - Xchecked via VT: 9469dd12136b6514d82c3b01d6082f59" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208408" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c18-384c-4f96-ab3c-4dd102de0b81" ,
"value" : "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Danti - Xchecked via VT: 9469dd12136b6514d82c3b01d6082f59" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208408" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c18-6224-4072-81e8-449a02de0b81" ,
"value" : "47a963e7588e9af060dfac62b94076f270d4008e"
} ,
{
"category" : "External analysis" ,
"comment" : "Danti - Xchecked via VT: 9469dd12136b6514d82c3b01d6082f59" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208408" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c18-be9c-480a-9fab-477502de0b81" ,
"value" : "https://www.virustotal.com/file/2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18/analysis/1464079999/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(lsass.exe) - Danti - Xchecked via VT: 8ad9cb6b948bcf7f9211887e0cf6f02a" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208409" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c19-a3dc-4911-bf50-451e02de0b81" ,
"value" : "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(lsass.exe) - Danti - Xchecked via VT: 8ad9cb6b948bcf7f9211887e0cf6f02a" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208409" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c19-4c04-4e65-9eb8-445702de0b81" ,
"value" : "0246a237b281162059b84f1bc013d90bbb4104f7"
} ,
{
"category" : "External analysis" ,
"comment" : "(lsass.exe) - Danti - Xchecked via VT: 8ad9cb6b948bcf7f9211887e0cf6f02a" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208409" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c19-456c-494a-b765-4fa102de0b81" ,
"value" : "https://www.virustotal.com/file/38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f/analysis/1464170885/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(http.exe) - Danti - Xchecked via VT: 3fbe576d33595734a92a665e72e5a04f" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208410" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c1a-ad58-4ef9-bb4d-4ce002de0b81" ,
"value" : "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(http.exe) - Danti - Xchecked via VT: 3fbe576d33595734a92a665e72e5a04f" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208410" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c1a-c00c-48cf-8d94-483202de0b81" ,
"value" : "fe48b93058cf7e0ff9c27ec9322015d230545646"
} ,
{
"category" : "External analysis" ,
"comment" : "(http.exe) - Danti - Xchecked via VT: 3fbe576d33595734a92a665e72e5a04f" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208411" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c1b-cd80-4797-980c-46c902de0b81" ,
"value" : "https://www.virustotal.com/file/ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666/analysis/1463728182/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(dropper, from cab-archive) - Danti - Xchecked via VT: 6bbdbf6d3b24b8bfa296b9c76b95bb2f" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208411" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c1b-0ef0-4c52-a04d-420202de0b81" ,
"value" : "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(dropper, from cab-archive) - Danti - Xchecked via VT: 6bbdbf6d3b24b8bfa296b9c76b95bb2f" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208411" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c1b-d1a4-49fe-960a-415b02de0b81" ,
"value" : "469abc3cf1e3b871566cf404c1e382a5b7a20212"
} ,
{
"category" : "External analysis" ,
"comment" : "(dropper, from cab-archive) - Danti - Xchecked via VT: 6bbdbf6d3b24b8bfa296b9c76b95bb2f" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208412" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c1c-1fbc-4beb-b6f1-433a02de0b81" ,
"value" : "https://www.virustotal.com/file/9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b/analysis/1459335213/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Taiwan, 1-3\u00e8\u00aa\u00aa\u00e6\u02dc\u017d\u00e6\u00aa\u201d.doc - SVCMONDR attacks - Xchecked via VT: d0533874d7255b881187e842e747c268" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208412" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c1c-51d4-43cf-a490-4a5702de0b81" ,
"value" : "d903ecebede658ff6d7c930f22378bb7471a940632cd59d196f0e8a44ecdb7e2"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Taiwan, 1-3\u00e8\u00aa\u00aa\u00e6\u02dc\u017d\u00e6\u00aa\u201d.doc - SVCMONDR attacks - Xchecked via VT: d0533874d7255b881187e842e747c268" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208412" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c1c-ac6c-4ceb-bab8-4ab902de0b81" ,
"value" : "8cca13ea2381b50be9880047d504d9bc423c1102"
} ,
{
"category" : "External analysis" ,
"comment" : "Taiwan, 1-3\u00e8\u00aa\u00aa\u00e6\u02dc\u017d\u00e6\u00aa\u201d.doc - SVCMONDR attacks - Xchecked via VT: d0533874d7255b881187e842e747c268" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208413" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c1d-a1f0-47c5-9029-4f7502de0b81" ,
"value" : "https://www.virustotal.com/file/d903ecebede658ff6d7c930f22378bb7471a940632cd59d196f0e8a44ecdb7e2/analysis/1456452590/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(svcmondr.ex,Thailand) - SVCMONDR attacks - Xchecked via VT: 046b98a742cecc11fb18d9554483be2d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208413" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c1d-6c8c-4374-911c-492602de0b81" ,
"value" : "ee6cfaa117cce98abe49ae0c3c848bc5669dca53e8219ee6a338491393799118"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(svcmondr.ex,Thailand) - SVCMONDR attacks - Xchecked via VT: 046b98a742cecc11fb18d9554483be2d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208414" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c1e-23bc-4d2c-9338-4e8102de0b81" ,
"value" : "fe54fd458dcef3f120c71c7818ddd5a6d6731c29"
} ,
{
"category" : "External analysis" ,
"comment" : "(svcmondr.ex,Thailand) - SVCMONDR attacks - Xchecked via VT: 046b98a742cecc11fb18d9554483be2d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208414" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c1e-7f14-4a52-bb7d-4d0e02de0b81" ,
"value" : "https://www.virustotal.com/file/ee6cfaa117cce98abe49ae0c3c848bc5669dca53e8219ee6a338491393799118/analysis/1462817646/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(svcmondr.ex, Taiwan) - SVCMONDR attacks - Xchecked via VT: 8052234dcd41a7d619acb0ec9636be0b" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208414" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "57460c1e-16fc-4357-bcfb-4d2002de0b81" ,
"value" : "12ca6760857d1bb0751c3e108d4175ebcbc9688cfecad0db189efc56b0ff9768"
} ,
{
"category" : "Payload delivery" ,
"comment" : "(svcmondr.ex, Taiwan) - SVCMONDR attacks - Xchecked via VT: 8052234dcd41a7d619acb0ec9636be0b" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208415" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "57460c1f-8cc8-4e06-afc4-423202de0b81" ,
"value" : "a512228f9499a96d7cbf027854a04032d742fd6e"
} ,
{
"category" : "External analysis" ,
"comment" : "(svcmondr.ex, Taiwan) - SVCMONDR attacks - Xchecked via VT: 8052234dcd41a7d619acb0ec9636be0b" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1464208415" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "57460c1f-764c-49a1-869f-44fe02de0b81" ,
"value" : "https://www.virustotal.com/file/12ca6760857d1bb0751c3e108d4175ebcbc9688cfecad0db189efc56b0ff9768/analysis/1464134416/"
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
