2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "0" ,
"date" : "2017-09-08" ,
"extends_uuid" : "" ,
"info" : "Malspam 2017-09-08 - 'Microsoft Store E-invoice for your order #'" ,
"publish_timestamp" : "1504883477" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1504883454" ,
"uuid" : "59b2af44-f68c-41ab-869e-7f0b950d210f" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#0088cc" ,
"local" : "0" ,
"name" : "misp-galaxy:ransomware=\"Locky\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#ffffff" ,
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
} ,
{
"colour" : "#3a7300" ,
"local" : "0" ,
"name" : "circl:incident-classification=\"malware\"" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "Network activity" ,
"comment" : "initial download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882656" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59b2afe0-db84-4377-9d06-7920950d210f" ,
"value" : "http://brandingforbuyout.com/3936jkgHGdcm"
} ,
{
"category" : "Network activity" ,
"comment" : "initial download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882656" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59b2afe0-b0e8-4ed3-91d1-7920950d210f" ,
"value" : "brandingforbuyout.com"
} ,
{
"category" : "Network activity" ,
"comment" : "initial download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882656" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "59b2afe0-c518-4444-b4ee-7920950d210f" ,
"value" : "74.208.163.59"
} ,
{
"category" : "Network activity" ,
"comment" : "initial download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882656" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59b2afe0-3ca4-4f65-badc-7920950d210f" ,
"value" : "http://etforhartohat.info/af/3936jkgHGdcm"
} ,
{
"category" : "Network activity" ,
"comment" : "initial download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882656" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59b2afe0-4ab8-4279-8e4e-7920950d210f" ,
"value" : "etforhartohat.info"
} ,
{
"category" : "Network activity" ,
"comment" : "initial download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882656" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59b2afe0-fb0c-43c6-ac5b-7920950d210f" ,
"value" : "http://lagrangeglassandmirrorco.com/3936jkgHGdcm"
} ,
{
"category" : "Network activity" ,
"comment" : "initial download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882656" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "59b2afe0-142c-4994-a68b-7920950d210f" ,
"value" : "lagrangeglassandmirrorco.com"
} ,
{
"category" : "Network activity" ,
"comment" : "initial download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882656" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "59b2afe0-2604-4bc5-baf9-7920950d210f" ,
"value" : "65.182.175.15"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"data" : " U E s D B B Q A C Q A I A E t 3 K E s d b 0 F g P 3 A I A A B Q C g A g A B w A N j N l Z D E 1 N m Y 4 Z D J l Z m F k O D N j Y j J k O D M 1 Y z M 1 N z V k M T Z V V A k A A w 2 w s l k N s L J Z d X g L A A E E I Q A A A A Q h A A A A z P w X 7 C n Y X D u H Y e 8 E a P 6 + Z E B 0 93 t J l i J D 4 F w 6 S z 9 P A O D G r X E l P P 3 M S v V s 8 Q S 9 r 9 O E F O d G W 3 w K U D + u m 6 y b j s W 7 X J s y 1 D T x I s d 8 R Q 7 y 76 C F P N A C P L g y z 6 x T T / V v f g C 3 u 9 r Y c c r c D w D g n 1 V m P T y + s D D v P D G n y k 4 Z u V a T N K t E o 0 5 x d H A s A G F l O Y L r t l s l C K b R v j g x E o v f v 7 o i i H x Q c u S x n z t + p 71 V X v k A x 6 R G + C K 6 E c z q 1 z p z z P S E / G a 8 X W 3 o 6 l w N D i h w B 31 m Z D L Z H 5 J / 9 J X / 1 k 0 g 8 o 2 t k i R r y E 1 a Q / S S h r E u S M x 28 b L T V P n S m q U O w s Q J c b M 5 w p 2 F V C M j h Z 0 8 / B W V O / O 5 n C 38 q 8 t k 31 n V 2 d B Z f 0 N e I W s j R J e 7 m j x X b z 1 x N x R T / x 2 Q Y N n c P D c d C q x S 33 B / i 20 S w R Z h T G O s g j T r Q e S O f O 4 m 9 n P N Z j t p n R + y K a 5 L c N o N r s i V W W k / R j A r p 5 h R S s R s c X d o y j w P 67 S U V q 3 x U J v F + D v 2 O e o n R X s 0 G J Q h v n 4 l J X t Z 1 h x T A t g 46 l U l E i O t K v k D b N h u Z v U 944 w / S C K f I s I B j 7 X M 1 W K 6 T W k Q 6 K a o W E H 48 G g 0 X m 52 x O + 2 t k Q 1 n z r 2 f n h C 9 c T c L m l Y K 6 C 4 j T S j 68 r G K C v Y f y f 9 R K E s J L R y 5 m u a 2 k i + 7 / j j d o B K N k C z 9 z 4 O r 4 P G M P 6 o 9 h 8 L v W g 61 E Z x N 6 + x O O R i w v 9 i M U 2 r 7 S b Y f X q + J X n 1 E s d t M R A 5 M I l n F j w a N p F Z z O h e + l S e 9 k p s r v v 77 Y g Q W j F D / I p j S z E o 2 Q q d c l 7 n e X N Q 4 j w u e 93 f 7 P e U U n l W E s e Z / u 630 J z a R b Q k 0 y p A U q f Q d t + V Z R 2 l S T Q L G 4 C x o 6 n 9 D 2 k q n b q 5 J 2 w 3 F C x p T N H J j R a u l R G e 8 d U U c f Z o E G J q X m C Y 86 L G d V G 38 P I I f O s z O A 0 b q f s 9 D j g F 5 z m Y M d d Y P z D x t b 7 i N k a m T o D T M y V h h 2 z B h Y K u d v W g g J R W R / S + L n E v F 3 / Y t r D L x z t y U H Q H Z O e z T y s S 0e2 S 5 k W Q j y X c t I t m 4 f b 5 M f o k k t I n y M r 5 Q M 1 q Z t H M g b b q G 5 l Y 5 T 5 A j U z V G d D P x Y 3 B t s G x W K R w m 6 h K r 5 E M B m Z E W 6 h A z 8 J 5 I v C m W 1 O Z m K G X b L g K d H N 5 G f z 7 e W w g F B T 4 c W Q B M V l C Q V A j w Z a h 2 F b Q r + 1 i A b 8 H f Z C I 37 A o 4 m z S c / D r i S V r r o W U 5 z 5 U j j 3 y + V L u 6 t 0 d K 1 s a 5 e m 8 N g 2 W t r S J U S 2 d z Y o Q I 7 G 9 W v H K X G 4 J i Z z Z Y K T g 3 z S 99 h S e p p U m k n T y d n G L D M w w v G v s e Q d N U / m c E 3 k D x 8 M Q 11 n I C i k h B p N m J V q J 5 U X W t 9 W g d 4 m L o U X W l r 2 P a 6 J p p 1 U m R e y p z + c b W V 5 w c Q e 9 F M v O N 2 C f W o 0 P r W r H G 4 P V v F V 3 p h v 38 z U 5 D 6e1 V s l u i 3 H v w 2 Z / r 3 K i P s R c p G 4 o w q p v 5 n y + f G + t h t 7 Z m a o p c N T S H N Y 1 K 20 u E N G N c p Z j X 3 o a 9 i o r x u G X V j 4 H p b m i f y 43 J A 7 G d 2 w Q z S z d H b a d D s 2 M g y Z a j 5 Q Z c k w 0 z v 3 C R W G A U j K r U c w R 4 c z A C S 3 A m b a H C J + Y 4 t j W x I E F R c j P w T C Z i z k L G d y 2 u J m k I W x l S G 9 V I x Q 6 R x I t n L k 0 n P p s T m S E K N F L 6 D G b g J O m Z M i H 53 T H A v g f m P A A m x 7 G a O y v S k p c c y n 6 r o 5 p e 8 V R e e v G n W 8 Y H w L e o n 7 l L o t / S 4 q 2 S z B K y Q Q c y u 7 e K 66 O g F R j 2 R T s L a 9 i O U u 7 X T 6 s V L + R R T u 5 P V t a U L / Z 1 H 9 Z A e z G m m G Z N f g a d a K K G U h 5 b 6 k k d c + 0 s G + D E K m A / o 9 y u 7 E k o 3 f f 2 w P Z z a 2 E O k / h 72 v X Q m 2 W g n c M 15 E J g R u 2 O m 0 D Y 1 V l g X c I l F W / A p O M Y v o U o 0 s 7 v a D V j 4 + Y y C u k M 93 C + / p G L b r N + U 6 E T S X 7 Y T i p L P S P U o H h u d C O O b c E U j S U + E s / Y a q 8 H O / T y w + n L f F y b x 2 F 1 F e b J h I 8 f 1 Y X F S i X m V h n + c i 3 k Q 8 p e 4 H M a V b q D c T J U i M 3 c 1 u m O G u m b k L m x J 60 r s z H B c c L o 0 4 T y n B f 3 s o o 1 P P s C I v U T H U H j E k u k R b r w q 9 k j n 8 g l T d x s j H u L / O C h n f s V 2 h A M y q 3 i P o k 8 p x c e 1 w 1 d p P S t r H / X X 1 G 6 L W O 4 I 2 V U v H D l j B r 4 Y K X b V N j N n H + e 6 W U + H a 6 U U c Q n Z U f y / b e U p E t M H 6 y u 4 W h Y l E / r d t y V F 6 v f 40 N q v 4 E z S + s u D I k d C z h i t O r + w H w b v K 26 s a q c z P N m w 13 o 70 F 4 d S b b l h G x o H C D 7 d t C 3 x f 7 V Y 94 i N 3 i t c F 9 K h y p N E o 7 w S h g t L W x 0 H 1 h n X m u b u O 6 T K N Z t F l E Q D t u L h r L L z T x + 9 m C A F 1 F p 8 I Q Y V J p I f 3 + I 5 Q 2 F s r D c 9 K o Y b q P V q R O t G I O W + h N H Q s d 4 s Y H G x 4 H M G M Y i x T j F e R S 2 d r A O t 7 V v i 6 c l B 5 x / g s 7 q 9 K i L f Y n R l Y j 2 J h Q f Z x 0 Q T X + b f 4 l K p b o s N X e t e C M R S a Z A N 12 I T 3 a z g K A q 15 L h j T B q X o i Q m W s h j S a a K y w 7 r a e D b w X V F G y a 6 D H n j r C k L U 7 A Q j i j Y t B 2 l q 9 m f k n Y d N e g O D 61 X A 6 W 5 y H B O A E u F N 6 g t v Z a S / O V H Q t 2 Y J w / c N M j z E P r a L D a 5 D 2 o e d d T a t t B z a g e l L 3 C N Q / T Y M C a 1 S 64 D P B 2 s C z M W 6 m H b S m D J 7 D w + T H + q i r B x A i j d X o N X i f X A / 3 w e X + v n 8 Q c j Y L 5 o u S + 7 o t V U 5 Q s A J Q Q j P B O r 1 A / U R S d k K h l H l N g T W u D K 8 j S n 0 l p Q L i l J e 0 L w 87 L X a / H + Y y S J F l m I e 5 q E X S k x P j A s 74 y Z a x E M y W n 1 K M m a Q o R e F a N F O b + q h h y m 1 C R N z m t w J / P W w h P + U 7 m y D n s q F t f y 5 A 2 w r 4 W A n L w r g L 48 d O a O X 0 k 2 f p B N S E n t 7 y V j M P A m / b o z y + Y Y O U j G m A y 84 V o / 8 S P r K R 4 T T I J X q W d T Q G Q p l e m E B D O X k Z E Z V 5 N j y I y q o G y v s t 9 v H T A l J K R c V q 9 w y D Y J 0 i S V 8 g V d A q E 8 J j N C F y / p w O o 8 Q 6 o U T X 8 l d M 3 f 4 G y Q Y n I E J N 7 F 5 o 4 s O B B w L W d a j X R C y w g b y I p I / 7 k Q S 6 o q v c y / x 1 C Q w F S + 0 H 4 Z / F l g f b b c q p a / G q k T 7 T R T w S l o e W M u 1 Y 1 m h M J s f a 5 M G I J G 5 x v g c S y J / E 6 d C j T G 8 e n F c 7 Y K t V Q 0 i X Y 79 R 7 / H J V o J F N A c C C s 2 l + W F 1 g 2 s H 0 E V R G V Z h j L Y G d c Q d S t V Y f E G v m 698 a L u 6 e G g S a U M P s G E R S 24 R o 1 B K U 0 h 4 q / c / q K s U R y 9 w Q 46 t N 3 w + g v X c S B / D E A S L 0 v N X + 0 / G q / w d m 4 S F + 0 a 5 a L G n l v x i u e O w v J Z X P s 8 C p d G X H c V Z 0 4 X u h d q d 27 X Z O a 4 t C Z m d Q r H u + 4 y o 2 b o 8 G b 3 v f c a X g d 2 + q L Q d 5 / n w t A 5 S I / 5 G 1 l t N C y m 0 h k Z 7 / M j j b 6 f z G o i i 6 Q n o z 4 x g I G I 5 c q W u h u 8 x r C n q c v u x l X S L P Q d N J z A 7 u x w 4 w z L u + G 70 f k L W y V o f m T r a B t V M b y S j p v Q K 148 m 98 s g J I V u 9 Y u Q q z n a k B B u U C p 19 J 8 F i i G 6 / L 4 U j W O p T B 4 y 3 O / G U / S l 1 W Q l S o n J T / A L H R g f d C V V 7 T 7 X D z n Q u k G d K Q y y S U i G R 93 a l j s 9 M D l i + 4 u 9 f A l t 9 A q / s a S N g h e J D g p V P 8 X Q g C s Z 8 l L V u 8 N e Y x Z S s W 3 z i J 237 v w M / U Y e 0 o 54 O b s 8 E I r d l h g C e K i U u T n H Y T w z J u 5 s J p L F d / y X M 8 d z 4 B y F B 32 y D T 5 F i Z K i 0 b K f Q v u W M F R G D F 8 S w W g 3 a t 5 B p d n G M g B e s 4 Q V u p 2 V d n J B U G 3 z 686 m t k b 6 x N 4 f v O g m R j K A G U w / S 4 v B + q 6 G 8 j j G p m O O 8 p g v h y t p d o f u C F 8 L z v n Y r D Q S J w 2 F 8 T 7 q h s I + x t n I a k 8 o 4 L V q 7 O 9 o L S B B L F k 28 G M Z / Z Z f E G G w h x j I P 20 B F 0 q 3 G D E C o T p d X I Z y R A 0 f E m T B o t u 6 A 271 n D u R d K X y B A L G p / Z N Z M k 2 t R U b K A d 1 K G M M J l V g x z W P w X l J z c 2 b U o B Q 2 c y o 4 C v V I p 2 t y e J v m S 1 z 2 U h W F 7 G f P a K h A S p T R D P S K J k m z N Z a 9 z I X V D 9 T M x k 0 P 3 C O 7 u Z O H K x r v / o s Z u x E + d V L a T r P y D q W 0 2 x 0 5 F x N m Z G v a F U x w c e 3 v y E W 43 U a k o 6 T E G G r o
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "malware-sample" ,
"uuid" : "59b2b00d-37f4-4833-b599-2ae1950d210f" ,
"value" : "3936jkgHGdcm|63ed156f8d2efad83cb2d835c3575d16"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "filename|sha1" ,
"uuid" : "59b2b00d-d730-4088-9ecf-2ae1950d210f" ,
"value" : "3936jkgHGdcm|e599e64297c3525742611b18a8fb1a4a7ceb8c15"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "filename|sha256" ,
"uuid" : "59b2b00d-3d10-4e21-bcb6-2ae1950d210f" ,
"value" : "3936jkgHGdcm|3e1924867806778624d231df10928d4d4deef2b3f24de5505f624ddde7d33636"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"data" : " U E s D B A o A C Q A A A E t 3 K E t u a l W b e w 0 A A G 8 N A A A g A B w A N z c y M j Z i Y T l k M W M 0 M T V h Z W I 4 N W J h Y m R i Z W M 2 M j Z j N j B V V A k A A w 2 w s l k N s L J Z d X g L A A E E I Q A A A A Q h A A A A F k i O m k z k x k 3 x v r t t V + J K f r u A K x L 3 Y A k 2 G F V H i Q q u z l C 0 m a d M V W O c O O 0 T U g z n X F a Z w a Y x E Z 9 L E o U N O w / U w 9 c f k Y u e C o I k e n Q h T R K p J I 7 y s f 6 d c O P N 1 c D K n V 6 L w C H y T p Z Y 9 + H 8 G v K 5 c s p T L q j e M 5 a G m 6 v q 3 F z S o U u F D Q 3 / d 22 T I J S 7 s k y a i x B g s o T n h p X o + K j z q / A + y Z m x Z y g u 8 b 1 N E g X L F j g R 6 J U I n c 0 9 + q n 32 i k C M L D 2 + 5 K q s h 7 v N G a U Q z f y T a 9 c l H d 0 F f 16 U f S N b N n o S 9 Q y V y j O 0 1 p y i p B 7 G q u q Y w k V v j M z 0 x m Z x A k Y 3 I 7 y N p v u h 4 x i F j j s 6 I k U J T B G 7 j 6 i Z o u L 0 H 3 Y u 3 P 1 T C 5 h R g m r 1 i b 3 w k 1 P f D d 3 R y 1 Y Y j n K O q u q 4 C c a F A H U 2 t J 7 W O 2 A 8 X V + T w L I G 35 G d R b p A T N z m y q O G t 8 Z I 5 K a + c r e 2 a y F M u k A X r T W 2 s A T P e l U S S a d 346 A i 1 m c k B K F b m 53 y Y 2 D S p H O d E r P 58 G k F K t / R n a r y g t f w U U 9 R n z u u E o 2 k s A l l T e N 50 + 38 C K d 701 X 93 W 89 d O q B Q p 4 A p Z y C 2 w + j K U V f J U u Y C S f F R E o F d E L Z c H 1 N 8 e V c h D m i x 5503 O g t s u y K 4 x 6 b 1 + 5 Y N o h D u X f i c U A t 9 A B h F 4 j 2 f V Q Z R T R V e J r 23 u X N 7 o y s / K 7 c Z C d k F 7 P B 6 h A / F l C 0 D Y 353 u S b H 8 H E T j k Q w J e h x + T g r i 86 H i T S A H t u v p A 215 O g n O X P Q A X M 1 D w z w 8 Y 1 I p i H P H L J r f l 1 o u N w 5 Z h F j l i a o H C h u 4 g 18 r q T r V K I X F / D q F 2 F I f a 9 u c 5 z k 2 Y e L M 6 G 9 F G w c E K r m w Y r E / x H 54 / A J m j K B 2 c b 2 S / Y B e a y Y a l O m U 4 J j X g B q i / a p Q F A j Y H Q e l c l r e E K Q O v 2 W D y W f 9 n D c e R F b 4 K K z n C u L p c G i R f S f b Z r n x c Y y f G O k c / H Q Y T Z E 8 n i X 1 i b u b e 7 S H z D 94 M d X H Y Y 7 z A 3 j I 2 k T a h I B V S O k l r t S f d 7E3 Z / 6 B 6 W s 0 q Y Q H x e Q V 7 P e h P d N G + Q 9 I j Q o R a U O L Y 9 x k J U S W Q O t A g m b 4687 Y r S m s V c 7 R 5 c o q 3 d k j N Y V 2 D U T e u W 4 G l N q k V j B H u L y m q e A N + t q b n i 10 z o L f J 353 n f Y f 9 g R R I q E Z Y Q I W l y C m 6 + r H D h W O v 8 Q u K Y y 8 Z w b y K 5 q T 2 H g s t j Z O N 8 s T X 3 x a s o 4 w / x 4 M C v B l V W Q d 1 j z S E 8 t T n b h Z Z L h O / q D 6 c i v H V U C H b A L Z g p d C D O G k U H b Y C / u + X z x E H j / F p 8 d Y q O O 6 K R E G 0 q D u f K h B U F I v 2 L l J L A H f 7 k g S S w t I G 1 A e q X G m K T 6 h 89 / a P 8 t B U 10 K i 1 b 21 N X j Y m z g t o S d B g c x 9 R N I q t 0 D T M I n G f y B y b y w H C M / H q M K w N q 7 N b 1379e2 G h 0 E F S o u 8 N R A h r + J 35 s K c S t f n x h d h U C k e i 5 J e B / s F z R X v l o O o 36 x v R u 41 y T M e k y a O C F O / 7 e b Q 9 y g Y m S 8 i U W k y k C Y M Q R 9 l 9 n T p n J x P + A k k k I m n W u 45 t g g J q w 5 d V n f 1 p q j w Q k E n T h C T t m 65 B t o u S X O k B 4 Z L i D r s W y r E k Z A L U u N e A 6 z 771 B 6 O f l H / u a t b 7 k M s d f M U C B C l o + H 3 O 1 U + j 9 I U p 7 M U Z 8 E O / x F K O 1 M P 1 o C e j X j D o e b h 7 F O N 9 l V I K 1 t S z l G y o 6 S g B o / 0 t 81 Q q H F 7 e M w J W O h n L 7 p H E i y T z 37 K Z W X o u p 1 x Y x M P T / P g E E q C K l F x S u R Y r R 9 r A 6 v L m 8 n + g w Z g w q Z p W 24 g n 6 m w C D y s S u Z f C z a C l y V E Y N z G A u B s p D F q K S o r P c n 3 X l R I g 4 z + 2 l 3 h Q t Q a 5 k T l Y A n Z a 7 J 48 J I u L Z x C M s i 1 / b o n F n 0 g B V u w 1 W 74 H 7 q m f s l 7 G 8 n f x J 7 + D I c z G B g 93 Y T r 4 y 4 w + 9 T q q F l B G z x l k j f J L r / f r + r y Z 3 B G Q p Z Z k d m L z i / K n k i o g P W g x b b i b Y W A D r G s B U G E m 4 M e n i W p Z a u O Z i 7 o E 1 V 0 2 x m 4 + e O b h Q 4 T A 6 t 5 Z D l o r 9 i s q D / B c i B 9 N G 9 g 5 K D D 3 H A M L J O q w d P h 2 I h 69 k 9 o u t Z u m K g 5 H B C + I s A y X + 5 q B f v i w A e z v I g p G N j G t a B r / y i B 9 o D 64 c 0 j N T r l R O P L P b 7e1 a I i R o c d N T H O i 7 N 9 D h 8 O O C B h S K 6 P c P p J b X Q L g 9 j o a 0 2 R S / 8 L 1 J G T m B b e 8 G U 8 E R l q i 6 z D Z H + H E I h l F a / w m 4 d 1 Z w d Q k 7 d h 0 G O 0 g J F e P W J k / B t 0 6 Y j O w n b 4 R r z x L w n w b S 9 b J n h q T j o q N T F Q O 0 U z 4 b e K I / 21 s + 54 e I y q i L 5 X u C m 0 G / L u Q O K y i a p Q v N c M I s u B Z / z u z 1 C u j S v U V x q X f R B n W b l 62 O Y 4 r d u f b I b v 9 I G 34 a h a G U P P f C g l u C r 4 P u t B d e s X R F t 8 Q o W l G n r 4 t D H 387 W D Q 3 B E V p q 0 Q g X O A y P U Q D Z G f Z T n Q 2 g J z r B j O + a 6 A E i Z Z S S J 4 A / 3 E L J d l d q d o I a h G Y F t U x A z T b b q 0 o / V w q P A y c b 5 l V y s V D O t f s t I 4 D E y 4 e E B 8 P D 0 P S m / p g h E T R W S 7 g 4 U d W X d 1 u W f B H V A t d C Q + r X L Y x g q 4 j y g 6 y X T m K s 2 k P 4 E f U z h 1 c V f Q n x U U c n E W Q 2 x h D f A g 3 U I U 8 v T d b 5 n L w V 8 M 9 / Z L v A t a w t Z Z T d k T i V J s Z 1 Z w N q D X n q 1 N / B N v b o T + k k 3 k / 5 i J C h w 2 R u F A D s R L x v l c 79 F A r 42 J M Q 6 W 6 I J S J H t J k 5 F U + I K V e M M 9 v R 3 z a t j p a S j P E k t Q U x 6 P d r T f F M v G D S W h k e X A W n 8 d c 31 V 83 W L e C / o 79 F s D 4 z V z 9 g k c w Y m v e j Z P E g t F l B h 0 3 P c X Y + B 9 x h D 6 M s B o z N A Q M 7 s 0 k z a k E a i M w 7 L 3 C Z J 70 K x x 3 I / V H h J U T p z P S g r G n o + 4 L q 0 m + o J N K j 0 U E n m 7 c 4 A B M T 5 V x r T f h 5 a w 6 N T e r 168 V t t k J b f b o 3 J C f 22 d o L P C c m D U z E 65 i l 1 J C b 8 j v J P 9 e Q U B 5 v 8 x j j + 7 n G J x g r e d x + F s b q / h n Y h b N 3 A c Q N 3 G 8 R D u a X L I M i Y r M 4 Q 4 i o U n I I c 5 + H Z z 3 p Z o b H J m F h b 0 L a 6 B c 8 O A M s h 4 g p Y j t m a L x g C y C M 7 W V C 8 n p G A R Q B I p S K u S O U f a q s n L l S D s H b e I N Z t d w Z z r G r v 6 I 0 t w X 9 A G H 7 o I M l I Y C U w w H d G 3 y g E s 8 G F B 0 D d P N t A I L G I a x n q z N h a k O n 5 a e T h S 244 H 86 M 6 b r T H R x 1 y C 4 K c M A A r a q J x a T M f D N 4 R P n 977 s X 77 k O l Y / R x O j R k e / n l G O z X r m g F P T f 7 T d i 8 N + B b / 4 l X g m U 7 G F v Z y o t 1 o 6 / B F / O 8 f 8 W y 2 s Q y w j V b U G P A S I p 5 + M n V H z 7 b 43 U S l 2 Q m 4 c 8 O b e k S X a v D H h t n F c F n t 49 M 0 I s V t K Q L S M o C m l N d e M d X c 56 i O v U u U c r c Z / M I 5 w p h t B S 0 33 f g j 0 k 9 k P K L E h 5 a p 494 B O 1 y + I R G A N + K I q M T 5 y I J L D E A 7 E K f Y I v u V r k H o x a K G x v n P H C P m G s h c 1 N 5 S i D A Z I a E / i l q x O g C e f O i 5 l c x y e 6 q f I + g A E 4 F r J S m 0 Y S K S b U Z J / 3 H 4 o Q o 5 / k T F u 5 T d m X c t l J G 1 k C r i 1 A k L n l h D W Z e r M t G n j l s / l c S i y i Z Y r Q 9 j k e 2 F 2 T b d F S Z m a Y R D / v s C j W x 3 d m j w 0 E J y i H V N f P W R l D Y t b g L t W 1 V 98 j / y P 5 t N n K d 79 f e 6 / 5 O 71 s o k l 6 v 79 s h k r d 6 R W T m f n k l 8 A t b Z H X 571 a T s 3 f M 5 H 5 m 3 y h / 6 x I e R R h r k T C r P H 0 p A c W S T i 9 M C G 6 C 6 p E 0 K D Q I A w z 29 s r S i e 5 a v 10 J m m D d H J 5 J e k 0 x q X N w E d D m F E A 48 W G 8 N p h L Q X w c / 6 T V t h M o q d q P r V i m + 46 y O Q 28 l 56 g L a Z d 4 y f u t b a I z Y r B 7 / f n 8 i M O Q C 4 L g o 8 u I O b 314 c V f 1 E T h S B 6 X V R k l q f R E + h x S 492 j 7 Z N n 5 Z 1 N V 8 L l l y b 63 R M l N P x B 824 G k p U c 4 Z J D K b e c z v f q s p 1 p W y l I w y x T P q C n b C i E n T h P F M W I X 4 v y G E M d B 7 O 7 d 6 U 1 k y z F v X K c D P v G F o 9 Q A 8 D x C E i E T r 0 / k t 11 n i 9 w p A z A z P d F m 4 d S S O Y F G N 2 l i E R d s g 1 j o X + d x F 7 j K 3 O e R D 8 V w h i y i + T g O u B 4 X A h X s t a g M r i z z n 464 k v C V u q o U P 7 y n p J I 0 V f 4 h C B y 4 g 8 K D E 1 l 7 a / U q h E p o l X L U H f o n z
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "malware-sample" ,
"uuid" : "59b2b00d-b368-447d-b9e3-2ae1950d210f" ,
"value" : "MS_INV_4391.7z|77226ba9d1c415aeb85babdbec626c60"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "filename|sha1" ,
"uuid" : "59b2b00d-7c04-4139-a539-2ae1950d210f" ,
"value" : "MS_INV_4391.7z|e58fbff82ac433af75512b506bb3617c319f5e0f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "filename|sha256" ,
"uuid" : "59b2b00d-ec20-44e3-9716-2ae1950d210f" ,
"value" : "MS_INV_4391.7z|114c0ca2d2581cfb70e84a0c0885c892d06fec233213e077a1b332138ebd557f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"data" : " U E s D B B Q A C Q A I A E t 3 K E t X 7 d d Z b w 0 A A G c r A A A g A B w A M j I y Y z M x O D g 4 M D g x N W U 3 N m I 5 N D I 2 Y z c w Y j Z j Y j U 0 N T N V V A k A A w 2 w s l k N s L J Z d X g L A A E E I Q A A A A Q h A A A A + 4 c n c h K D 1 U m X B F x j x o M j X k Q W l 8 h c q x p G O 6 y 9 c s v W K Y 10 c R U B S + f U t W 1 W G B 1 B f S 3 E b V u X L 4 a N u q U V r p s S A U 9 i E z 0 4 S 3 N E L T j w J y h b / 3 E I n A U w T t s t z r E c G h 9 s Y j o 2542 a V R K 40 p y m J N l W Y v x d q q Y v q 6E4 C l Q W q 9 z v X h y E F S 6 i 1 t 6 U h 4 h h Z T 2 T O D A s y S H i U V Y n g 0 + i z A A 2 n 2 v 0 25 K v n h J N M + T n / M K 7 Z Z x N P y x u c N l G 2 x H 36 l e H F F R x V s U J g w + T Y 4 / Q Z K X J j m p 0 n 3 G h a 8 b p 0 F s a k 0 G w 4 n A 5 r B C C k 5 r s C s X L e W K 7 V + Q m v q H S u e U m z q u w 9 D u t e p l I f h + k F g 9 G T B o l 42 D E 9 P H p A 1 d H N V 0 b t j 0 l U 7 D v u A U G s i N E I u Y s s W S l P / 6 a l u p h 6 I h h 3 A 9 o U + g o r C 0 z U 8 x J q F d j 8 J 2 q P C A 0 V d 97 A O n S l e B H X n 4e4 W D O H r X 95 g y E N F + A N r h j W 4 N 0 N l E 6 + k v G L I + k 6 F Y B 3 i Z w m W r + i z 6 z z K S U s T W N S M N Y Y C 8E9 h p G + i Y B W 9 m 1 J / X R s X h G U V x F q P k r g J W 3 b p E f d x F J E u T 9 G W c V 5 x E 3 t U s 56 w O x Q R 2 + a z d A 8 J x E L m H B A 765 H J 0 d 2 p Q i + t Y g a d x F g S x Y 5 k o W T G P K J z A u j Y 4 n k U K i N j r 7 C 2 A d R 35 q a b s G Z i R X i L b D 7 x / O Q H Y I 4 C Y I p g e w 70 w x T F F P 1 f M D Y o O j p m v i j 83 T + f v g e q A x L g G H N o 4 J p H w F n W k / W F C / k A F 0 N 3 N O f t w W L H Z k r K Z 87 A D g X s z o J W q p 1 Z 9 M N i 2 w 6 o M Z D T n g i B O x l k F v 3 z 80 R J T r 9 n r 0 D 5 L U V R v y o l V e a 0 k P 9 d f / E A C / c U 1 q / L u E k a D c J M p j 93 k S 6 i g X r l N 1 T 7 R j 43 M + V a P 118 h D S J u E s P V K 1 y o x U a + O K U d f 6 L j w j V D e t j R M C E T x m j N X X g D 2 O L h E d p U l l Y y a I j Y x q m e r j P 8 n z Y y W u V o V 0 q 97 p z A H K N H s b y I U a J G n + l / 4 X n a f F w b z / u s s T O q F 4 O R 7 N V O L F K 2 V C c Q Y h g G R / 2 h 0 / X + 4 I y t 5 c P T t X e H A L 5 m x T 1 y c U o g x q 61 A b f d z X v 0 W / 7 V t 6 E C Y Q L J 47 Q 4 L j y d X l i x k p u x w U c C x W 6 M k f g d n n B 0 V / 8 T V k v r I t b x s I f q I e U m L r e c x 4 z 49 E j D b q N q 1 i T a 8 L t 8 a 5 k / x t / b 11 g b m E f A x A C W K S n X O s F B p g B h f K t R E J n G a g M 2 A U z W 0 / r k F N 2 l 2 L F a 9 i 3 c U B h + L 1 m l A 7 G k O G o a f o S y G R o K / L p H B z h W d b f L o A x b I o y r Y v h X A k k W K S L d y 69 F B p s R 9 o 88 E j a 0 X z E x R E n 0 B s 8 H E v B x d j S 7 K K k 1 G Y B R p x U D 4 r i S e d V i R 3 g I 3 C H R x X 9 J h T s / w o f 7 T 3 X d U 8 M 5 o / q q 2 f J g C E v O n L 9 U Y 5 v A g Q M + 3 F p 4 w H Q m d y f 47 J l f o j i H e 1 K 9 / k C f G 6 M e d 6 p M E a y E o G U I I B Z U z Y d q W 4 A S K 0 M h 78 o S q j k M I 40761 W W h j c B d / e 5 W c i w d e 9 d A M R l j 1 E e l e x j v 4 y v q G 5 s p w Y x I g E 6 t V d x R S e 2 A I v l D C C 5 q 5 Y f r i 1 L 66 r F 6 u V g w k G F w Z T K O 17 R 5 X 5 r C o R Y J p h C D q L k Z K f F u D 1 z Q 0 U Z V C / 1 + 5 h 5 D 2 a 7 B y a c e i C k U m D s 5 l m H a r z l 4 q e y 54 p k T a A v O v d 3 v 53161 D 2 f s i W W 672 u E K + f 5 W 4 i T m X s y R a M 7 L u g H E Q h M S F b W P X N g r B 0 Y j 4 J B A r W E + j U N q G K b W E T s T + x c r H N Q v n P E + q 2 h m l n L z X W S L 9 S k D P r 8 v l c 8 N 2 s 3 r t K w u Q H 2 a X U d U H c H J f U 2 f L c f T z 3 T c 9 b / f t / w J f 0 X y W 0 + t A a b m t / X 2 T o o + V X c 1 c W s L z 2 L A I S H + G 4 O 2 g x o x S c B 0 U d l q Q b 6 V o p A F U u s F N M C / 6 x F J R q Z U y R P z d D M P Y 9 O j V s z E V Z 6 q K X z y Q N f 1 e i m a J I T 2 a 3 u + y L G I 9 E / V a o 2 I U 4 Z l u 0 I j b W 1 y w 3 O t i Q 6 a X 4 N R f z v b v P Q 1 T s V 5 S c 5 c Y G d Q 9 z Z G t 9 Y D W n J 7 y 6 s 55 g J x l f F j j 0 Z 8 e j T v v Q 8 L 4 U Y H j z u A y 8 I T F R U L k T z w F J F T x v R F k m J 1 Q c k A i l I O Z Q Y y J A D o 9 m 7 A Q b H C s + y D G d / 7 j Y Q i d F X C W 8 d K Q q X 30 N x N 3 / D 9 j J x m b g K w P r a I z d s f e P K C C 5 b R y 6 R T I q C v l v C p 3 k L X E D r t S G g u h X A 3 F O h z B V 7 L R N Y 5 w J V 2 y 7 H P 47 L 2 c 0 S J J Y y s b M N R U d p f A j T b Z v l F f C 1 k h V X Z U C i q C y 3 Z u r Z o s P Q a h Z C o u 6 B U K g + X b 3 d t B g Z F P W 1 L X J 2 W n k p L f G V a 8 x g h b + s 5 B w 628 p f k E K Z P 3 I D 7 O t E 6 r L b w E v R T E O q Z e R h y o t p d E Y 2 R v x g f T n K s c e u u f w n s A D R 0 w H 59 t 9 m e v 3 P K S q h v I b 6 A b 6 H x E M H t I Q t i V F p k d N H 0 E J f 6 s s K o T Y b j R D l J r Y w b 2 j A B S Q p h K M h b a n E J i m f e Y U y c I a B t A + / l I X P B V 8 f K M 7 + v 1 f r 7 l B o r G u O P / j / t a j K 6 Q r b X g z m I r G Y B 89 x l x D D c b C D / w V / k X k + 9 f G K 9 m 9 I r T m X h 8 W N g + A W M l F f F 46 P u y n u R E s y a A L 2 E x T F F + t l 3 I L L u k 9 O k m O 0 w V 1 I M 1 A g d 3 r Z a D j b C K E A D q e 19 o V U e 0 k w e i 2 p c z 8 F y W X p M q E 9 T 2 r Y 9 c x L 21 O W O X e 5 E V A M d y d E n B q H H t L P t s L J / i H Y 7 g t / a e 7 W l t V i u / J u Z e 51 o P u Q 2 B Y I O + 9 U q g t 0 I e H / T H R W K M R h m o L x k s A v N v / j D / V B x u K L k 75 t m r E P Q L H e 70 O Q / Y C 9 e A a B v H S v h H m v O R F S 9 A 2 f 0 5 j R Y A g P E 7 I V C 9 h 4 a K 1 Q j w 3 E A M X z Q + + z F 5 V 4 a H 87 G i B / H Y 5 W Q A p f o T z m R n X F 7 s h I z j O u Z 4 M y x n m 9 j S F h 1 Z 297 u y e C D E 1 E M w 9 P q U W R q 9 X Q r q e Q i d D A Q y N m L K M / 7 g g O M B 5 M o m J Q O 7 Y t Q z M Y N i 6 v 0 F e X C W U n g k k 6 I e C e a z W 2 e F i N L o + g A 41 W c q N 0 / o O Z / L A u r H J A 5 K P s P s H I + L 0 F 9 f 6 p p i C c n p Q 4 z m X B G i Y C U D z h U y J 4 X g 77 T 8 T s o P g C 5 t S 4 r a a f 3 t z f E s / y 4 u T G T H y q X o r B B 8 d 8 V o V R I p d 9 G N Z c D W Y y 905 C o z 6 W u Z P d v j t 8 G 1 T / 0 E B 2 Q m 5 j R J s 6 F m 461 t h Q t f G h q e m Y k H E v K S u R e v 2 V x + r z 2 Y e Q H k A s 7 K q x y d G J n U T I U 7 L e y z l + b X + z 0 J 4 F L B 0 / P P R m Z 1 S r j I 4 P k f q t T j S + O C s 3 j o Q F m z F 2 b u a 1 F W H i o z d y I 6 O l h N I 8 P W / V P L v P v 5 O E Y s 4 P f 0 6 E l i 60 d J 8 l Q 6 A x B n W Z y w G E u Z S J p 6 D N 0 Q V 3 D u Y V R t 9 U 9 n 2 J 3 n f Z 156 M F G 4 t G 1 n P S 9 d g y x d S + 2 F s A R W N h x v v y p U p C z v f J I 6 D E E 95 X f 0 O x Z h d s Z f q 3 u y g Z 2 F y x x k 4 a y R Z 0 f T M L y H y z w x C A N J k c Z n j a 7 h t C Z C f N 1 H 5 R O N G n d i s r F X P A E P w A 0 F u Q u L b f c J 45 J 2 z 6 p s J 8 m K 0 j E r T N U Q c b j Y N Q N D d y F a t Z X D e G M 0 G L l z D h / X A p Y + G K Q 4 w Y m r W I f o T h L N W P s i 8 w I r P O L n + K / A / l L l k U L I k F Y i q b 9 d a Y b I P K a 655 e F M d S 1 h c k J J 1 / u G b V z u 704 p w t D U h b E 0 6 A C J O C T R r R Y E d 6 I E p p Q U a k / z C P X i v l m r D d j 7 g X G w 3 Q a Z n 4 G V Y c p b G N j P R X D h M u 4 + 12 p v z J 0 B / m p c Q n X U F H E B R T 9 N 31 D + H 1 m u H / D W R 5 / N V r 4 j N 1 K K 3 x X d o q y g D U G N I Q 2 d Z h u / o F v c g m p g W g o u e N 1 S R M H 1 n h c L G 6 k i S G D 3 Z S U o e Q 6 a s D K m E S V S N o e I 0 q 5 P 2 u P M A I Y 9 i d g n r X s Q p f T b H z U P P D / 5 J a T 7 K F f / v j t N 0 n p t s E 2 D m x F v L O 2 P m j 7 W S Y d z b W y k 2 k d k T 8 j h l B C c H p s 7 a 34 a J p E i s q K / h Y c u n Q H T P T l / q P K d 8 k p N C F 9 D K h D 9 t + r k 9 G H L p a t c G o K G h 1 x K g o y 56 Q r r q D O L w D t U 9 l 0 e a q F o 5 j A I F t + 4 a n G r O k M 9 K q 6 u w + K d 24 / e 4 A 2 l E f 4 T M U z x z 3 l 7 T 5 L I I g l N / 8 C J k 5 q 0 D A b K v n S B p T p g T C w m J p 7 v v R G c n P 3 Z a F C w C j X m y / g O n 6 b 2 U S 4 k 0 L 8 L Y 177 C Z y 3E9 j / g Q 4 L Y m y L r W N c
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "malware-sample" ,
"uuid" : "59b2b00d-3188-4f87-a0b4-2ae1950d210f" ,
"value" : "MS_INV_5783.vbs|222c318880815e76b9426c70b6cb5453"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "filename|sha1" ,
"uuid" : "59b2b00d-cfb4-42b5-bcec-2ae1950d210f" ,
"value" : "MS_INV_5783.vbs|98e78ed75d7363977c0384bfd4be315734c0566f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504882701" ,
"to_ids" : true ,
"type" : "filename|sha256" ,
"uuid" : "59b2b00d-a648-4e5e-8e91-2ae1950d210f" ,
"value" : "MS_INV_5783.vbs|7316f1875c62f2a97282023d757e4333752c986e11bc3c521c9ee8adac0cf804"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"data" : " U E s D B B Q A C Q A I A J p 4 K E v F Y 1 P j q T 4 I A A F Q C g A g A B w A M G I y Y T U 0 Z D c 0 Z j V l N m I z O D M z Y z Z m Y 2 M y M T g w Y W N i N j R V V A k A A 5 O x s l m T s b J Z d X g L A A E E I Q A A A A Q h A A A A h 0 T t D 7E5 c v O e k e w T / r O y C d 79 T S g R 0 s f s c d g E s u K q X k j 9 G l g p N r q G h / N P V 8 v V m d 2 j t B o l z 0 3 N P w p E T U z F u e K h M b f A t p 8 C g I g 21 w / t o D + P t D a 1 M N i r 6 e I / p P m Z g S Q 52 G b n Q v M g l X d Q N N a y / r 7 O F H R X H c U e y a 8 f y A J r 0 T O p h C 8 q W L E 2 N Q v S B 1 E h b g o i U f i H + D T b I t Y 9 t v T z p 5 R r P r E x E k 78 K 4 + H C 5 w B n P F O I a e n k o 6 x D q Y + K A c P c U I s m U U U Q H x 8 R q o 2 w B y g R q Q J G z 2 k i M c 9 c d p l r M L 0E7 w i M / H p X q Z j 5 y r 3 O F 1 N Y d T Q A j s i X g E / c w p H l L N P a b L A d R b Q g I G P + C r C U c c n 9 v H 8 K W q Z k + 1 N o r r U P w z n N p G n 9 U O t f T s X y M N Z H W i l 0 a j k r s M R n r i 0 i M k 0 l I N V v Y V Z B V U 0 w S G 7 p K N 9 P L N Q X a D F b h Y e V I v n 2 l X C + u p S G P j m F a p W q C 670 S g f a r 7 M t w p Z 4 O R d l O w S 4 A b k e 19 i r z I e 9 j C r r K m I I n A Q i p y x H E + c l r 5 B I 0 E J 6 Q C N R e v L w O 1 Y N + 4 H K X x s W u p c 94 i A d H x L L q L n u E Y K T r 4 U 7 j e e M G l l u B 4 B 6 U V P P k 6 y k Q w g 4 H K Z F 7 D O P Q A P b 6 y p D y E 1 n v Z P O c + k m B k Y a o l + y g f K 3 i b A D S E N b I R O w 7 Z t d u q X D 41 k N q F v h G I T V Y u 3 v s + x O u S O 4 y e Z 0 1 e B G K B E L S t 3 P h E h 9 z K 8 C w r O I T f l n E P z 5 g l o p T C k j T + 8 K U w 6 c H x Z R Q I H / z 7 u V u w X H C Y x 94 l v j o P 0 O o G / y I J 4 d S Q 1 K r Q L a M + y u T B R g m X O z F H v J Y P i U M C 1 Z 8 h S 2 d p v z s / k 1 d / s 98 Z V m Z / 8 o Z M L 5 k y i 6 X I d Y N + 9 y 7 N E a 616 + 2 t P u s a z e P f S B 84 V 5 J 7 X I I i s 9 O Z 9 I U 8 G D k S x Y 0 G E e l 8 L k I W d B B 1 V m 1 Z C 6 S 9 B L c x 1 / s P V W m j q C q K O Q S q d P c M g c l H i 236 b h 2 W T a z Y 9 v W V E 3 B u X A 5 G H o 1 a H 41 j p 8 S P s l d l n V y h Z a B T a R F x i U I b S 4 J d O 1 L K Z 5 g Y S U 5 w x Y R Q B U T w 5 a 8 x c R u O L 7 Y k P J g n K L 4 q d R q X E 0 C v w E u 9 V z m 6 f N D c y k s f R + D s 6 t q E i 4 X B 8 V g 2 L S P p I K Z v W n n v F d J Q X W I y F E G F q g y 5 t K s U E S M 4 E G C D H T 6 k Y R I 1 Y T 0 f 1 x R n z B g r n j 8 L g g d c t T g 8 A O 0 E j c V E i b M / 13 u D q W 9 C j G U K P E K 6 M H e M S l Z x f 9 c s + W x V c q a p 5 A 4 V J z x m O H b d 6 G u T R a J v f w I X W H 8 o 1 J 88 s T x s X g I n B F h R U g c c 6 v f V R D w K D a + q A H 3 z Y 4 D 433 J k l F N h 9 G 1 d z U u 3 d E f m D r G U e v N n 5 K N 2 g N J T 4 m 10 P e j q 6 D t 8 q c b g 6 x y 0 e R 2 D F 2 Q A q u M q 9 K 6 P s D G i a c 0 E s o a p 7 Z g o E a m K S K J E c h + p h 4 V i s R f 3 u U g B L f z y H k / c Y o T 0 G O t T L U k 3 F 4 p g G v 7 N n Z L 6 w A Q L u w u d b z j u d / d F 9 y E k n X D 0 j j + 4 L o p K C c Q B w g R 5 r B v b / t a x M h e Q 4 x p U N K 6 m B s L F v 3 Q e B Y r O q i I f Y Q L U L t E 3 C K + a z f l / W 3 M R 89 Z s w n m 83 P o R L 7 I K R S H y j 0 0 9 / 8 Y o c R z s j K S G n T A Y h Z w + N A r V E 4 k X / t v y c 1 X O i v + p j m 7 e s G z / R n 19 h C X f L i u i a A S A + n 8 I 5 x P N u v y H Y x 16 D E X V G T 6 I Y b B 5 N 1 A G c x X M O 8 H A 0 v m X I 0 v 8 x G a 9 g i J 7 Q Q / j 31 D c c y D 5 d 8761 f A p C d 4 Z 5 O E A Z r Y w m 8 j w j J N A w U 6 L q 8 L c X r h M L c V / r t U j P A v t G k c z 1 I F o O z 26 U i C r x m 8 O v q o E x n x i e Z P s 1 L 5e2 t L l M H v b p y Q 81 H h s p B P I Y n M + b l l k s y Z e z W 38 t A g Y G t T x S Y g T Q f 9 I T 5899 f E v Q 1 s u B c 9 U 397 E C f N 5 m 0 J m J 8 s + I D e j O k u L 518 x M 6 I s E g F i S n M h n k h s / b o 0 7 L p h P N 9 c M Y t N 84 k E C s z h x E 1 N m c r K 16 E x G b K A D X e L l R d y H j O c y F 6 D l X x q 2 Q m z I F L Z T / 9 W m W 7 T M q N a 6 m h a k 5 B 6 U w 9 H 70 o 7 k g H z L f G a 2 H h Z 2 G a h V C W X v M b 0 E A Z 1 t k 3 T u Y K 1 h C j V v O l f u v Z B W m V 526 i 1 j Q k R T C j C K s / 4 g y 3 L 7 M 9 s K W A O 6 h 7 L Z C S s 7 c w f m M z L I 7 y y Q J L i u k T J 0 h T t y F 9 T f U 8 q h U T U o E Q W S f b t h e O p H E 9 g H F Q P A g A / 4 G 2 D 1 R u Y K H G j r 1 p t N W 69 T f 52 l q 1 k S 98 w W K k X x x u 7 I s V r u c 8e0 c m k s P 7 G M o N R 0 k s s Z y E e Q T u e e / 87 w d C i + b 5 f n 1 Q Z t j g 0 R / G B D m V z X z l 5 d v c s k a K 6 M + 6 k h S 3 C 9 L 72 m B z q J H 75 r 1 / 3 n L q w q D F c O d O j N b o z J P I 7 D Z 8 x t j B X L K 30 s r E T y S 9 M 1 Z u b F e Z n i g H n u b P a A g V t M q R K w 0 H a s H M M C O P K I d W T 327 w U p K 8 X e F M S m l B R b e t O n f Z 0 0 + 1 K d Z d F y p u Y h v l y y n I t r S 7 q T 94 C z W B d R v L B l b n t Y t N 2 z 6 Q z j L 8 / z 5 t 1 t T k G Q I I 8 n B O B W x T I C t j 6 q Q 6 O t 7 n Q x c k l f + j 82 q I j M k a p 1 d w y 4 c 2 E C y N t 86 T y w t V i 8 + R W B 6 p X F w L L L 1 r 5 H / s l X u E O E X v l + y 6 u l h e e m d x d N n b D X x n g b J I q X Z a 8 z f y w B j i 0 O e Z / 8 L b f b p N y J o 0 F 6 C m Q W t J d T D s O 5 T x W m w j 87 A d v p O 8 Y g b 5 j u P o V u 9 o V u 4 I / j Q c 7 C r + y W 0 t F G b U q V V 1 R x 0 9 J s w j K z + V 8 x O E V q / w N B r T K 0 E e j V 6 i j H p 7 c V / r Q I u + y e 9 J F U 0 r R y b R F u d 1 d 0 M Y a a F i v x m b 0 F u X o n d U p k k Y X p a S Y c L 78 x + a r 5 r W D r n c r 46 v P r N T i 7 l R G L M 6 D G w 19 o F 5 w d l P F q H e v w g B H j J Y M Y x j / l y o e q W 2 z B Z g P 80 T D d x D T P 3 I r n N A r 2 F f W z m 0 K U S d D N q 7 z A 87 P t f C K N I m W u v 1 y S f q Y c + W 0 9 C c X V x 8 h I B S + v D 8 A t V s q S i y A c C 9 + P r 85 n U F e Q F / A r 9 F e C e G K v P l V 1 L P f 0 L a Q 3 x K c U p x b n q R b d R 5 E N X V 9 F i I O P c I F L 6 o g N c a + 7 W u Z h n V w r P g k 9 A r 6 T O o f g i P m y s / N o E G L x Q s W f B r S d a K t H i 2 X f + F 0 X 2 e c U u r 61 / c 9 Q 6 J b p r z B M P k k 7 d I 85 N f x p z c t x 9 p 9 B 9 v d F v g d o Q E e 5 Y i J c K S u 0E7 D 48 H Z A V U 7 n s z H + Q 2 F W D Q u C l s O M 6 x Z p l W Q v l m q X l U x g V Y B g q 6 q o a z S X 613 s 0 u / i b V 91 B d 7 C B / m 6 C C U K N x j J B v n b m R r J 1 n c N q P D n K p 56 G D d L M r 5 q v 0 X r 0 1 o 4 p c A c a C g Z e 9 J f 9 r 7 l j H M I Y X G x f / V Q x H 0 N + + w d l F Z l / M L U m 3 h I P T i S h / W a S J Z U g w 9 Z R H g / 19 t 4 C J p L Q F A X 3 f 6 G L D F I M X p y m e a p e C q 3 c + w p / 16 R m Y W R Z I A i p S M u x T T V t / l q c 4 p K m R n 0 y i + Y O + U d a 3 W P d p 7 Q g V n 4 U n N S / A v G 4 u 2 v S M n i B Y x O m N R L 88 r H e 99 V E H g o T T l z V L A g 9 c S / Z W a N R q 27 b e g X q / Q c o k 6 O w v p U 0 y i W E c 1 H 6 K H 6 L 7 + S 0 K A J b U G f 0 A O 1 i Q v F K J 3 u u U v D n K 4 U 0 F E p l 41 h 6 l I h o m 8 z 0 b Z j a C 7 p Y 4 N 20 w a i a e a N m P y C H E u j J W v Z X A C r N C N x 66 g F E F g D U G / 9 T i M D 4 p U u k u G G g M v W b Y R A W + P e v P u d / 7 Z k y 0 8 m U n 6 F 1 x x 5 m 6 g 3 T g Q 0 8 O G g 5 h M t X r m Y R O d G Q N r 8 s f q K 5 F / R C F Y P h H W z X z 4 j 7 p r c X 4 Z H 4 u r / i U v d H h b i l L d C R S c 0 o v + Q P + P u 3 w + p 4 k 81 p l U 6 g G L M j 7 E D g a 7 Y Q 93 g I Z s N M W H Z Y h s o 38 Z W w e + 2 b 2 v 3 d V x V h i U n o 1 R t j L V 4 Y o r 2 O v T Q g O H q F Y m S A s r s q j y v N t Z h p 0 n c s f r Z u 2 d E h J 1 y 44 K B / a s W 4 F 30 f N d 3 O m 7 v Y t O M n c q k W E K V N c 5 Y t 5 M z r 8 L R F 8 U b z r 3 B 2 L x L 1 U Y J d T L w 49 u Y Y j l + n g x i L 4 I N F s e i w 9 H A 1 x 2 T K Y q v 1 s X I + X F 13 E L u n P / i p z n L q r O y O f q 5 o t L s V B T Z t r 5 p H w S 8 D r A B d q 3 S S i J + D l X b g 2 C 7 F a v R 3 g P B C Z a + g n z m G 99 P 4 T 1 U P r r D G D S / D t 8 D 3 k 9 L r l 6 W G 9 e t t 5 + x M k j z Z R E u x K O l R / 0 c e F v 0 D 5 d J V b A 0 f
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504883091" ,
"to_ids" : true ,
"type" : "malware-sample" ,
"uuid" : "59b2b193-9c30-4e78-a348-795a950d210f" ,
"value" : "3936jkgHGdcm.decoded|0b2a54d74f5e6b3833c6fcc2180acb64"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504883091" ,
"to_ids" : true ,
"type" : "filename|sha1" ,
"uuid" : "59b2b193-3c88-45d2-8cf9-795a950d210f" ,
"value" : "3936jkgHGdcm.decoded|c62429c23718ec9c16361c4e711b2535aaf8b3b7"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504883091" ,
"to_ids" : true ,
"type" : "filename|sha256" ,
"uuid" : "59b2b193-b108-4c24-87c3-795a950d210f" ,
"value" : "3936jkgHGdcm.decoded|fcf6e02ef14cc219cd532b72d909062967dacf195ad4eb12fe131f3c20755293"
} ,
{
"category" : "Network activity" ,
"comment" : "secondary download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504883387" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "59b2b2bb-62c8-47e2-a278-7959950d210f" ,
"value" : "http://anloandy.co.uk/MS_INV_1046.7z"
} ,
{
"category" : "Network activity" ,
"comment" : "secondary download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504883388" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "59b2b2bc-c30c-4215-b478-7959950d210f" ,
"value" : "anloandy.co.uk"
} ,
{
"category" : "Network activity" ,
"comment" : "secondary download location" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504883388" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "59b2b2bc-aff0-43af-834f-7959950d210f" ,
"value" : "213.246.110.104"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1504883454" ,
"to_ids" : false ,
"type" : "email-body" ,
"uuid" : "59b2b2fe-fd44-4119-b602-2c9d950d210f" ,
"value" : "--Boundary_ID_66HcBTplKwBgWnOL\r\nContent-type: text/html; CHARSET=US-ASCII\r\nContent-transfer-encoding: 8BIT\r\nContent-disposition: inline\r\nContent-description: Microsoft Store E-invoice for your order #3355505101\r\n\r\nDear Customer,<br />\r\nThank you for shopping with Microsoft Store<br />\r\n<br />\r\nPlease find enclosed or <a href=http://anloandy.co.uk/MS_INV_1046.7z>download</a> your official Microsoft Store Invoice.<br />\r\nPlease retain a copy of this invoice for your records. Your Microsoft<br />\r\ninvoice may also be required to obtain warranty services.<br />\r\n<br />\r\nThank you<br />\r\n<br />\r\nMicrosoft Store 2017<br />\r\n\r\n\r\n\r\n--Boundary_ID_66HcBTplKwBgWnOL\r\nContent-type: application/octet-stream; name=MS_INV_4391.7z\r\nContent-transfer-encoding: base64\r\nContent-disposition: attachment; filename=MS_INV_4391.7z\r\nContent-description: MS_INV_4391.7z\r\n..."
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
