2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2017-02-05" ,
"extends_uuid" : "" ,
"info" : "OSINT - From RTF to Cobalt Strike passing via Flash" ,
"publish_timestamp" : "1486315504" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1486315427" ,
"uuid" : "58975d16-ec0c-4d21-88bd-41eb02de0b81" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#ffffff" ,
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315015" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975d3c-caf0-4a77-9002-4b8002de0b81" ,
"value" : "https://zairon.wordpress.com/2017/02/05/from-rtf-to-cobalt-strike-passing-via-flash/" ,
"Tag" : [
{
"colour" : "#00223b" ,
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#0c9100" ,
"local" : "0" ,
"name" : "admiralty-scale:source-reliability=\"f\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486314833" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "58975d51-c544-4264-afff-04a402de0b81" ,
"value" : "Quick Sunday morning blog post, analysis of an unknown rtf file. This article is a result of an initial investigation, no attribution is done but you\u00e2\u20ac\u2122ll have all the necessary info for a deeper investigation.\r\nThe malicious document has SHA256: 5D9E1F4DAB6929BC699BA7E5C4FD09F2BBFD6B59D04CEFD8F4BF06710E684A5E.\r\n\r\nAfter a first glance I thought to know what\u00e2\u20ac\u2122s behind the rft, but running a specific script I got disappointed by the result. For a quick response, a submission to a sandbox could be the best option you have, but you\u00e2\u20ac\u2122ll miss all the fun! I decided to manually check using an hex editor because it\u00e2\u20ac\u2122s incredible how you can extract objects in a fast way."
} ,
{
"category" : "Payload delivery" ,
"comment" : "malicious document - RTF file" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315351" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975d66-bef0-44f2-9073-444502de0b81" ,
"value" : "5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Extracted payload from RTF" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315352" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975da5-2764-4039-8d46-408302de0b81" ,
"value" : "4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Network activity" ,
"comment" : "Cobalt Strike artifact url" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315403" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "58975dc4-52e4-489b-bf43-409202de0b81" ,
"value" : "https://193.238.152.198/OeeC" ,
"Tag" : [
{
"colour" : "#7000b4" ,
"local" : "0" ,
"name" : "adversary:infrastructure-type=\"unknown\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Cobalt Strike" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486314949" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975dc5-8268-450b-850d-461c02de0b81" ,
"value" : "2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486314995" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "58975ddc-d404-4a6f-8e95-4b6c02de0b81" ,
"value" : "193.238.152.198" ,
"Tag" : [
{
"colour" : "#62009e" ,
"local" : "0" ,
"name" : "adversary:infrastructure-state=\"active\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315352" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975e36-6cb0-4f7d-ad7a-4a0b02de0b81" ,
"value" : "7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315353" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975e36-b704-437c-9c38-4ca302de0b81" ,
"value" : "08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315354" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975e37-51e8-49c6-a2b1-403302de0b81" ,
"value" : "8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315355" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975e38-9bd0-4bf4-9a87-415b02de0b81" ,
"value" : "9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315355" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975e39-5fa4-4cfd-abff-4c0702de0b81" ,
"value" : "21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315356" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975e3a-5940-400e-9815-43e202de0b81" ,
"value" : "af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315357" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "58975e3a-06c4-451d-b8db-475e02de0b81" ,
"value" : "cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2" ,
"Tag" : [
{
"colour" : "#00add3" ,
"local" : "0" ,
"name" : "veris:action:social:vector=\"Documents\"" ,
"relationship_type" : ""
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315427" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fa3-9c0c-437f-997b-402902de0b81" ,
"value" : "862b1f9115c757e27d8c68f4a50341dbab1b15b1"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315428" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fa4-1374-4b9b-baee-459f02de0b81" ,
"value" : "6fdcb2847df6939f1e73c68d5cbd573f"
} ,
{
"category" : "External analysis" ,
"comment" : "Possible related rtf file - Xchecked via VT: cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315429" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fa5-87dc-4cce-a592-48bf02de0b81" ,
"value" : "https://www.virustotal.com/file/cb743f5057c77069a10ecd9e6b4fd48be096b1502e9fb3548e8a742e284eeae2/analysis/1486307052/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315430" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fa6-5168-4935-9c13-4ea002de0b81" ,
"value" : "e46e43116e35581eaeb26eee22d36bbb6bde032d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315430" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fa6-b790-4925-b617-423002de0b81" ,
"value" : "bc68d2a2b56789cf399e7530f1352fdc"
} ,
{
"category" : "External analysis" ,
"comment" : "Possible related rtf file - Xchecked via VT: af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315431" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fa7-004c-4268-a8d3-41de02de0b81" ,
"value" : "https://www.virustotal.com/file/af178ff11088ff59640f74191785adf134aee296652080f397cf282db36fad46/analysis/1485937101/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315432" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fa8-f164-4057-a063-413f02de0b81" ,
"value" : "f8bf4c87ec8eabad4dbf916328f50b02a5898c00"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315432" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fa8-2e30-4a60-b6b8-411102de0b81" ,
"value" : "3d4f5b714a19b7545e57743ee0003337"
} ,
{
"category" : "External analysis" ,
"comment" : "Possible related rtf file - Xchecked via VT: 21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315433" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fa9-aea4-4c97-9fa7-481702de0b81" ,
"value" : "https://www.virustotal.com/file/21dda5c82e5aa5c8545b96dc2d6d63e6786fea73453f5acaa571fd5c0466363d/analysis/1485331419/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315434" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975faa-65d0-4034-bbee-440c02de0b81" ,
"value" : "c51a1ef7e599150437fc8947d94e6d9edea18be6"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315435" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fab-0564-4123-879b-491902de0b81" ,
"value" : "fd3f5a495a8d573f9b6add69a6af9b7d"
} ,
{
"category" : "External analysis" ,
"comment" : "Possible related rtf file - Xchecked via VT: 9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315435" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fab-1eb0-49aa-88b8-46f802de0b81" ,
"value" : "https://www.virustotal.com/file/9c7208c5c0d431738c8682cf6a2bd81df66977cbabffa0570f9d70518bece912/analysis/1485841113/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315436" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fac-a404-4333-be15-410102de0b81" ,
"value" : "a963103fb9802a59c99f0ced333586a33f1f5d5d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315437" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fad-d3d4-4eac-aaab-4c0602de0b81" ,
"value" : "a5a507f41a217097d6394256ee401977"
} ,
{
"category" : "External analysis" ,
"comment" : "Possible related rtf file - Xchecked via VT: 8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315437" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fad-3aa8-4fd0-af23-4cb502de0b81" ,
"value" : "https://www.virustotal.com/file/8e27a641684da744a0882d3664cf84d5a88b8e82ac0070d3602af0b7c103eeeb/analysis/1485962308/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315438" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fae-d838-4f3e-871c-4e8602de0b81" ,
"value" : "463344f0ad46323fa191237db21e8e46a019fbfc"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315439" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975faf-f7cc-470f-82fd-42dc02de0b81" ,
"value" : "60cab9d4211216b82e6430a7c51157fa"
} ,
{
"category" : "External analysis" ,
"comment" : "Possible related rtf file - Xchecked via VT: 08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315440" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fb0-40e8-4db7-88e6-45d302de0b81" ,
"value" : "https://www.virustotal.com/file/08c9bd7b7b8361c5d217570019ff012773407337c9083910f2ae3a09b5401345/analysis/1485865450/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315441" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fb1-fb64-4fb9-a961-4ef202de0b81" ,
"value" : "c90fdf1e20aa39cd84479543101d2b4f299b3485"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Possible related rtf file - Xchecked via VT: 7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315441" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fb1-7c74-45ff-a4b8-4f6d02de0b81" ,
"value" : "b254fe605efdcc2aa235d431b1a30fa9"
} ,
{
"category" : "External analysis" ,
"comment" : "Possible related rtf file - Xchecked via VT: 7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315442" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fb2-e3f4-4538-93cf-41e402de0b81" ,
"value" : "https://www.virustotal.com/file/7a63fc5253deb672036e018750fd40dc3e8502f3b07ef225e7e6bc1144d1d7ee/analysis/1485428950/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Cobalt Strike - Xchecked via VT: 2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315443" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fb3-05dc-4249-a5d7-44b802de0b81" ,
"value" : "2ee7db02a2a0a7b0666fe544d803384cbbdfba9c"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Cobalt Strike - Xchecked via VT: 2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315444" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fb4-8fac-4a73-b782-495502de0b81" ,
"value" : "992722358935ce18c759333fee0588e0"
} ,
{
"category" : "External analysis" ,
"comment" : "Cobalt Strike - Xchecked via VT: 2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315445" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fb5-2fb4-47cc-bc58-45c802de0b81" ,
"value" : "https://www.virustotal.com/file/2fa6ec644b0a05c0cbe7ebaf4cc4905281e65764e91ed299d5cb3f54ab4943bf/analysis/1486218685/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Extracted payload from RTF - Xchecked via VT: 4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315445" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fb5-da7c-413a-bf5b-4c9c02de0b81" ,
"value" : "b7b53be3e38408ca9c0269cace71ae23994f168b"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Extracted payload from RTF - Xchecked via VT: 4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315446" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fb6-508c-4404-b75b-463d02de0b81" ,
"value" : "6faf7bf340105e5a119520761149c13f"
} ,
{
"category" : "External analysis" ,
"comment" : "Extracted payload from RTF - Xchecked via VT: 4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315447" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fb7-7838-40f2-a5e6-457002de0b81" ,
"value" : "https://www.virustotal.com/file/4c72df74a1e8039c94b188f1c5c59f30ddcc7107647689e4d908e55d04ff8b52/analysis/1486194786/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "malicious document - RTF file - Xchecked via VT: 5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315448" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "58975fb8-adc4-4972-a42a-4de302de0b81" ,
"value" : "7fe6cc2412b97fd27ca1bfb42ac811933c948f61"
} ,
{
"category" : "Payload delivery" ,
"comment" : "malicious document - RTF file - Xchecked via VT: 5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315448" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "58975fb8-2444-468b-916a-4e7702de0b81" ,
"value" : "81f829be44598ccf33382920f2597104"
} ,
{
"category" : "External analysis" ,
"comment" : "malicious document - RTF file - Xchecked via VT: 5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1486315449" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "58975fb9-63ac-4da5-a0b2-4fc702de0b81" ,
"value" : "https://www.virustotal.com/file/5d9e1f4dab6929bc699ba7e5c4fd09f2bbfd6b59d04cefd8f4bf06710e684a5e/analysis/1485944570/"
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
