adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/01e8868d-48ae-41aa-8516-ea5a303758b8.json

10710 lines
1.6 MiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "1",
"date": "2021-06-19",
"extends_uuid": "",
"info": "Netfilter Rootkit Samples - F. Roth - Google sheet + expansion",
"publish_timestamp": "1624087659",
"published": true,
"threat_level_id": "1",
"timestamp": "1624087411",
"uuid": "01e8868d-48ae-41aa-8516-ea5a303758b8",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#305600",
"name": "malware_classification:malware-category=\"Rootkit\""
},
{
"colour": "#004646",
"name": "type:OSINT"
},
{
"colour": "#0071c3",
"name": "osint:lifetime=\"perpetual\""
},
{
"colour": "#0087e8",
"name": "osint:certainty=\"50\""
},
{
"colour": "#ffffff",
"name": "tlp:white"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1624087131",
"to_ids": false,
"type": "link",
"uuid": "f37dea30-31e2-433b-a5a7-496bbc29ac07",
"value": "https://docs.google.com/spreadsheets/d/1FYgBmJH8MOli99oIqRsIHJA2XzI3aSdAOb9mZmqj_q0/edit#gid=1028909258"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1624087199",
"to_ids": false,
"type": "link",
"uuid": "01758ee5-c2dc-4efd-be6e-047cfaadbb8a",
"value": "https://twitter.com/struppigel/status/1405483373280235520"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086946",
"uuid": "6321c3b7-2f5c-42bc-9678-3404093fcc86",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086946",
"to_ids": false,
"type": "text",
"uuid": "9c471cab-8e3b-4745-8e48-43848b2fb184",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086946",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "aa69cc41-a982-48bc-b61b-8d9ded7c7c02",
"value": "26624"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086946",
"to_ids": false,
"type": "float",
"uuid": "754c42c7-3b86-470f-9936-7a1c0b24f1e7",
"value": "6.3151171440822"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086946",
"to_ids": true,
"type": "md5",
"uuid": "56d1dcc8-2819-491b-9d88-8846205d9974",
"value": "cf0b16eca2aedff96b586a2add8e956e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha1",
"uuid": "491e9404-fe3c-412e-8345-ea061688895e",
"value": "6b3099c00646a54d25d96c0d9a3394463394083d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha256",
"uuid": "a064ce37-572f-4d16-a327-ef82329a4c0b",
"value": "e64daa8926bfab138ddbe16a1f84ff4dd67984b06d0d908fecab21f051e7786a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha512",
"uuid": "da2254e3-6ebe-4d94-89f5-7ed77ddb3791",
"value": "f408833fd42da728bd7f89f4e288a4fbe1651cff3a26fa911cd09f845302d678c70037ceb36b3d58dba910d1b93ec602fa0f9ac13ae63936c4332d4c0f89c049"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086946",
"to_ids": true,
"type": "ssdeep",
"uuid": "9ec1d8f5-124d-4dbe-86dd-9adc2d1bddcd",
"value": "384:T7ptyfdBgZqCq6pWKksgl2IYdSuC2WigRelS1K8C1x2i7JxhsmuH40m+wMe3ifsY:T1ZqCQKy8IYdfWiUelR36ihR6nmRYsY"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086946",
"uuid": "e382fa8a-ec6b-42f2-9aa9-d0c67d3ce31c",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086946",
"to_ids": false,
"type": "text",
"uuid": "ec7f52ea-bf9e-457f-b879-c0b86ee0be7b",
"value": ".rdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086946",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "0aa501d8-8cbd-4a59-8099-c31f26abdd57",
"value": "4096"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086946",
"to_ids": false,
"type": "float",
"uuid": "fbb1dbb8-a1f0-4278-af9b-7100be6e8fb2",
"value": "4.5975419614638"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086946",
"to_ids": true,
"type": "md5",
"uuid": "fd5884c7-f7eb-460e-8824-a708a429dab9",
"value": "9bdac8b097939eaed66915ff2b749a65"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha1",
"uuid": "3dadda97-cb77-42a2-9633-b4848478c7fa",
"value": "90ffe7d75e330312af75613f6060ada878fd40bb"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha256",
"uuid": "4705a957-e834-4d4c-b375-68fc51d0cda7",
"value": "6e9301ad9fc55c0985604ca76ea25bfbe34d5ea053a5693b63988b5771384403"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha512",
"uuid": "ff96257f-dfcd-4435-bf84-8157143c4975",
"value": "e42210e5468e15207c537b77c87ff62a9519dcdff25b6ae370f738d35d73499af26a7608996b3f4fdb50c8e46aff7c016b353b195be156a3c8c320d545eb9cf3"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086946",
"to_ids": true,
"type": "ssdeep",
"uuid": "1ab9c7dd-958e-43a9-acdf-5b7a5f05f0dd",
"value": "48:rwcdILFDTZ8qNEFw6QNO8gpXqsBAXpQXQcPhhpHP52VosLHMEiLnRVsxO3YU4dTx:r4Cxefl0ZR2SsaROOrOBEM"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086946",
"uuid": "a5122353-0bad-4b08-9755-48619da51f61",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086946",
"to_ids": false,
"type": "text",
"uuid": "7ccba7df-ae57-4817-b6a7-ba1c3e3178ba",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086946",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "da19b595-5098-4084-8194-0dfeb85cbd9f",
"value": "10752"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086946",
"to_ids": false,
"type": "float",
"uuid": "802dc942-2c3b-49cf-9b60-4b408cdc4499",
"value": "0.6671192572015"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086946",
"to_ids": true,
"type": "md5",
"uuid": "1425fd44-e4c1-4071-b9cd-db736caff24d",
"value": "cdfba2ba88c72647f5347a2835bfd043"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha1",
"uuid": "b72508ca-66a6-4229-8407-5189a71d6c68",
"value": "da6a4ffcc7026a22fc6df5b886285f194680b0ad"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha256",
"uuid": "b35afd78-4cd4-469d-8b5a-8551a6b7dbdc",
"value": "b5ca2985dcaf1bffd87922bf5ae6425012d9ebea70b1f9ec5ea7bc212c37cb25"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha512",
"uuid": "319ea4ac-d0bb-43a4-861b-89bca08d4ddd",
"value": "6ccf8b884e64df2a4074d994d97f287f43a263614ebd91597dbe5de0a5f3c48b288260fcbf3e382b4860747a6da9d03e5f7c8e483d81f1e236dd59ba833bd31e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086946",
"to_ids": true,
"type": "ssdeep",
"uuid": "e93a3ddb-0d4a-4138-a3ba-7ca89f3d602d",
"value": "24:W5xK9PJtoa+0SC8gTMCkzVk1yu6wnffu6wnfX6/1nS:aK9PJto8SbgQW196w+6wP6/9S"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086946",
"uuid": "d20843ec-7a04-401b-909e-c26ebca453c2",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086946",
"to_ids": false,
"type": "text",
"uuid": "07718463-fd8a-4303-8c8b-4c02cd1be926",
"value": ".pdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086946",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "eed1fe18-d608-4f94-b93a-e92f8f837605",
"value": "2048"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086946",
"to_ids": false,
"type": "float",
"uuid": "840a7eb8-8c95-4dc0-88bc-ff777f7340dd",
"value": "4.4275237153285"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086946",
"to_ids": true,
"type": "md5",
"uuid": "87c0f98c-c2ff-4ffa-8efb-7d6b424619a6",
"value": "28b9ff623b02f7596cf4564576009938"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha1",
"uuid": "b9d2e2a3-4f9b-4e7f-be7b-f8dd56d37ad9",
"value": "2d5145a5694e6dabce74ffbd02879ca657dbdc2c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha256",
"uuid": "32c334dd-bf7b-48e9-b0fb-89412319ae21",
"value": "f5a8d079615b1a06d900cbd6d3ec9fb4988d1c007634fcdc2bd42cd675b51fff"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha512",
"uuid": "36da0f6d-be6e-4b17-a982-6f81cd7acdd0",
"value": "a6d5a9d3f622d502ec30e85491a76589968b5f8a1c62f52257fe334d1643c7048bbdaef21a5c5888736f851bc39b7d3dfa13ce49a171fb7feeb4ae872c0a9398"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086946",
"to_ids": true,
"type": "ssdeep",
"uuid": "1c45af3e-2cba-4b47-bbf2-2ff49d579c5c",
"value": "24:rworPlT2b8OvhB5+hc6TRNot/PiTmO+SMxsyBp/AFxXqLAQADSh5b:3sYgDwDT2HSfJYsSp/APwAQAurb"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086946",
"uuid": "c3389c56-14a2-49ff-a14e-a9cf391c07ef",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086946",
"to_ids": false,
"type": "text",
"uuid": "0f686d51-677f-4acd-a8ec-f3cdd9c92c37",
"value": "INIT"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086946",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "f6d40ce1-8622-4b67-b3b9-47957e685ae3",
"value": "3584"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086946",
"to_ids": false,
"type": "float",
"uuid": "01e0a230-2a1f-48b3-b241-4832ac0dad50",
"value": "5.1718697425243"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086946",
"to_ids": true,
"type": "md5",
"uuid": "5c306537-3e30-40db-9b25-4d167e029dd9",
"value": "bf3aaff8a4f25625c50651a235f234ea"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha1",
"uuid": "9699addc-c80e-4066-b431-c5a8053a0784",
"value": "efa19aba8be359ef3d1671eea2533d40a8ad3574"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha256",
"uuid": "e0674277-451f-4346-a447-ce41208d691c",
"value": "0df32b5ab983d4f13d1f4d350e1a92f66e41350711886943720894025588ea7a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha512",
"uuid": "52b58145-d6c2-4597-b907-81d5e4d1a827",
"value": "b3d5d87dfff44bc6cbf37f4f514c223bff7229ac93342c2754effb6d6b5a91fd01939160e5ef37c5edb66ae94670b7ef9387004102d1aa6aa128a32bd7f31bee"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086946",
"to_ids": true,
"type": "ssdeep",
"uuid": "769c8e2e-71ab-48cd-99e9-2d6fa6007240",
"value": "48:qjHwcdILFDTZ8qNeDYDOjNe7kBtWt2BpRbD+KCm7MuINTg3nuO4EgdW/lLWfe:qjH4ChDY6A2BXbD1XN2EgdW/lLW2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086946",
"uuid": "67ee881e-d39f-42fb-a99d-5c55ca19a6bf",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086946",
"to_ids": false,
"type": "text",
"uuid": "5e06ebe5-8c0f-47d5-856f-8536019f6582",
"value": ".reloc"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086946",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "0864a3ef-08c4-4806-84a4-822fabc7368b",
"value": "512"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086946",
"to_ids": false,
"type": "float",
"uuid": "32f759f8-2ede-4ca5-9973-9360bf68189f",
"value": "3.6204816846131"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086946",
"to_ids": true,
"type": "md5",
"uuid": "ae036816-45bc-4115-bc99-a31dc9657662",
"value": "fcb8a85ae2d11c0aefad6b5535e1bc90"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha1",
"uuid": "084590e3-bb13-4758-9644-e4bdbdc9c004",
"value": "12c935664a10eea034a86053d7dad2c872d582e7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha256",
"uuid": "252bf901-28f4-4f50-8623-e0224a00aca8",
"value": "199727264dad79db742e501ee665c0adb8a5e08f70158dd23a8780663e330e0e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086946",
"to_ids": true,
"type": "sha512",
"uuid": "ef13ab02-6fea-4727-ba93-3c9ceaff1abe",
"value": "aa6cd28eb6eb70ef70229126734a359aed53a505608162ee9462c5bbdc9790e4c35336c52f39941988c3f7c9ee8b4c1d53c9e44b241bf2dd75cb827a61777419"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086947",
"to_ids": true,
"type": "ssdeep",
"uuid": "81593feb-0503-4169-ad55-9bc396077d3e",
"value": "3:X96q9llvt1CtC4/:0+6tC4/"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086947",
"uuid": "cb2ad8d2-4513-4824-98af-2417ede9f9be",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "cb2ad8d2-4513-4824-98af-2417ede9f9be",
"referenced_uuid": "6321c3b7-2f5c-42bc-9678-3404093fcc86",
"relationship_type": "includes",
"timestamp": "1624086947",
"uuid": "b901f8df-f65e-4653-bd39-3a4986701c42"
},
{
"comment": "Section 1 of PE",
"object_uuid": "cb2ad8d2-4513-4824-98af-2417ede9f9be",
"referenced_uuid": "e382fa8a-ec6b-42f2-9aa9-d0c67d3ce31c",
"relationship_type": "includes",
"timestamp": "1624086947",
"uuid": "4ee6c81c-6144-4e49-bb1a-e960188375a9"
},
{
"comment": "Section 2 of PE",
"object_uuid": "cb2ad8d2-4513-4824-98af-2417ede9f9be",
"referenced_uuid": "a5122353-0bad-4b08-9755-48619da51f61",
"relationship_type": "includes",
"timestamp": "1624086947",
"uuid": "7d34bc3b-30b8-4434-bb7f-25d7415b0c05"
},
{
"comment": "Section 3 of PE",
"object_uuid": "cb2ad8d2-4513-4824-98af-2417ede9f9be",
"referenced_uuid": "d20843ec-7a04-401b-909e-c26ebca453c2",
"relationship_type": "includes",
"timestamp": "1624086947",
"uuid": "0f30ba44-c4bb-4e44-925f-7173ca5ba205"
},
{
"comment": "Section 4 of PE",
"object_uuid": "cb2ad8d2-4513-4824-98af-2417ede9f9be",
"referenced_uuid": "c3389c56-14a2-49ff-a14e-a9cf391c07ef",
"relationship_type": "includes",
"timestamp": "1624086947",
"uuid": "a4032c00-fc2e-4267-92e0-ecced894646b"
},
{
"comment": "Section 5 of PE",
"object_uuid": "cb2ad8d2-4513-4824-98af-2417ede9f9be",
"referenced_uuid": "67ee881e-d39f-42fb-a99d-5c55ca19a6bf",
"relationship_type": "includes",
"timestamp": "1624086947",
"uuid": "eab6954c-785f-4776-8807-4b8080a80a5c"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086947",
"to_ids": false,
"type": "text",
"uuid": "8bb601b9-fc58-497b-a702-052865a2f4ca",
"value": "driver"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086947",
"to_ids": false,
"type": "text",
"uuid": "1826e466-0436-4122-99fc-6160dc473d32",
"value": "5368713632"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086947",
"to_ids": false,
"type": "datetime",
"uuid": "017ff965-c9ef-4bf7-925a-ae4782163bd0",
"value": "2021-04-18T14:09:04+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086947",
"to_ids": false,
"type": "counter",
"uuid": "0d725f12-a115-46ec-8eea-28a0f940d257",
"value": "6"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086947",
"uuid": "ed183e3e-ac50-4ba7-b340-b7cef8292189",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "ed183e3e-ac50-4ba7-b340-b7cef8292189",
"referenced_uuid": "cb2ad8d2-4513-4824-98af-2417ede9f9be",
"relationship_type": "includes",
"timestamp": "1624086947",
"uuid": "f9bcc175-7345-4868-8956-ebee58318a21"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086947",
"to_ids": true,
"type": "filename",
"uuid": "d35d5647-4e90-4077-acf9-6d9b8153e043",
"value": "f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670ca"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086947",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "e2774943-4677-446e-b8fe-4bd6769f6642",
"value": "57232"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086947",
"to_ids": false,
"type": "float",
"uuid": "805ad91f-22f4-476c-849e-6fff923e5d57",
"value": "5.6519636869645"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086947",
"to_ids": true,
"type": "md5",
"uuid": "66bc0aad-49b0-4dd5-b884-62bb6a3759f3",
"value": "a57e4e3a3fa46bbdbc9d803283af3479"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086947",
"to_ids": true,
"type": "sha1",
"uuid": "277e7e4a-86b9-4143-8a50-3facf3bed42e",
"value": "4ede7f018c317ddc6a5f8f935f917621668cb1ec"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086947",
"to_ids": true,
"type": "sha256",
"uuid": "44764178-35ae-4051-9092-b2863568e870",
"value": "f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670ca"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086947",
"to_ids": true,
"type": "sha512",
"uuid": "2ab39600-9ae2-4915-9e08-2f9386bca375",
"value": "96d6af8643dffe45a35c367b4eed292dffe0ad6cce9da197c547d856ab6e77b4b8f85bd3375c7d21194599a47d956b7c5f448ea148dd47efad854f0fe0fefa27"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPg501LCdQZx8mYAAJDfAAAgABwAYTU3ZTRlM2EzZmE0NmJiZGJjOWQ4MDMyODNhZjM0NzlVVAkAA6OZzWCjmc1gdXgLAAEEIQAAAAQhAAAAOZ0VHsTuSFU8uq8RcQfVUTYKVoh4ceT4WIIbGDmvNTj8/MP2/TXdqoORjGXmbLkVm74T5i061fRZ0Y/jVU1Sl3uWRNWAFGSeZqqfp8Q0suwAMHZ4AqAixVP3qSMVIWkNat3P+fnmSa9Tg2ygO2XPp1aY0e45YSc/tcPxLRfasNYuwLsuk0791fNr4IVqMXPP2gBiUAD7Nt/yczV2wXqIwEuOh81WwSsTPJgHIwx9gGcCDhEC4Xak1q+DAM9tntmSVsW+kLz7yPh0RDtXF/qJfvGTUhBDGUpiDY3bodoqzCaO9mlyhYIIkXo8j93HNnLLsAc4Q3tPbpZA9F8OKv6aS4GSQ1Qeq/nu4Rjp0bNXa5OxlpgUe/GmbhYplKF7j30r3To+neVkCtd6KqJ2yBC7ByF8DxqhvqObyWpn7CUs5E7Zt9zcCi0uLF7iya+cgvb5xqUxwx/QisEU5d/DhG3AFZFTmbEVHcduTKFvuye1kXoiITl80mHQ4ciR70GsdRlq5RMn6L1tghissM0LZZuRgYYR0ld9SbaZXhPFcCMDCscPN0n006oz67lf4GbWFNoM5hQdEtxuf/IocYuEIM2ftSb9GFUzhGrxqCT0GotMYLCDh9q1KbYtSCuQKvWiHKpoPpZMOPwHa+vyKiX0CGMaKeo2KkSccnPMDU8LG6KDLyYhVQvi/au8gDhQSHgfsg2oinSJg9NjbvcYhd7SaN2ClqByEkh95F+vLFia8eS+/ZwLdeJS4IlE/Js6MhsgMmPbydOPmobwAy2AFpqyWXkFXqxmJGMtHY1mro3ElR1ez3PMw+WxSJxesu8LMDXGczj+2UGFmwwWP7DP1bKKOiHJoX7eJFxBMWucUvpOWK/1cndZ/PN16D+W+DV3RNTGmgHD4ZjRewQWK63ffb+lGJdC4jMOFabR/+yX2b52sz3PkzhovzD5dgX4EDl/FpbkgUvamiB4idA70+dzTYosq1/Sn4MHt3ExCDqzmbyhG8adGBbSyDBE2vWPBv0kgsIniblNKjjqJqGcUANJHlaUuoZZMDn61Vuns4LZjfVyKN9q1SEH6y3bWHuhSXczPVnZ2VmJxTHm3HjVejTD0EJEBRRy8INI9cqkhwG/kEP+VQxEnpN7ZqH504aGoXu3t0M8qupok54y4imw74z4+Lz0T9ZlDk8VFUbm4GbFfdg6CVXWMlnTbtFXG6q5Trt9NCd31R5g9JwNT1cu6ekD3xRbeY5iezi5+BZvnb8yNt4mLACjcHh4N9OldJ4zpXYuLtyVdZgAaVjwBtWil7/bGURNqMraUIVvGZbJsSrpMcKyJVTWKbjW9d108mOChcWHXw8XxmaVPGnFDKVY578BegCW+bBjbSS2lFVpDq/PAzRc57MhCE7NU0Jyls3W3l+hV4W2Hm0aLZAKFCKka8qS7q2oGgKR+EGZ/oeeoLmjbwxXbEv7fLMe/Ptor2SnbYfkQZ+bVeMWFg5sf358sdJoBuMh9xtGPlab0EIzLxOveVGibTbM2ad55KtbuBu4QuhgcjcbRdy5L6HfLoPw0JioFuvJfXThFdTekHS8oEpaITOECToaGSS3v9G/bKdDqjmDNB71EVGjkmBCwWM7iOVP8/LvUuodDQG9QpzfgxUmPBIegqbYdQb5HjljZD+Xly/+Fy2GkUvBRBV68xm9B4bNEdVo30SwxCDnxnCeaO1K/zqd/ZwTHWHSoAAyUkTGjsGNrsyMn5Atq3OOdAyPtOUJd8aOOZk4T34MQuo9ZkPpqOsQ9OCfq0B/llOINABvyr4bbec7Uielvy9tZOjbulN58prvSm3hefcwfQuCQt0EJcarLwl3MfjSnKIe2JBSqhJtRD5ok0/l3XUzixe/iNd8erx698fej1tdhaMlRpl0bqM5NZw9tFCsqaaOIocOybI8KZvr1UghLseLN6/Fk/d1n3aDv0aLX4GTC9Fr2a1IQ7Z8PyKI73x1xI5sMk2fjS1wEITuJvk+r+SW2WDBQI4flhvR4UVKEgC65trlmgcxJR072oOiDj0hpY9HMC7dU15egDaD6zNWOJ/gUHvG0Lezp+0Zds89TtGHivubK02VEIYNCEPsaBwffw5mSHuOr1CG4LVSlTV4fBejAy/Al823PBYAimiKlswy2RqqeqefUGW8HHRR07X6mBLNtKYJVFBXSHnLdEFR3mwduqAoKN8ih7Ix/svu0NQsE7pIPZc6FUzk7wUUyg//dT4QvKBfwrUPJM+iwTS9GJvhzH857DMAsjdeiyeNhja2FkPKYhMRKSpf+m49FfSAJT452RUxXpi/MuHKxNvyS1d29lDPZzxLX1mscmA1xHVjIho/ojKMTG/y99mBmb1VPgdyAUUucoeng8jB4lJ8Jcq3ocrIme7hquUK4VnziI89uk0hbuHC2ZEr1mXpQGBDvU105cubjSO6Oi4ICrpqZoIPMsx3Yx4X9ArK1AmJ1OR8d52l9O/d+P0A3cmgA7Nk+fqeaDXBlz74B6Aa8sFharCC8sR5oIwHV7AcVXEw6OjZaTW6DUdrHWyBRx0uZnGigXJO2XIKmw1ElExw/JfCpNtysY2Ac0Np9xRCRe3fqPehX1PZoRDSgxzBaj9HXQl3Et0Q7q4KQs2VvM6xGjhNhZy9RKu4l0vQiEaHadYVWV4r3NMSUa2uejMntJHW9u+p2Im4Mz+cYiR7DnGen+yWYZe/6OYHXTVaU85XigUgxPUoBR/AMvSpamYyi4M852m7HqMCTkXXvE6wHk3iQv+q0fEJhqbLcNov4F5w5Xp2ecKoNmgMwgSQ6RnjjfsHdDbYKUIye/wfYoq8N+qpVfzqvYKYKht/yvunKjRpgcbZEFQX58b1NKiITx/JFvs0HuGC1ZK4U0lXSu3r5NiTmj6OxbBjdH/ZL/1yjclOVYzhTOcum2gpMUXTdOMn+Cm/jgCKOwvAUBSLrMsBhTkGLTVRsqIqdktPMjCLOF21oSDtb/j03v9SHXed/KUro1qbhk9awBlM8K9ZwfVpDgNeD8tg/++2p6jCUMNrlmHXFnHYyV9oPhAYz57ySrq+KZ3VjQiQnmLlXSw+vSlLxBx8HZJ926Gr9NKl/J8xyokOf0CTQmVaQ0VLI17do4yyHja28X9o4y5dPROb+k5PPf8ZrMHf/0nGud0fwm+/AOg5Zi6+ryVna4BBg6RbqQO8ZygEWZK7q49HAZui+YpM/9QJJF8jpPURuAjXHeu51OiiL6+4FBXxhofbrkL3zZ6gIJu6YQghJnKmlDXl5xd8awmy9qDMC8znOnd4m1Jc33J7KADqg5voMN9zohcVtolfUqxldKGDi1kIHCU4RFYK09q2lIIzjterEmBcIvIorM7se+nIEdGB5jvl1F/1yM4bIb+pDBpqyVrC++hYkHz0F27fEzBgoLN2SswYt+L7HywQgt08vYW8rd3IcKl7KYvgdlGK0ZvLSE+FoeK0OQQ6RWuhthkEmMlsTx7xWSmDXPNEKjXKvU5jmHLqDjMhZshdNv4yu1kYU8OG4Kes5loyAoSudL5PnpvGpn2LjA6ZlmWmKGeRx1ShCxJLJYvzsscKLE/Wwtu/L5TG6s/YmUGKzM80CplpU1K14aaGBOecEXqM2+Kv9S/Ofk+J9T4U+ujpE8rCdizr9lOsoYuPkjpP4FE7cQV80Hb1sSRCyY1u8N8uY1GHTyWd0ulZ8qHXV2Dnk//pwYccjHkwVmCi220yhqNFzjtSq9N5LTy2qlRvETKbrqjcviooBx2TWnJFcTLzogO6s1nGu/JOvZtOeJOre2a8f9OmATibu+vas/YM3q5BHjiAfVjLH8lbq+qTuUAOY80JLAd3kPbFURxDr4e1zPzhiZfXtmNAhXrQefxpeGRI7tYh9C0UltlYN98p/AaYp0Zhzr6ZCOXX6/r3ed7+C/B/p9LICgR1kiHjWvO5czrEbwVuWTnRKutkIdh/p2S30Mrk9Ca/sXNeJZ
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086947",
"to_ids": true,
"type": "malware-sample",
"uuid": "ef591383-5e32-483e-b90f-4e5250f46007",
"value": "f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670ca|a57e4e3a3fa46bbdbc9d803283af3479"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086947",
"to_ids": false,
"type": "mime-type",
"uuid": "339d48f4-35a4-4ebd-b6b4-57f151105277",
"value": "PE32+ executable (native) x86-64, for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086947",
"to_ids": true,
"type": "ssdeep",
"uuid": "9bebf81f-1a90-4f17-b313-709aff947b58",
"value": "768:y1ZqCQKy8IYdfWiUelR36ihR6nmRYs5ZjSyrNi7fb:yNyq+4lRX6IH5vi7T"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086947",
"uuid": "47b82d50-d85e-48c2-a3c9-3d34d0f9dcdb",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086948",
"to_ids": false,
"type": "text",
"uuid": "a8546e63-2f2f-4e2f-9c7c-48dcd6b73858",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086948",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "8569f4cc-d72a-4ddb-a117-3a173d12e3e2",
"value": "24064"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086948",
"to_ids": false,
"type": "float",
"uuid": "6168ab45-a42c-432c-9feb-e9f8ac6c2187",
"value": "6.3405794123405"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086948",
"to_ids": true,
"type": "md5",
"uuid": "5e74dbb5-0a84-4516-a4f0-5a8b7a8e5d8c",
"value": "776e79f0764eff801aae771252c3fa02"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha1",
"uuid": "30ed1beb-43c9-46dc-a00e-cb7daa88f6b2",
"value": "4024c296618817b9b35df8e78a2e610e3a7e2251"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha256",
"uuid": "7ec61737-8d55-4c60-abe1-c58ea3600a70",
"value": "b3a1f978c3c288ba58f7540ab0d596d698eb1a450a57abda3c1cc07e19114407"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha512",
"uuid": "48c997d3-88ab-4df6-b103-9a4d2f72e075",
"value": "a56dcd5211f03861d13d14f04142c262750d3717bf589277ab47e1d496dac3d2cbcb6a6627486a33bde3202ab1d42ede030d736f597a7314ec2d3db82dd79ca0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086948",
"to_ids": true,
"type": "ssdeep",
"uuid": "e4e558a4-3f5a-42df-a409-01e19fc1ba46",
"value": "384:h21YxntngRRPOQaniVXgMmZku8YcTTO58N1ZQdY2x4qyg+3h:hWetQRPOQaniqkpY0O5w8dBxmTR"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086948",
"uuid": "5bcc2973-c2ab-4e94-9fa6-c7e7ec195fae",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086948",
"to_ids": false,
"type": "text",
"uuid": "ae55d480-1907-42ab-8d3f-ae437ff7ebf7",
"value": ".rdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086948",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "32060bcb-fa68-4cbd-8053-e0986daf1934",
"value": "1536"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086948",
"to_ids": false,
"type": "float",
"uuid": "dd6aa8d8-7098-451c-a7de-3afc7813bf1a",
"value": "4.565535020822"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086948",
"to_ids": true,
"type": "md5",
"uuid": "06ae2b8b-0bc1-45ec-9eac-72ae4f556f03",
"value": "e0c219ca37595280d7640998b6b9c704"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha1",
"uuid": "d76693f1-4fba-45cb-b580-98abd609d03c",
"value": "e2241b5839b9b49217a5920b0abe3b26df755847"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha256",
"uuid": "2480a737-6a00-4cfb-a2ef-e63288161503",
"value": "d0342377ac505f37a21fba24e68195ec67e0cabaa5aba3ca18f6c8ac81337881"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha512",
"uuid": "9c954469-e387-4e76-8a67-e86d44ac24ea",
"value": "20d989aa10d27dc41464801f34a5ca1f2752b46547c625461aa9cddd5fe8ee9f7d58a7dd5fe8775e4c6a83d61a8ae84f5de119bf570bf89657485f1499766cb8"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086948",
"to_ids": true,
"type": "ssdeep",
"uuid": "3b8cbbc0-afad-4a4f-835f-55ebfcc9153b",
"value": "24:VuYWgpPdowf+p7n3JAlYHj4OoSSWMU1w6QO/OW5elrBSdNcSaFDVNyfwfQyxiEiG:sYbp5+52lWSWB1w6Q4OW5e5BeKSaZqs1"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086948",
"uuid": "69b9552b-6d64-4b76-a0a9-dc0f90cd6bb8",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086948",
"to_ids": false,
"type": "text",
"uuid": "2be9d9cf-053e-49ed-89d0-d22cf4a604b7",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086948",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "6c30d4c9-cba6-4ed4-ad04-44c33a56a5cb",
"value": "10240"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086948",
"to_ids": false,
"type": "float",
"uuid": "11545395-be0f-46d4-b7c3-d01d2637edc0",
"value": "0.6890836305716"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086948",
"to_ids": true,
"type": "md5",
"uuid": "cca3cfa0-5b03-4c6f-8aea-029044da8fe0",
"value": "d962b31f202d0ed76ca43a73874ee4ab"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha1",
"uuid": "1a7bca30-1dd8-4e13-b262-78cc80e9eb7b",
"value": "d3427e3bed6686f6592787ebe95d209fedc871a4"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha256",
"uuid": "e877e128-9096-4066-b496-28a005e362fc",
"value": "cd81fe7de212dc7357a8b316e2d9abf50274683592d4e97b84307f4e510785eb"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha512",
"uuid": "fb2f8a1d-4539-4441-8e10-e7430abe527d",
"value": "938cae1a8b0463e806bfa5d0ae4db760b6a89251c1ed4aac5a67c7bf32402806ce56351c44df8242bfe66a76e43ede0bb918c5e82f60cf10178891e4744ec29f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086948",
"to_ids": true,
"type": "ssdeep",
"uuid": "b4d590f5-53d7-4433-b61d-cf8f21eb7365",
"value": "24:25fI5K9PJtoa+0SC8gTMC0zVk1yu6wnffu6wnfX6/1nSBtN:smK9PJto8SbgQm196w+6wP6/9SPN"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086948",
"uuid": "2332dcdc-e184-4d02-8df1-e00055e7c435",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086948",
"to_ids": false,
"type": "text",
"uuid": "cc2c195d-988f-4e9b-8e58-cff5fb2b7539",
"value": "INIT"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086948",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "b1f4311a-1f0b-4ae3-88f9-da504b9a5deb",
"value": "3072"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086948",
"to_ids": false,
"type": "float",
"uuid": "78242e9e-9536-42af-baee-882eeb57f75d",
"value": "5.6744050867927"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086948",
"to_ids": true,
"type": "md5",
"uuid": "99bac18d-503d-4de2-8bf0-3ff4dd51608b",
"value": "5900abb4cd3dcf41ca91b58504b690d6"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha1",
"uuid": "7ba8222a-1d44-49db-9e07-c4f70b4411cd",
"value": "6c02d86e3aa6caf28bf4c17e5e9ddb0113999b78"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha256",
"uuid": "a371825b-e049-4b33-83e6-c5e91aea63df",
"value": "4a819123fe7f7360495dec76b6fcb73b105bb87c5255df7650b15421b95f45e4"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha512",
"uuid": "c9ad0f6f-950c-47d1-ad0b-4fd9044c6de3",
"value": "55fcc8138926964081972710e6ad7756dd42639dc25c65e166533c980720cdf489aa62bf6598e3ad871d12c6d5c7e0890c220cf12bb0fec6d010d755b4790679"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086948",
"to_ids": true,
"type": "ssdeep",
"uuid": "750caebf-06da-4d1f-8e72-ef5e554be61e",
"value": "48:OM2DYbp5+52l1DYDOjNeYrOENPMgFBBTd98bCMQem7zPaTgcV5iHrXAm/lLWfU:Z28p5+52l1DY6h5PbBBv8bCjTvTAm/lf"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086948",
"uuid": "fa1b96f7-95f4-41a7-8282-d51ea35a003a",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086948",
"to_ids": false,
"type": "text",
"uuid": "0d11583f-3325-41b9-b476-40e2551c236b",
"value": ".reloc"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086948",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "bb4242d9-8536-49b5-a1df-5383658c7bcd",
"value": "2048"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086948",
"to_ids": false,
"type": "float",
"uuid": "3a86afd6-e682-41c7-a4e0-1966d1298ffa",
"value": "6.678416291454"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086948",
"to_ids": true,
"type": "md5",
"uuid": "143b0031-5ebe-447b-9e3d-07f76894ef42",
"value": "5697b274e4aaa5fdec318fcc871f591c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha1",
"uuid": "85fef2c6-b10e-43a6-ba18-7a58bdbae6a2",
"value": "385859eef08a7554e5988d1c0a71b493c40bfc54"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha256",
"uuid": "d2f78f4e-fe76-46c8-83c1-830a201868b4",
"value": "a35fedda00d2ae53ae9fffaf7307f6307f7c9c91c4bcf51c6973b5391da8c211"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha512",
"uuid": "c25224b0-50ef-4c86-b9e2-efd8651e4c81",
"value": "a6594eccefe7cbd618ad9f03662c0cd3ee9fae5460ead576da8b902c6428f8a753132614c816efafc6b4b18805a41d2741760843e160fefae7029d2222eb4a7c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086948",
"to_ids": true,
"type": "ssdeep",
"uuid": "f745c225-67c5-4963-bb13-70f8b68b7fef",
"value": "24:yjg+3sYgvUduAGpW2VBpYXhzRMClFvlXfFwXyWi11g2q5GjtBe2BLfJyUNmZWdeF:hn8kGXZvFF1ZqkjV5JYTAw"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086949",
"uuid": "c234d4d9-40e1-48a7-ba2c-0b5f007a4663",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "c234d4d9-40e1-48a7-ba2c-0b5f007a4663",
"referenced_uuid": "47b82d50-d85e-48c2-a3c9-3d34d0f9dcdb",
"relationship_type": "includes",
"timestamp": "1624086949",
"uuid": "274406ee-af57-498e-90ba-aee31198110d"
},
{
"comment": "Section 1 of PE",
"object_uuid": "c234d4d9-40e1-48a7-ba2c-0b5f007a4663",
"referenced_uuid": "5bcc2973-c2ab-4e94-9fa6-c7e7ec195fae",
"relationship_type": "includes",
"timestamp": "1624086949",
"uuid": "088f5f15-e844-44eb-8979-3d527e4984e8"
},
{
"comment": "Section 2 of PE",
"object_uuid": "c234d4d9-40e1-48a7-ba2c-0b5f007a4663",
"referenced_uuid": "69b9552b-6d64-4b76-a0a9-dc0f90cd6bb8",
"relationship_type": "includes",
"timestamp": "1624086949",
"uuid": "28a82c2c-c806-44fe-98ac-9bbd8bf144bd"
},
{
"comment": "Section 3 of PE",
"object_uuid": "c234d4d9-40e1-48a7-ba2c-0b5f007a4663",
"referenced_uuid": "2332dcdc-e184-4d02-8df1-e00055e7c435",
"relationship_type": "includes",
"timestamp": "1624086949",
"uuid": "de689255-6f95-4d13-bc75-71caed64a2f9"
},
{
"comment": "Section 4 of PE",
"object_uuid": "c234d4d9-40e1-48a7-ba2c-0b5f007a4663",
"referenced_uuid": "fa1b96f7-95f4-41a7-8282-d51ea35a003a",
"relationship_type": "includes",
"timestamp": "1624086949",
"uuid": "21b72744-f69c-4d35-9032-51b27490b4e8"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086948",
"to_ids": false,
"type": "text",
"uuid": "5eb030ca-27b1-4db9-af22-4dcf72f4037f",
"value": "driver"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086948",
"to_ids": false,
"type": "text",
"uuid": "7507e749-6628-45f8-aac7-f1c9d9d427b2",
"value": "4198720"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086948",
"to_ids": false,
"type": "datetime",
"uuid": "a4f02c99-32b4-4756-8c1d-a0cd5e5eb666",
"value": "2021-05-15T12:44:55+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086948",
"to_ids": false,
"type": "counter",
"uuid": "d4037530-e35e-4d07-b3a4-95e1fddf2bad",
"value": "5"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086949",
"uuid": "08c1c0b9-3f26-44b5-9181-1bbb71a9b921",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "08c1c0b9-3f26-44b5-9181-1bbb71a9b921",
"referenced_uuid": "c234d4d9-40e1-48a7-ba2c-0b5f007a4663",
"relationship_type": "includes",
"timestamp": "1624086949",
"uuid": "f60c4d07-b878-48a6-86b1-b684d07c3ec1"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086948",
"to_ids": true,
"type": "filename",
"uuid": "76143f25-913f-4c4f-97e8-37ede01f71a6",
"value": "e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086948",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "338c2a7d-ac48-44cc-8b07-1e16b5508318",
"value": "50592"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086948",
"to_ids": false,
"type": "float",
"uuid": "9e88d675-9bcb-4440-85af-de1854e806e1",
"value": "5.9300117079501"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086948",
"to_ids": true,
"type": "md5",
"uuid": "f8374a99-9a55-4ad9-bb29-4dffa8377fed",
"value": "cb34374f1b5fb771076872c6b14b7501"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha1",
"uuid": "031c91ba-b657-4293-8d46-8d5f292faaf5",
"value": "118f688c30a2f6c2d1feb955f53ce4acf3086b3b"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha256",
"uuid": "2d2c16c4-3c99-42a2-8c2d-ab050a8d7bbc",
"value": "e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086948",
"to_ids": true,
"type": "sha512",
"uuid": "bf7535f6-ed05-4a48-b8ef-e0afbf19344f",
"value": "6d853b6a191c6277e54f661ae50fa7421e8dd8d9c7b55b928aaa320cc61baed57b3d8d9d728dc9e3b096b04a3de3f9e7914d8b04a30dc2c956b3d65b981a08ea"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPg501IwABatYVsAAKDFAAAgABwAY2IzNDM3NGYxYjVmYjc3MTA3Njg3MmM2YjE0Yjc1MDFVVAkAA6SZzWCkmc1gdXgLAAEEIQAAAAQhAAAAy2rLJjShTcONkx+0Bek2DrKjGRGdYi3YOdwISPuZ0/F/6+aNwsWWJ0RMPHdh+mssMfNa69DOuzC+t2VSLlxGZfxRNXETAuuVaTEMkr0YjGZWIa0rorKcbae69pamabAIkuPR030pNt4WkFzWzrW/vH3+m8eu0n3ItLmw4Ecs0V1C0T2rt2rXzoCeNwHUi1BnX6nqBQll3dYjIXZrPDXYKVAbQkZ9Ke78Va3ZMAoLsEKYEDgaqSQsvlziDS+CyuU9+yAobtab0Cc80lBwQcM08f1FTxgFZQnc6PWTYUTDbBaFJ6+zk9FeE8ulvEBN3VxUzZ3G+cJZlZfxOkAbxvYHnrOAAF5pJJzAeTAF41njib1mSoeX8ifgPPNBSZ5JKaUZKje2ySsHIKxZ61JDeaPxHiWTNe8qlLplALjwlwRXZa5Lil61i0xwjMiCdlX5mf4Y0Fj8kC+khnv9uI0iutRwnGYK3loiJ0R/01jdNCFdkfVbe3EnNrxtEvUI3v1qZLWNqZByO0NB8WSAw8kswVvkmrLSxNFHjiPqmVGjsVmVYubpRNsE0XEsP122JtZdM5CIBQHnatEU8qoS3IlOA5uFW19ZQZD5+37fLKFvAvsk/zEZbsSeDzOOivsUiuOldXzveTMhRr1vqrvQYwXK5h+TdTeTg7VWW4Kxio5+XcEqNPWGv0pebtwKpgeqMJP8GEYraQdg0om5m+ZOnXm9eHdpi/cEpchq5MeMldohGAd9cnbvcGpfOwU1jCQaD4ym6ZlJ3hxTiRj3Kj7sfAa4Y3nINkMPy81QlixCGEZqvrLXOQjNBn67k9HniIrI6hJVXM8SK8LucXRdMJiFDE3WEnYFFmBYJ0N7ucBHDZOwBBVpqC2Dsd6ZE+fjZGmLlN7yLM+6A+2BWgdu86FcYUck61i4KxLLJa6KenC2ypoF3ActKAlzhduerTtfLHNurMt7KdMNrSDZVJwrJ/G6hH1ltWwqJ1Rba6XzaA15Hr92N22qOmX8X/fX5AEmbw543SGtBJmHsygOI61SKyqX4bI7AJCuwEjZRMyscioHz8h8yH1z/3WHJs1y1yVMsDJkSCt19Fhnh+qn8q0FVkdGPUw996957SAoI/wk29aDX6V3NH0b2tvqwrnXeVmaQdq2p+rLQlL8umiBW2dPK7mdrw28VMmrWrua7QD2nQRdlisrQ0pjJcv1HM1jbiPaWim3uj31Q2fyQRqU1VxSxbf/eAZ51yFOB6HW3ljEdeTSkYLHitUrIXQs3VHAH5jvYfdmgg9UVVBwvfNAcsKw47crQwOBS6LzTzpcbSXsdY76ABKHmRrsHnBi51enBZvCDdLE25WdvErFW3NkNFLnqojOI8ZzCbBH9f2NDnJQkTesa9+iBiQyamVAjiXpUDOSwfFgcftspoSUu2Zq1PHCXhfarfJHw2fAsDbEeB9mx21gQMpaL5zMFqJ9q6RqVzLXWFTALzYBCtVfzdrhpyHAEPHsEFzgaXDyPz5Gbp44/jWDClf5YnJgbSLov7CTwSvnwtboML4K/BjbPz5LRlbsRDdO83fFETNCHXtUJ1p0Du7xcXi1vfJ4xTiypf0pIT5v6vEeoyFBLs9qR2qhJ06VzTaeXNCVnwOZTwQhBSw1Ik9O1Qb3jVLwcGiH/nIPAukwBhfvsmVRfbYmgYikW6Kb7kZlOY5lnzw5q/SZGY230ekZJq07UluA13aB6xx8yiPs3a7iW7IgvbGC5VFG3TgI8vSE4G/ZlbQM52R7QUFrGRPTmZgzdoVL1TvnmK8eS8agkB/JhrSFaaBET7ifH5DzCpflKjdBVHP4Zu4KTGflvcDz3aOCjagVlUyo9Kt9mtvegSWQYYSXcQDR7TxLZ1XgWjwVatWJg8gtDxEpqab53rgnVgHVQmPX8Z6B5idgk9JfQrEzzEO3sgBM05zJ5S/LQlukg0NixiAxii2w2Ftp4u9Rxb67bJhpNHc5IaOQ4s48BGy2x0yyCAxCppjvRr7qJN49t7UFZdGtCo5ttykjtEwizytdNfxeViQW/sdCVKij3OpGozm+HJtJO6OqrRYgR4WQwYUqDPEFqKyWguZ4DizTNfBkgbd1nBaYKrqX02L/LQ88HRrWPZZzvjhHRLaUVJqM0zkXjNT1BGOJiAGs53Pt1yqrBLuWL4FIXD40oihn10JXvnCQMp3m/8BTTdRhJCB80CFU+pEGR/muZJ1+VXC7qkI8qQftnBMW7C3J3cgOYZNl9tE0jIcxA07/C56lYFGNv6re5FqlnbCUfu+0rr8w286RhVZyGwp9TWKZ8s9GRGHKHhyQWKcwSvZByJ48tZIRM9Vce6xxO4OjQJSi51Zv2wNS3mwmufXlxTBs5H40x+ikWp2E/U4K8eXy191BAfDHZQaRjfLXt9EqhpL1nJN/RAZpxmQipXRBrQiLlEw0Rxuc6rY8QiNbRzC7pXzGQNtsIvC54bNaM+wLzkIhXbqkT4dGkkmgZET3IWbVC0iCZ/Vu29bo7hIUpVNDriNQbk0MyOQr/+vnC4cnG4tsrwagE4D6hR3MJxXjwaLj3XeS33+A1pTlooh2qzBx9HXlPEbVcXpKYoMH0t13tK8xnW+14fc8Pa5eBPBrvv9zHu6Ol6ws6zoWSX3N4pMlShXMRRpx+Cuef/AiPJv5JIqdF3/k47Wkk+uA9TBpBqmnII0DR8Au5e1wn2S80W3mmcYn87U7qNq2eoklmWwRrKpQmRDaoORFVQbeZ8403s3fkk0QWyAblbYC4oCujRQRxj6RcbQTBu3WUq3oDB9S3EAwfW4iAB5oRJt9QIe+UgjRKJcTsOGl4dSzOA4/+jy6s9yC6w38+PuK/e5ffdQbt+c/IrNcKfLXIHgJtxffGvbznXu36MNDoC6y0VJ1fza7Kc4YQxnFSUN5cSS28oEhtLLVOD8T7K9oweJWha7bgi3Grt+kUnu6zvphqDvdxDspiCbn/nIx/VpEqLJrPm5j25ozkWIZKoNjQrAIFrVLcPfOFaR2TlOVgDWNetrKl70RVdhjxJb0wFlefwZ1DNqG0/qUOAk41FmB67S2f/Nujq6bpvxbasnYtAE/KmH1luj+2j5h1UPhKeS9WaliGGX//PNgxRu3NCtUooxRQN2kz3eLGVXP92tLTT3oIIhF/8r99NfeM2yOwAOxl+vyeW0Nabkq+sjb06m4Qf9FPce1z23Nd0ENsYh56PJ3Z9dKA3qv9P4ktkvlZGhEgnbwNTW6xZBE50JMeg9d3guxiKwh0WwcVGaIduUeTD2Rsb+W3VlLUsyG7GDXsV2NZaIgPOYsk/k6c4CJUnJEraodRnCGJSFyeGCWnGbr8nVzoLdUjy4M3x9kc/9bbrrRNU/mnqAoEpgloA3lnS2ImCjxBEJ7G7mxSnSI9rZBkrUYpnBh+uaR2Wrm7MKTxYsHGvoIZioit9BM2vyD0kUmfGnPap6QexU6vOE1SnEhxYXUkg7hF/vhHwGLu02R0aZCPfPNQT//0VV35OdxvmXGWX+xUxZPQH+eE5z07FFwTV3/ICWbiIaVECLAcImtgJZbtlFcjFDS4OwenB6aSBXMIynzyQ0w2MkVfWVwKeJqIirPkBpb1xGsFxDK2lKrU7/B0wzv94Oxp7WFhlJC8mq5QrEcAQM5O2aX8vSNbMQM5jObyvee3IcL9GBzCaMfOCvvGCqwMEoaDr0eVBR22iBkVHF9GIPU6Zpbj2Rf1OC7/SBHn8RtKQxSHgstTcELvwUiVI5boPSvVk+zBFSz+dxk75Ozx4sh5D/tOAohaLqaa2TUXJCTtpFFvShc3PE7YVIUuM8DNzSXY7oUtlbHErKDviEY7m1x5ud635eY8dvMTZsyOksTMCkkWdATIH1IVDUfEryjKmhqaYcLUv1VuShjNhEGeDHMoRh93/zLfFb9a/itLROpn/U7WxldN8tzhikFan6+6Bq0pVuVAEjQktqEDZr2uAcfBCmvAZ
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086948",
"to_ids": true,
"type": "malware-sample",
"uuid": "34987113-b258-4976-93e1-8b36be766aed",
"value": "e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37|cb34374f1b5fb771076872c6b14b7501"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086948",
"to_ids": false,
"type": "mime-type",
"uuid": "38697109-a151-4206-adf1-21007208d100",
"value": "PE32 executable (native) Intel 80386, for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086948",
"to_ids": true,
"type": "ssdeep",
"uuid": "b43109a0-783f-4850-ad48-dfcc679773aa",
"value": "768:8WetQRPOQaniqkpY0O5w8dBxmT9yWU3jSPyyihNfVARbpn:8WXOQwi6wEBxmTSp3Epn"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086949",
"uuid": "d40bd6a2-0eb5-4796-b699-dffc2be4b431",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086949",
"to_ids": false,
"type": "text",
"uuid": "e8e9a949-fb7d-43c8-b254-6fd99e5e50b3",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086949",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "c8c7c6a0-28fa-41ff-9055-256f7966233a",
"value": "5632"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086949",
"to_ids": false,
"type": "float",
"uuid": "ef19baca-5dbd-47f4-9ff1-6f08f9059e28",
"value": "5.058013904165"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086949",
"to_ids": true,
"type": "md5",
"uuid": "e4cb9d1b-c263-4e72-a848-915a2fb877a9",
"value": "56cda77a320b3cfbbfe5e1eb818f8abe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086949",
"to_ids": true,
"type": "sha1",
"uuid": "69af45bf-182a-46ac-a524-b4ec1d8c9d9e",
"value": "0d2795d63eff30382c17a44639995b5e56564ea2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086949",
"to_ids": true,
"type": "sha256",
"uuid": "1ef0dbb0-22e3-43b5-a69d-4b2d6b8d8949",
"value": "d3e92988e0c616f054220d238b76a4a68f15547adc7f9b1e8c5abc199c306706"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086949",
"to_ids": true,
"type": "sha512",
"uuid": "89495fce-4d4a-4bac-a73b-4fd20c1d0747",
"value": "18b1856853135518a06e4c1467a569e47ff551f5f9b3ca528fd3896f0aeb93bde3b54439ccc5415025d369f4e0b95ae73ed8edce493954b8ab83c7f34bf30ac2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086949",
"to_ids": true,
"type": "ssdeep",
"uuid": "1ef88778-55eb-4424-90ba-94913ec617da",
"value": "96:wD0sc/cytcPa9M34/L6/sGVFx39Wot0F5ttVAZ2F8patDLX:wacytIaG3GO/pVFx3ci0Frt+MF8p2HX"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086949",
"uuid": "d7bf8eb3-19e9-4aad-92b8-3a95c884e22d",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086949",
"to_ids": false,
"type": "text",
"uuid": "c03f69a2-57d8-493a-92d6-fe16f99cab5b",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086949",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "f82071ff-68e0-4cdf-a806-0e560e03162a",
"value": "109568"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086949",
"to_ids": false,
"type": "float",
"uuid": "401675c5-1907-41f8-826c-6a9c24bae37d",
"value": "5.8367064851345"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086949",
"to_ids": true,
"type": "md5",
"uuid": "62a8d214-05dd-48e1-a893-79cc877fffdc",
"value": "c2f903dd844c290e1778f9b1956b5e3a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086949",
"to_ids": true,
"type": "sha1",
"uuid": "cece7d80-a32b-4ba6-b436-6cbb9047dbce",
"value": "7411f92a0e96519a2c2babcf23af488251aa695b"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086949",
"to_ids": true,
"type": "sha256",
"uuid": "b391fbef-13f5-4cf5-b8dd-d54d5222a180",
"value": "d126053a505dd4be9f4f6314a2f513a39fa8c1bfd472fc01d54fb41433d0eafc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086949",
"to_ids": true,
"type": "sha512",
"uuid": "5408850f-a2ca-4d52-a471-7935ca61c5f8",
"value": "04f186bc509f54305963cdf2200efe4660e926d276c4cdf3450583c1e2657b23bbe00f1e99c503bbcf342542c1c996961fad049d56fc337425dbdf4177be810f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086949",
"to_ids": true,
"type": "ssdeep",
"uuid": "d18191d6-06c0-4e04-a427-ca8d2fe3dd0a",
"value": "1536:QWXOQwi6wEBxmTSp3EpoNyq+4lRX6IHOSyOVi77:QKOQwNOT+eFq+4lAvOi7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086950",
"uuid": "f41bb4be-9919-43b6-9196-0840d368ee1a",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "f41bb4be-9919-43b6-9196-0840d368ee1a",
"referenced_uuid": "d40bd6a2-0eb5-4796-b699-dffc2be4b431",
"relationship_type": "includes",
"timestamp": "1624086950",
"uuid": "9aa3a727-ed99-4e59-81fa-71b48caa0282"
},
{
"comment": "Section 1 of PE",
"object_uuid": "f41bb4be-9919-43b6-9196-0840d368ee1a",
"referenced_uuid": "d7bf8eb3-19e9-4aad-92b8-3a95c884e22d",
"relationship_type": "includes",
"timestamp": "1624086950",
"uuid": "aff04ab2-d00d-48b1-b2ef-9d471e0572e2"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086949",
"to_ids": false,
"type": "text",
"uuid": "8ef22567-a81d-4ddd-a99c-f4ae9f57f741",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086949",
"to_ids": false,
"type": "text",
"uuid": "e3564010-e32b-420b-9465-bd8bddd89d21",
"value": "4203264"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086949",
"to_ids": false,
"type": "datetime",
"uuid": "f10f22e0-d92b-4068-9d5f-23e3d7fcba5e",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086949",
"to_ids": false,
"type": "counter",
"uuid": "33d79be4-7b39-42a2-ac90-303a63f1fbb8",
"value": "2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086950",
"uuid": "54cced0a-cc7c-41ba-890d-b043db623bab",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "54cced0a-cc7c-41ba-890d-b043db623bab",
"referenced_uuid": "f41bb4be-9919-43b6-9196-0840d368ee1a",
"relationship_type": "includes",
"timestamp": "1624086950",
"uuid": "95227298-41c2-4e8f-96e1-64414da55459"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086949",
"to_ids": true,
"type": "filename",
"uuid": "8cec06a1-51e0-4f9c-a423-fcf524d7a719",
"value": "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086949",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "eaae972a-ee04-4007-9d4f-95a59d68baab",
"value": "115712"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086949",
"to_ids": false,
"type": "float",
"uuid": "eacdb883-ce0b-46d8-a83b-007fd838447c",
"value": "5.808363900185"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086949",
"to_ids": true,
"type": "md5",
"uuid": "0d1e725a-a7f8-4f0e-92a6-7af9b0ad7189",
"value": "1c3db7002523e1acd621c90701c694ae"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086949",
"to_ids": true,
"type": "sha1",
"uuid": "62f5bd4e-99e6-47ff-a11d-46997cbc5d18",
"value": "aee092fd31772d33932a7a02dd2d73ede67f7db0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086950",
"to_ids": true,
"type": "sha256",
"uuid": "8d94dc6f-d632-4511-9ca6-6b6b0f3a2f7f",
"value": "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086950",
"to_ids": true,
"type": "sha512",
"uuid": "2a03ea65-cdf9-43f7-973e-61ade474a1d6",
"value": "e94cd7fa788fa2f828dd40fe096b25655d7b8fe9fd948c5b53f6c30039ca0b9c309ebf8619c0de6988ef5efb4db0b0683c9ddc63ad200aa5e88b8f01a9294f1b"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPk501KvDx/0BdAAAADEAQAgABwAMWMzZGI3MDAyNTIzZTFhY2Q2MjFjOTA3MDFjNjk0YWVVVAkAA6aZzWCmmc1gdXgLAAEEIQAAAAQhAAAADZJvNF7veREJWj0+33d+3KFVMIZI/Zj1tjEXGMBuVtwArOpQJMV6K60DRSWHfdxaE6QlXlRKQHCC2bD2Roql3sCh1dlEtSSh5wBq2irWWvxndhJixVcwtv+b7++7AK3y0o/eWvoUP2sBBvSAnyqJjuo7abfHNjnw8d2bIw+lY55h744B/ljKbDEXGazaMxC6+ONCYYMJsqdPaZqCASErbI0idz4K6xpXcd/ENY9j+93BH54Q8uKMhauzfFBsoaFc5/j6H/AWz5dPClYMhNB0QssCElvBL+NjkjBz+Nil1UDDgLpbK2TEh5+plF9HCDHuX3kRtjUC0zTACddqSuv2NZL/1VFzs0/dIPsSXrTJ/aJXBnFtOt+eDygMnlTpjrfIkT3xxECSEH4VZBG3EElDgPqydCkVPs9I5bqhoR4+vMAI6Wrb4FokmUu5nswxbOnQiTl/aTXcDVYR0kCbBYGOkgaTVDkvFD6MjYIQKklLjDpvqo/o2Mbsh7pBsOlApI4f3aAbwI6vwly+3PeM7mwKAgx3kYISZffaNbbyHQX43F2/9VZ7rosvOF05y+wIiJRaK+lLJlEDT5RSy0Plllhc2qaIMsPyg554bFNtfhsdphxSLpNUhBHD83SG8AHTvgCUJb3OURsza/EE4YngQmkoHJaIJe24i35xHlZFFUVt4YLfSK/GRgc8roW7y9jIOU4YGGq0Nnmmq1Zuv9sy/qNApAXTSKZTgTLYw4vB2OpbdwY8BPhZ8qlbIua+a+gxEgVGT9fidQfhFZMJ/szw7omVyatlbkyH9NJJLX33wt94Dq3KNIIKooVfaiTRgtfZIU+KPNiq5MtBxkHerrDnbj63cFOWBOJxBtX3QyQH/TalrxelqM05HfGXcep3Ryto44dMDknkiYgqwIsv59rHHsLv6PV6mQDom/aFMzDZoUmJ34e0JOgMPvwpsQGOO26daOc/51m2/jpXorHCOzMNPz8nfkvLBlwc6oCda91KeFt7c+geVEHpMr78AYv9W0IPaE9FmYPX4hAxvQVlj+/TENUBs1YyPLNuBFjA2nWyJl2IKBHZfAMGfslTwwBbDwMRE2g7jhlm/TWjEmX/sgfXpN6eDTS1Vq3z5eginek8RxlCBWO6TlZl6H/NgfPgDnoGwLMIecv6UqToj2p5MHlD1vqv0PaxeB2jOOgrEIFmuLtLI3KuYKkMSG9OgtSK0soHQicj4Kgl+DKETeYg6MLux4bOfYqssA4Huqv82IwKln4cz8fCSGmKDQ74KMFnRvmMApJemVf3B1sRAZ2ZKAv0529LSX7NT/rcLWTO+lv2QD5dve0e1JsZimy7YJzB5RMdLpw3d3x+uQPmxCXdvNlIiYoizxsTydUa57tU8Imc/rVwIRgezwR33aGPnYwTjlBNNYI7K5iaYDUTj1u3xQgbgO6BiwDPYC7y87UQ0MS7SU3SYk7ETI+TrEJ2RfKQQWkejyThDH9amhUmgQY9wYOhqwjGjLYjtzyQV6cknndG+rdICRLFzXS9utfJCy7V0Ecwd4ZUrHcqsfgwKgHjPgI2nyWR//1AkkM9+LkcuKHOrcHcIqrSa+5bbia9JvUM52hHCvEd/yT8YrhifNvSFmRUFyOP0K0csozF0bvR1/Vc8RBdRq9Enzun5MXHFtFmpgMm1DMqMMRcHCJcMEvyfPTyTYfDdu3rK/0SI+Ba4mzA9A38Vc0JqKLjKhshIiM0VnaKfHE0n/wVtK3h0T0of1iMTnHGy+03vJ7mbV0OOzP/XMNQbAkMBbWVX9sjOtkjQsVfmXogjVvDnyEe+8SUO99pNi1rSZSIuZY1bKvFI9+JmpneBjUiOI/5vUxHu4YJiF+vKBFvGobworAh4f8osDRzZ0huvcBGGmUXM1Pyl6ngGUDqZzIhc3LO3d0Qqcyy8iVKClY26CJVwLW2/NPxQwj+Gukdad4uLR0UJFoudhjYILXtLf6NdK5rDuk4L7E3jtaY4uvev78pIb0OlYmtqhDLmUAlQspZqRG+S5XH8WoRaxQ97rxyMsux6y02F+N3Nepp70ruDBXLSbDb5lYE51N/d6iOxGuXUJY2adLlSpH9m0oUhYqsC820hoWlk32Kna50bZVZkb6Gg6fHn83kU9h9BVPmm9BUxeIjjcKpriCpjC61Y+Rz9SwyBOoBqQxtSMH966A3fnUbJ6DrpFEZsCj5ciglTYOO/aGV/I5XXpLho+YRUlLMeZjJUU79oJTW0INfuRMj+Z6D2JrK1TOMb8plKNqVtgkp8AE5/TAhyBzrJ1Ayi27IcaC3f19sM1OYaGwgt7Z6Ga4SFANjVj2+EEGlPw+Y3ApqNUVjwsUPhmPWgYW8MaR31+hwNW1U9blrBB8KlJSSxZtMsMQID+dTHzzP6M93Se9JgSpxepxWdRqqJ13eHuz2psoICFp56FmkE22bY8B8x5Si+LR1uUCawWY2MZQSIenn0MbPT5PcsAE06Le1Z6eCheqHllB9E8vFJllvWyMZczYyjVEySdDEmj/LBdgfM2tneHRWAGZy5Px4gQsjVgNjOEIEHwDFFEj1VBie2N8iBAHhebMnx6GlJvRPVe4/lnAz5LWAAYijpCR6lA/8STPC1lkMzA84I8z4IDjpOCmgUMeQl8dhCyYLv8m7ZIg9jnTodr22Eip/sv4AALmAqtECa/JnXx/Pwpc71pIdnWz3hntIev52X6A5d87OmPy4kRXom9AzpWbyI/NATEAQcGOzfFy0kuOCRXktdAjKZeB1WlhjlXbcMsdvYZt0u/wNHBJTF4/F2y4xFfCe9Lf/6iTxmV9kB74QU+tDECoPv1uQo2DkGb4nBIefCS4IbTypI4RnH9Z4ySekkDxbtLrtiXBqIenZ6BF43gzc+iY62eMZkHA2MIXtpqZKCjzBFp5BophDVEX1Rg0MmyIHOsZXjyogF+/oqu8Yr3hGzhPkFr921qPIpSgrlaISOIdrMp1EzH52BviAZWAAIOb7yTy6jWPG9Ex7DSOyEcjBZNA+jUTrPihUO3ctVhiEyJNFVLqs1U0h1S9hyWJqs9WeAAfid/XvWcdP7vEvG0nHfC2qxDtMvtvTFQJMVu14TKrN5FWhSXpUhtR3UxwvNGDFiCm+hLtrzfnNu0BsQOz4JarsELhGB0ukeOaJLI1QOxnh1Jnvaps4hrSoBDaZG3RL8Ms8dZM6gCJpffqJmPyLR5A8sfVahSRzBn/EQj7nDJLCrKH9a9W65FSaJGl/qunpqp1L+BWayc/lP6tFXSepsLZATD2DoMJ27zwcTxCsWpekAdoamzBZ1XSkKaS8OGqEKzArDUXliAL9P4ngzyB14KmDIx6GIKC/KLQdnJzUxLlrfhloUZM9Qa6+kFGqo+nraMmwuexoqBuDlFEC1gGUN3XDaYvtAzlQR0I4k0EtTpP72GvgAi4cm0jI5cMYNwhVlJwt5JBGxO2i0lvUexJZ5dgUtzhhIjVDc8blhpuOVldvGi4Kce6E5N9MB6YAczEUerrP7O3CCjMNBDkDwsiRDq2jGPfHCkU8Bg5DmBhBZOO4WcwivBG5Wmd2K37nGkGi13tvvBuMU1Dj6+8ZjH0DTYsbhDVmT1KkaY4c3WHTaQ7c/dq/OrZ8jTrXmImnwx49Et/qchH1mpyJ5V8BwFuoXrcUFAd/EvZe7+Hkn0wXeCyoiW7e9p+6WSGEOYBQ9c1YPtJXG5BxdFFGTGy66UV/xDx6wpBwfOtT21lY4cMBKrgP4ZaWN+QAzWZDQ9c1BC6G+u5YO6tG2H/q4l6PHyHFc1ajFVZubnxPox9gFoysE++rowr1KWm126v56jwFf9oVdpM9MmxqDCOPUIVHQuXXMpKPdx9+Qi0dBssaDlCZndL6tMB+2bNr2qqL+qg1b0HVrEXAc0GWo4205OeJ4zBmW/a1C88zDCbVMWJUT/XEjaHPKYmHxsJwDBgE7UN9SpkPclNDveC4G4M8nd
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086950",
"to_ids": true,
"type": "malware-sample",
"uuid": "7d114d9a-8cfd-4919-b6d4-3cb790533644",
"value": "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe|1c3db7002523e1acd621c90701c694ae"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086950",
"to_ids": false,
"type": "mime-type",
"uuid": "26056e7e-571e-4fa7-aefb-eff4ff674721",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086950",
"to_ids": true,
"type": "ssdeep",
"uuid": "1f19a9c3-7eeb-489f-9e9f-864ff9829dc4",
"value": "1536:HL9RWXOQwi6wEBxmTSp3EpoNyq+4lRX6IHOSyOVi77:rLKOQwNOT+eFq+4lAvOi7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086950",
"uuid": "c41067d8-f1e0-4a79-b653-b1de3a333983",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086950",
"to_ids": false,
"type": "text",
"uuid": "7f478b35-0275-4416-9590-e6f5013f4505",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086950",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "d64d1dcb-0752-44d4-991e-9e115c13ad11",
"value": "6144"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086950",
"to_ids": false,
"type": "float",
"uuid": "09698219-24b4-4661-a4ca-bc10259e574b",
"value": "5.0216588985258"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086950",
"to_ids": true,
"type": "md5",
"uuid": "7635d5e1-6de6-4de4-ab3d-9148a3bd258f",
"value": "d95c252424ff0222f4e9aae3ad461c57"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086950",
"to_ids": true,
"type": "sha1",
"uuid": "8843aefd-0ca0-47b8-af7b-780140bcda26",
"value": "694eaadc11895e88b9bffbeb250a95b9913c2917"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086950",
"to_ids": true,
"type": "sha256",
"uuid": "d02e3fed-7c73-43e1-a3c8-5fe9f3f86417",
"value": "761aa5997b2fbbf52dc0225df16a0ba111246e31b7915d3e8dc316adc0b09bdc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086950",
"to_ids": true,
"type": "sha512",
"uuid": "e02ca84a-3de1-4a50-bba5-7f0f163b4fc9",
"value": "ee20b57ddd887761a758d8ba26e0b4c641dae84f945f995ff3dabe3e51d5dd9b11c7614907e5b99c075cf9139a2ceabd05430240d8fa12dfbc96dd64f8a3359c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086950",
"to_ids": true,
"type": "ssdeep",
"uuid": "c5ec40c5-39d8-409b-aba0-ea4a9e124b3a",
"value": "96:bJhcyN+iiPca9M34/L6/sGyGOVCTAy3L4i39DEKdsVPTilD3r:bhN+ivaG3GO/pyBA30i3X2POlDb"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086950",
"uuid": "d54701ff-0998-4d1d-a226-52968b38688e",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086950",
"to_ids": false,
"type": "text",
"uuid": "75e744c1-0359-4e78-9bac-7d570c2b5b35",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086950",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "9aac0cb2-4310-44f2-82a6-277e4ae30ea5",
"value": "5120"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086950",
"to_ids": false,
"type": "float",
"uuid": "be7e74dc-1fe5-4cb6-bd58-65a72f7f9111",
"value": "5.9696789438541"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086950",
"to_ids": true,
"type": "md5",
"uuid": "df3fb9c0-fff0-46ee-b863-b7e0a0498149",
"value": "5254471169d40804343c29a0c7c2c756"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086950",
"to_ids": true,
"type": "sha1",
"uuid": "91ce8303-5e8c-4cfb-91b2-2fcd2f50a02c",
"value": "b879e7313f3d05f12df64bb127636e6da1d6b13d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086950",
"to_ids": true,
"type": "sha256",
"uuid": "72e90c64-bdd9-4d15-bdde-b27664136af3",
"value": "e05febf89b27e15fff85688ebe072fe1c21a909a25c1c950283eacef1db09062"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086950",
"to_ids": true,
"type": "sha512",
"uuid": "a7a2e169-907f-47f9-804a-0de16590f22c",
"value": "bb20fe30a57a33e0afcddef4ffe80634714df3ee66cc0a1d9447439b5fb611679ee450c77d16fdc4f33992abeb2bb5c1a3cc548de9b420cf8be5ecfb40c3c6b0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086950",
"to_ids": true,
"type": "ssdeep",
"uuid": "d3b6d507-4123-4116-92f4-aa9f81dd6cdd",
"value": "96:6oDC2bjNUtWh0G3yJR20gltKdJdvPf/4v9K4RV:RC2bJUISPNglwPv2K4"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086951",
"uuid": "64bed6a7-3297-4789-ac29-49c73b493235",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "64bed6a7-3297-4789-ac29-49c73b493235",
"referenced_uuid": "c41067d8-f1e0-4a79-b653-b1de3a333983",
"relationship_type": "includes",
"timestamp": "1624086951",
"uuid": "2bb0be55-f9c7-4c6e-85d8-93379da661a4"
},
{
"comment": "Section 1 of PE",
"object_uuid": "64bed6a7-3297-4789-ac29-49c73b493235",
"referenced_uuid": "d54701ff-0998-4d1d-a226-52968b38688e",
"relationship_type": "includes",
"timestamp": "1624086951",
"uuid": "42bd46f6-5dc1-4ba2-b361-edfce3483ce0"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086950",
"to_ids": false,
"type": "text",
"uuid": "c62750df-df20-484d-9555-b8fd57c5c511",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086950",
"to_ids": false,
"type": "text",
"uuid": "684af92e-cfbe-43c4-9f87-117fe27144b1",
"value": "4204160"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086950",
"to_ids": false,
"type": "datetime",
"uuid": "327c534e-8350-46cf-8253-872a5d626cbb",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086950",
"to_ids": false,
"type": "counter",
"uuid": "bcb471e8-6020-4321-bf1a-91dffcca6b03",
"value": "2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086951",
"uuid": "da79e5e2-3944-4de3-84c3-5a59a16fb3fd",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "da79e5e2-3944-4de3-84c3-5a59a16fb3fd",
"referenced_uuid": "64bed6a7-3297-4789-ac29-49c73b493235",
"relationship_type": "includes",
"timestamp": "1624086951",
"uuid": "abcf1c11-498f-4f0c-ab62-79cd14d4590c"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086951",
"to_ids": true,
"type": "filename",
"uuid": "392ca689-61da-4589-af3b-310fcf19e38b",
"value": "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086951",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "61b55565-5320-4846-af52-06f58b9826ed",
"value": "20864"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086951",
"to_ids": false,
"type": "float",
"uuid": "0d710eef-7709-4cec-8dbc-f68b49636877",
"value": "6.7091979958499"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086951",
"to_ids": true,
"type": "md5",
"uuid": "8e94475e-9fba-4f75-b35b-d6352f4f0817",
"value": "da6b25206a29c8ac9a8cbb4be5d3875c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086951",
"to_ids": true,
"type": "sha1",
"uuid": "ec3cb852-8e37-4885-befe-46e325dce4cd",
"value": "0e23cd5f100a035bd5ad521a6ad40454fda084c7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086951",
"to_ids": true,
"type": "sha256",
"uuid": "7c455c3e-7557-4b17-b28f-28ca281a1886",
"value": "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086951",
"to_ids": true,
"type": "sha512",
"uuid": "970673c7-7501-4d21-b4ad-9f11f0cd98df",
"value": "22da1f71f92ae3ecd81bdbffa81f1d44c4d1b06c4533d293c02bd159a68539015a162f2b1a835142d06bf5f6d3460adac39643479d93d5171701866401ad9835"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPo501IuD2ILSywAAIBRAAAgABwAZGE2YjI1MjA2YTI5YzhhYzlhOGNiYjRiZTVkMzg3NWNVVAkAA6eZzWCnmc1gdXgLAAEEIQAAAAQhAAAAHgjXg/jAb6NJs9XlDA4DarR390+OW/bNbD51kuYCm10ea/waVU4r8uAEGaVGS8cSq43VDrSR2XEfZxGaY+XYj6abq06+LrCpcpnfkxoSmU85h+c+u3pwcSuFQgzFWmp5C3oQrKF86wRP5sQ6vn45iBiztK5IgnTJWI7P/pfxnO1jeBqY/Vgnxy2AEgM2l8KlyRF8jWtGuzui/mlkOo5ecxEZEax66iKtDCGCKAX+4MF5XyCKnFYslaralEB45R7FefxLyWE5J+UiDjotMNF8hKlunG2lVEwSPP4awKDecV3NcJkR+bPn0zzdWcAECUZOePszbBgM+66T+YbkQGVaBLYnLUKoFSYGKrkRyLZGjXggIUpp1aKz94YwugiQqYwjQNkogCxafTJmvrCtXpluIm25DASEOBn9n69lUqtXcrgyMTg9+nJinBGj60RQsiilXdA7cXWQcRGqS/YEI570TObu6W+x/RGrpYpn9y/0xFTyJZ9N6QPauB09ebAZneIIJ5YSq7PEx+aykp9jBttSw/I0I8SQGDc2/YQ0NDNuPCQ7LaU8ZkdEA2TNg9UXmQ2wQc3pTEi/nmpfwAX/8jbEsuUIwWEA0uKLAE9uY/ewUCZ30VUilHpq0GrFTtjzQojxpMToC9v7Z0S0qKzJM/d6zIMLl5rrd/Uw/WoWHycKj9U6NWz/B5LD/wUH4m6FV/fa/Qfdj6T/j5g1CKgPBc6qGP7AGW4t9JhAAn0V/d5paYwLTrTJ7EiSMa/0zJQipTi13lCwlev0ff7+cMjXdygQfkse2hZx53pJ1tBzp/IYwKLFfizqclNtJSRAfej28OrAYvfFXBgBB03LO0320XMxb8HAP1KglLLwkfuC8vvAr0LlDv6Y/cEvzFni5gCc0pTKMugpnFlh3iMtHxQgkuVR5aDtqZ+2Y+dIrPFKhvG5am9IEuUNhFzHwdA/0kKUlYakJynZ+RaZEMt0K6Dhnn4GDYN1hzyf4SgV3beHCIYmZq9Ki/e96vbfoHMacEu1bmvdMNrvdBxvC4gX7risfNEmhTXGZC16vcYhW1+4TQ/+x2YGw6yctS8y/BV7hBlT+EvQsaDx1xibmZTvelJ7Ie4j316nySeOn2PT0avGd01i0/Kgi9Yl7EBXDOCpPODaiekeSBhRO/5p8WNR4SiOXbgo0qXnmJM+eodpnfSxE+bScVU0S8d3Nh9TanpTVghwFJ/W8MNl05DFY0wU6cGluMHtQoJ+VQVuwliHkYPpc6MXMo1lJRqU7qL7lYstvHVzmYwGVtY3/Mq2VxA7JS35VMJta6uFthEhmKadyJLUIvuZKhcnHYJuN2yS6yjd22VEw1NqEEj0Nfkm3gxAiV2jiPN3zIqpcB/5bFGOaMKsImgAcVjheENQv8nAsfrAoJPbZ08O3X8cYRndOumyRRdwz6PyL1oyLSRsXOp7optmGNDb71JLCscv8364tEb6BzRWJypw8Rth1DGY1ikUtPDRsQ+aAqIQqjoyGg6qv0VGa/SZioJPnzx5m2sin+zmTVwjoB8LO0Osp3a1z1oVOvF/qLmYeXtV/v/8pqiPj2vMqDrCDTBXEvi31FoFJ7/luR3ART0QpLDfxOyDWWlIDC+jOqL0doBZjnqwnw3GPWlOxP50TcdAWUn9kxvuWqwGvCe+l5DsH0FUW8PFB8E6WOtLDyurWMw+n8O64rQwUTE47rWeCUtmFFJsMXcq3dwpZDBDHwTF93FrSVyRyYb1Z3XIwou4qVKAQxYuJPBNFB4yTBJtLCqr+KHnmC2eYOpqe6EG3biD2wDrz88E7wrvJ18WDYorBHpE1ojykuHIIWR+1FcgDW9b9uBR9te40ntdxP3gfwZFmem19iP1trw4jlESjkVlakpjVIAaUNZplTWS/i90m6IRE3EaNp/pnNQ4F3zuwM0Y7aQG1hrBmIDHsE17zgJZPEkbc32fx6hOcQmUKLI/pa8xtA3LIKfSL2/hSYg/wwr6/847HMXehgJ5kYz3QdiP/3tt19HLCWoenGpWOorCDUukBLfo1OCKQoK3rrLNtcC4W9K+qUdvgXFC2F21RFeaklZpo8KC+LWzeyzBz2gJhoQJPPUYDArkWUh2245LBoy/FgUU5NKfbf8huG4vaOw419v6rme0+5SDoU8qMw957M9DmdPGAng/QHcepNL5q6gDWhqIlq74HO3L1grNM4k2CNeKgKzl+AbdEVeXR1Ry/d/HBjhvfuT5FUvZDBigoZlNk70sbHV1v1wI/tYhx4qtRC/74l/34O/zyzMOi0Pjl3dvZblFAcljXXgCAmshmem0Li7iLjW2UVawe0SPMN8lO8e8USjWDtWxE/R8gHhOk7gvh0sJ7nwt3FGstDGv7MH/sKvxWSZGI+e3Dz8sdjzewlCcCu3LT3B/t4Md/yJdpT+C7YI4SPIg5ReGpnmmFPRnHkFTYIcBUEGeXM3lpeDdDj8FwCPbXSYokYWD8MOxhPV88HVwFCZwQGYZDLryGUPjLdoQuwbbmJa9H/R+MHiTVtvv4sqU0b/7yLebl/h/BKqkC+E+UOe8XWa5c5+GVMUg3VV9mZrOjfl2NJuFyeRXmFOnvk7tq4gUIzt23Ocs4CKJNSkKOB08QIudmCBx84Z4IVWuXEHwjL7U5A40F6uMLpo74jhiSItV1ouPHyoDqO+FvxO/a4BmkxaM3Q0Hxlydd6XRAb8dxtc2CvHe+W6a/2gq8dcrKICaI49XPVszUNFTxEe2/A7BPu5e9QOV7tBEVR72dQD58o6RUK6RdFc52JQD1mxcjM/sI30SmR2c9mFXbUhhQyDb2ASfjfonUQ5OdpLoukUeibOuG3uc/O0P0Q5Zb7+NZzjxTNOFEAGH/MipxjFSxmiro+JFObPsUuK1glnx6iDcgT7f5RXBInloK/IfceXx6ts4ABBpQO4OVySy1xUhWbe/rBn5j3iGtEiJ9bFXIpxZOgAHhtzJ2FmLs/LvWpY3kYxDHjzx4rThJghhexnLc5dewDb+gDbespFHRIirthEEdOIPpMnEF3gwhW4g9C0S97H4U2H1qOikwWfV1XqWeUT3nEodl73WA0cAPNevXJGZeT30cgx1OR7nTtT7iylshNtvZ7czuzFw3Mu3QCdNNXM+2oXUzlk9k+AkV1BM8dzTK6roIDhKrE75azxTaX+FyYSootMzDXGQdKR09v8Q+yKuecuZCOqPuHZIZcJjAGKBqIcq4rEBcroragdh9S1hB881ZUEwCqU1zUQ6yOIfq6l/hqRXzj3Kb69GL0M3UwnSoph1VrZrreVuxSMKoBk9jd6XXztvrhTL8L1flG8QthgTjRC+Z2LxSis77GNtL/P38KUKnrt8+7REIgdB/9DTs2wGqFY+ufN4srrSzxZ8U/AQEluEIvTAkWu2FRFp4YVGQhQr+hZpVw+Vx0A9SY/SVgvg3N7Bbl8P8O/+BKdgq+sBofojHPUZdqeGIgo6cwolGmmtPVavTDoOACLWSkX8yPU57roWAWW9/3NClX25UmsqMpAuHgtrJSvbZ3MOiki+dIY6EbnZB0etqheEmTb+nGspNjq7vT8bNREliB5HiJE0l8mbSybC3agwNW5YVLkTMAk3F44ajXu1cOuq6FeK4/L+WWQMXNmDEq5z3ckp6ZvKTKfidEYGW7WMZqPziWuVpU2Y9Avra6cYUAwVI+w7oFv/1+B47SO5VibEyJj+ns8HXtpWK+WbRF12y2zVLpOaXclOD3AyADBCYb7DVhCZRus9EmqH4vBZyiS0osOEHmcupvBMz3GhBEKciA6rIPV3bRLgvf3l5DHbXTixOzclAJay0DDKSHRJc/hhKa+K78UzofMye73fOlbMSgFoJ/pMyqL7M+m49x8HoAfueXp1FDx0DCTyMsXnnyx4V5AmV18CJBXouJ4ehdpe5r7lmUxVjwbtwEpkaKrZNCXwxdS+sVvuXPARYw5UAt3fmrvEHK
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086951",
"to_ids": true,
"type": "malware-sample",
"uuid": "8134ecd0-1b5a-45dc-b3eb-23c42d3a1a95",
"value": "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540|da6b25206a29c8ac9a8cbb4be5d3875c"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086951",
"to_ids": false,
"type": "mime-type",
"uuid": "70ae5058-e565-4c25-b9dd-2f952952078f",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086951",
"to_ids": true,
"type": "ssdeep",
"uuid": "f7495823-051c-45a8-b8ce-662c554b4533",
"value": "384:rxNt/Iu30i3X2GjTJmlglwP74b14gHRN7aW0R1lnNfq:rxLIu3GIglNP749Ilfq"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086951",
"uuid": "5460049c-12dc-4c6b-ad1b-574ee6e27b46",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086951",
"to_ids": false,
"type": "text",
"uuid": "2a97749c-b384-4b9e-b24c-c2d08799278a",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086951",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "7400dedd-67cd-4278-9e50-1c6b69dd6bf2",
"value": "73216"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086951",
"to_ids": false,
"type": "float",
"uuid": "5a288f2f-7da0-4007-b264-c4512de65b2b",
"value": "6.6460112902163"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086951",
"to_ids": true,
"type": "md5",
"uuid": "03d9c5be-3fc0-43b5-8f12-befc2f42af15",
"value": "ba122448e9e534fc1bd66fe1e20c2817"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha1",
"uuid": "e8c125a5-adab-4b88-8953-da755f5e68b6",
"value": "55cd8e9b39a5269edae46760f3015496d61ed417"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha256",
"uuid": "199923a3-650d-4033-9bdf-23b556cba695",
"value": "c8e8917bf6b5f311173b7652240c8d752e83d8354e00ccfb42e18d9539decc81"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha512",
"uuid": "0c4fa4d2-fe70-4c9a-afa5-91efb540a3aa",
"value": "87bee0f652995ae0a2432115271d90be033996e215c32356d541274ee6331590a0442d1c064cf81bd0d5875841d426b5824b5b8a61e3666daa19bdb5a457be63"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086952",
"to_ids": true,
"type": "ssdeep",
"uuid": "c9d5275e-8af3-4691-8cb6-7602464a2e8b",
"value": "1536:tF4UxFgiCmlggnF549biIJWiwmYRWLGZxu7QTb6BRIAxKKM36h/do9zcEruQYf:t3Jlggn749TgxSGZxu7yb6BGCKKMA/2C"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086952",
"uuid": "8ac5b696-de49-428d-8edc-8ac677efef52",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086952",
"to_ids": false,
"type": "text",
"uuid": "6be7726c-6525-4344-ada2-ac45b2575876",
"value": ".rdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086952",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "7a86bf4d-1444-42bf-8e6e-2d5814322b48",
"value": "29184"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086952",
"to_ids": false,
"type": "float",
"uuid": "358c19ab-6fd9-4b12-9d8f-dcb9e6453ff3",
"value": "5.1292811401258"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086952",
"to_ids": true,
"type": "md5",
"uuid": "e6d532c1-f399-4109-87c3-2ffe5b61e8ec",
"value": "256a7bc964bed0b763853e7d06254cf0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha1",
"uuid": "9b08dd66-08dd-46e1-84b4-664133390f3f",
"value": "230666307a7060e10f26a9ec7b14631391b6d3ee"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha256",
"uuid": "15d8eb08-03f1-4836-815a-259bdf7aa81b",
"value": "f41d59e5ea021a69e5b9a3a546a9b5b4f4ac256b802c53403b4984b74adf8334"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha512",
"uuid": "88bb9966-d1b2-47f8-b24e-4925b46ff582",
"value": "d708e62fb30c8f00d40ea1dadb0e4a31e43cca5dc00ef31f67d3927d92409605edba5a87ff2ce841eeb148b5a9e65460b6bd21008ca263662cf30d39ebbb07c8"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086952",
"to_ids": true,
"type": "ssdeep",
"uuid": "978dc06c-0ddf-4a9e-8e6b-9d62fa5bfa8c",
"value": "768:AgCQxRalWkTsWAg83cd7zBD9vmOCP3gED3m:AWalLsW8cd7lzCPQmm"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086952",
"uuid": "8688dd97-17cc-426c-99a8-663fb002ae49",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086952",
"to_ids": false,
"type": "text",
"uuid": "a7ff5a1d-b58d-4a45-9410-78b2e68efb4c",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086952",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "7952bef5-48f5-473e-95ae-eeda78e4bb26",
"value": "2560"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086952",
"to_ids": false,
"type": "float",
"uuid": "8c40f6f1-7771-49e9-8bae-52968f36d358",
"value": "2.1461655382031"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086952",
"to_ids": true,
"type": "md5",
"uuid": "51c73a96-597a-4a78-8321-364091bcbfdc",
"value": "e6ddbb0c98bdbc5cb6ef5e47332ef148"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha1",
"uuid": "1b8f53b3-4df3-4084-b56a-e0ab9d0d7b90",
"value": "1bc4fcb6cf6b3a452a53d3dd0890fcc26ac878d6"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha256",
"uuid": "bedea244-7145-4aa3-8043-f0f89dcc9ba3",
"value": "4f6d5b6cb5664c7fa5cdf5149aa3842cfb6c8fc98fdddad8f3e688a36879a5ab"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha512",
"uuid": "d29d5b96-dec3-4b25-ba39-f5b5abf85464",
"value": "fb98d03b2c9bbc1351c04454c6924d792dd6c83e92aea6cd40f21ad306984dcbf610261d55fce683e621dec095f329b49ec66a8cafb43e96db85147690ef0dd7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086952",
"to_ids": true,
"type": "ssdeep",
"uuid": "c871ef8a-c0df-488e-9c6a-be8d7f2919c7",
"value": "12:pi2DX6nhiE04LF6LO5SfXMvmNKzuW6LO5SfXMvmNKzuXhB/q0qeUcKgBFyXXXXXQ:FIF6uSkeKv6uSkeK8hBSq6h/CScSdu"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086952",
"uuid": "0e9b987d-c99f-483c-9bf8-40d0adb31ba7",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086952",
"to_ids": false,
"type": "text",
"uuid": "df09274d-513f-46bb-865c-a0b6631535a8",
"value": ".reloc"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086952",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "5c35fff8-b20f-42c5-86fc-6c5a1255f0f9",
"value": "4608"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086952",
"to_ids": false,
"type": "float",
"uuid": "f9680b36-2f73-4f1f-bae7-182d30648d7e",
"value": "6.5342268114962"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086952",
"to_ids": true,
"type": "md5",
"uuid": "1e514782-687f-410f-a3a2-d5c04edc5986",
"value": "d85fe860a8751a320647388fdfd485b4"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha1",
"uuid": "069b6cfe-c212-418f-a2a5-515975e4fe98",
"value": "e4076bc60d87609162518e9d651c39b3554cfa70"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha256",
"uuid": "a770e3f3-cce2-453d-b478-6d7d0eeae3ca",
"value": "0c20438725be27a7af290c3634341b54c971d2407b0b4b482b0dca81fbe813da"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha512",
"uuid": "203c0c56-032a-4ef8-9b22-bcd2370f630d",
"value": "efe8f55288934db25667545a7382f36c496a6d16263ad489613ed5c42dca8bb06ba435764c2cbbe5dcb0420a174ac20c1ee3cdaf4c01905843fa08f0bde8fbf0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086952",
"to_ids": true,
"type": "ssdeep",
"uuid": "ebc674bb-b783-45b2-b7f7-e61b451751b6",
"value": "96:kt+f9W+sN2GU7doIH+t3+uNE7sBpnnnGbGkmnqjnnSDs:A+VWBsWIH8ZgQnGb5mkes"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086952",
"uuid": "73fe839d-d8b3-4b19-8df5-e075319f39cf",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "73fe839d-d8b3-4b19-8df5-e075319f39cf",
"referenced_uuid": "5460049c-12dc-4c6b-ad1b-574ee6e27b46",
"relationship_type": "includes",
"timestamp": "1624086952",
"uuid": "80633db0-8bdf-4e1c-98ff-98360c8dd114"
},
{
"comment": "Section 1 of PE",
"object_uuid": "73fe839d-d8b3-4b19-8df5-e075319f39cf",
"referenced_uuid": "8ac5b696-de49-428d-8edc-8ac677efef52",
"relationship_type": "includes",
"timestamp": "1624086952",
"uuid": "52e3455f-216c-40cd-9e28-f23684a46010"
},
{
"comment": "Section 2 of PE",
"object_uuid": "73fe839d-d8b3-4b19-8df5-e075319f39cf",
"referenced_uuid": "8688dd97-17cc-426c-99a8-663fb002ae49",
"relationship_type": "includes",
"timestamp": "1624086952",
"uuid": "32b2cd81-f75c-4921-9db8-7d749505e3c4"
},
{
"comment": "Section 3 of PE",
"object_uuid": "73fe839d-d8b3-4b19-8df5-e075319f39cf",
"referenced_uuid": "0e9b987d-c99f-483c-9bf8-40d0adb31ba7",
"relationship_type": "includes",
"timestamp": "1624086952",
"uuid": "b37d4e50-8088-4448-96b2-46416de5eeec"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086952",
"to_ids": false,
"type": "text",
"uuid": "e7ef579b-8cb1-41e8-b030-9bc6a2aeff2d",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086952",
"to_ids": false,
"type": "text",
"uuid": "e1e1cce7-695c-49f3-8f04-30ba23822195",
"value": "4201754"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086952",
"to_ids": false,
"type": "datetime",
"uuid": "c89d8613-e320-42b5-847f-98f2dcce11f4",
"value": "2021-03-21T09:46:34+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086952",
"to_ids": false,
"type": "counter",
"uuid": "47da9d4c-8089-4316-8338-f0bafb1e11e2",
"value": "4"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086952",
"uuid": "5e1a1253-df3d-4d7c-aaa2-36db9ed411f1",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "5e1a1253-df3d-4d7c-aaa2-36db9ed411f1",
"referenced_uuid": "73fe839d-d8b3-4b19-8df5-e075319f39cf",
"relationship_type": "includes",
"timestamp": "1624086952",
"uuid": "c215225c-fa81-4e58-b9db-2e4f995d83d8"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086952",
"to_ids": true,
"type": "filename",
"uuid": "68d34b50-5b74-4aba-a603-ea8922c2ecae",
"value": "cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086952",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "05517672-00b0-4306-a359-bedc8a7a98a8",
"value": "117168"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086952",
"to_ids": false,
"type": "float",
"uuid": "ff23fb34-701f-4211-80d0-00a7cfb5d28b",
"value": "6.5382445196778"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086952",
"to_ids": true,
"type": "md5",
"uuid": "49d98351-d6ed-4950-88f1-022b651310f3",
"value": "400c1c6312f99e4640077994bbfaedde"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha1",
"uuid": "16377bdd-7814-40ac-adac-944126c2d09b",
"value": "657a875554b075eb7f2d314bbbe967c789624b30"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha256",
"uuid": "25c83f7c-f707-4624-90dc-4f1555c67591",
"value": "cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086952",
"to_ids": true,
"type": "sha512",
"uuid": "0cede4f9-6d14-452f-8ff1-8e42ce3e4847",
"value": "00b05036757e558c3d210f838dce3c8b2b4808655263cc1d69bf21a78e93f6ad52b6a20a4d68ac033fdf06eecc334690190f38e8435dc64fab3d64b7fc1d5c96"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPo501IDL4iXxAIBALDJAQAgABwANDAwYzFjNjMxMmY5OWU0NjQwMDc3OTk0YmJmYWVkZGVVVAkAA6iZzWComc1gdXgLAAEEIQAAAAQhAAAACHrly9eaWs9SiIkEW5vXPVZLpcW/whxNJvMFKYiBlwX9RPS0fbM8HZdIa3tTvQp2nrFVJpcu/zX1EkFTOyyY2/9CGYxoqM8JaqTbRT2wQOPaWE314zeIq3om1tVsz6vUdtHk5b7OjoGunYqaIz0fxYggcLYX35Flk+DYNIrb2QLusVxvvC4cnDf47Bokub5SdB8c2GTVurzaLBuCJILc1H3bx/RZUj6/lzXJbA3w3Rd3ub85cUZw/A5RCryH2UQywAFg0BCd6I7VHq+8wgf/MtB2rjcfC7LQ/5VdJKao0YormBrVeKqOV2LiPGAp3ucI3zLaChbROilsm9qlHyTssMChmA308zAPQFImgyn7d0ru8Yqpr0kV/4Xp8fsoDkacpUkFmWsKs7hjc6g807zqSkgY8ZzLeUDUNdROv+F1Dm7v0i9isXLz3HWeioBlCNJY2Ojb1SwCnwrEzcER+xq3Xc8Tetx4YDm0l8d+0edgJCTnTwBzo+J2NgnKo5nvSaHEV/pVBIK0W2Dxe6pIPSxfvZMZetbKwOalFuWKwJ2Jry2Rjn5GFLoaBusCCdPae4A5mIe/LrAdvewaEKFJgxMmqYFWXjV/RjFyWw/a+YRvmiHDNRp+FiEqswCCaVD4nOaGu+3jLinMuOjUWvMus/p99Dee29AXY6OYriD3pjvefT1OWH+QWtO9vyB300RyJ2cXu9sWEUavTunXTz1y/CIXYWLn9xqttw3vDFI+ny12y8Tzg2+1vOSV0coDZxkeI2mxqmZjion8oz2aNCq/TDelCeRZP6p3+9H/iRPuY8PreB9QYN34rAiK7m9Po6AKyjuSNnv3o3du5o3isr1I6et2QoRijq4xeNjJOuwhQ3qRuq06hHDa+8U3Ku1ju+p7vKS5Bx5cLMw20c+gbI2u9vw/7YSEaPxkxSduWKnaqRdb+HvDxny82OzfqqlyTua92PLf0ufs4uHtZiDvZgbbeo6cwK2kCCHaBEgCUuIlSDl7hw3xmMaoQ9chgICEi5d0V6jeHeT18UDHz9S4A5G/rqGs5cEIgjbcGMJ3ULTBjvnTUSVCNKUyFz5NovdH8tO6Vypqh6YzZs8OwNhRiPATHKojBMhVHyXpV22RmJQ9ZEsVsqgyBoeG0HwFBHBBcvIgJgacRKkg83jDZEJ3dUeFt3pVhG/qfco3uhwlztZkma8cuoDEWs+wzb98UlEfeC7HmWLVgJioaawwU8VydHKJn+WheU+zzGJcAsnqI9sI6RcnFQ+NZpoefeUJQkYja7F7L26znelGT4j+7p4qvp3F9RCWIRmCtOqpprNpYyd4lLOcR53+ka1GW7jXqbNLzj8Gs/Ik10WTNQ/qrZHP46KdxqR8PZNku1DqqzH6sUO8+YxGuqfezQVJYQRXDfg3YZss+bOslj/7VQyLWEMEDbPUs0DXSs4Xh8dh+DhQX0ssteSrGtrXLQF6T9XWqdqYkudVOEzNKd3l3SjitQbAlE7teA3px7KgHaSZjGfWAAeG+iGVxub0DP+8Kiq2ZX1bx0oRMZa3kVfzY+wHHRvYp2tjKKQpoiNuDFkvWuIybLTj+qKK+z8ugw1p46F8JeNfETvT6SpvDml+3Y1KLz4BT+phjXtv+aDpaNIPwx+2e+ULELnHuxn4XJuxeFiWEgxZo/11WGQNdAU72s2451fdJ+hbJ+aAi6YdNRObQrFn77FA1yhUxgWH253+Dg5djZgx79UX2+3NEo+DNY/WwNTz5MyF83i/JJcLQVdcHYJlvTPUgH+OYcQxaaP2f6QpRCE0V/h6G/LrawuNskFXRPPts8o/1o0ODHDg4iPeBOVnZJ63Fozy4UntBKyXof6FYgMIWFJ2+bOxvgofzZ0fWAeYYoIAXvZX4BGLHcOXQ8q83U46m3CefBmdvA/3KxmdIVLNsksMMr8lmGKsb0Kwf3yxNdgpbgUwFauRNvEF+wMKMwY5XBhjmE/9uC+32HG99QrcNaoMa3BhEjAoyu1avd8cPtg7DnF2NBvTtryCMmmu/50/oYWKnwQv0HRa7FlQ8BXXdZvfQAmJQpUwXBqGI0ouy1oL9qySxTw80tN6xPpd2zFYwP22TNcjrGVcd8iZWhQ26hefs0aWniH4OI6/wv5CirkzC7+PVWreFrhUSptgQy1NWsOpLLbtIq4EHgcVJ9yD/mL8k8KcfXAumc3vC4m2rQQtKflXiS+7j+BU0ug7hoMrNxhKAzBoDa/V4bvfxd+oEuHkFQKeA2HHanX9scF+1xNYEvij6IboYdnFAmLWUh6ZNXAMSrnokEJyahYlu6aMLSDUgK+CCXEEVKdrmWNcXHCVohTiQr4ILsfbl2FH1xQZu6LISZT4Ez/8z4cxyyD3vhvwKXFi97yf0QhMuDdwaMB4FmxEIBfUJEpxRKsAR8THmy7gSeKWkVpuBsA6X2CFp/Hp5bij49mywZKsz93K44y39rtP30brqSr2IU4o1APAp2t/dE1xMWW7a5k6208qrMBGrcdJMpoVE3gz5MLyExk/3GwNIkYiJD5ds+hpAEqw1pNpPIh3kTCCld64ESd6FKZUxNSBgg5JQuRuZTa+5DJ1vVPSCk6N3vHBtoI8iQyL0P7Yq/Kp1RDfHz57b3uOv5MzHWNznahMR47YhiOCtnItkC1xRS1XltzrdzjevLElpjzZ/dH2VHABKX35wB7DaVSpHBs2ex047YMLgt2chPjxwFGPNrd8+euLNNNZAXltFUhLIqf3NV5xixQecJQ3XXUwQUR2csE4270ELoogfg1Mwl17JOn0M0KH+bjiGnE3cP68fEMtRcXWaJD0GpHGQ7XwTYvg7Cd+oNz9aZLnCt08rmAakxhlIfU7BZ5VYy5P13zZh78GUMa1ue3Sxr3B77tQpKykQjrmKrD6y26CIbeo4i2rukguVGOtZyWn+xm5BMsw7lE36SP6Va5UqsmDTsHlcH48yTYcVZEsfStEh3g/xBRTe6/lIZ6jtPkIuRiZxVWzzOD7aXBYUoytLMT1zJ+tK4fhbdOBEXJlgUm6voVKGJtNvBR+xS2SyCEkUwkZktwd8fp7Y8di0Wutin8p55CBqXVGvaMyCci6q5jV/OMRyp+cV7LPmo8jRHYjf6QPzi8Fq+z/gwNf6ZLY7iiLINBiY38skLMVsN0RXfhgjpKfQLgYwx67AEpDC+QTyY7UptsjNToLDYzQhlhO5H6wX9PVJazueBmfAjUjmLru69oKUFDX0XdcWhUGjQDAYAasMgN63Q+GNNSsBZ2UYEt6qjmOe0XDdeQ7vaqD7NzNCWQcvlp+F5dzfS1rAAlrsB9+Be+obaweCUDASFVr6cEH3OgafPGX/IUg5yXcSigC7gsUJMHRks/+s7H9jrk4YtWIGIN5hSJHJs4M6F0Zj0N96AH6hRgY0HhWyN3Tw2PZgaCg0e6pHpgzP+kvt2ggkr06n3Nyqcf4HYpeN+QtI58tZP5cNnjYsd2EK+mUtfeDQVfrmqOJNckUyYfWiWA6uAYxw6eTkOh9n+3f5wLaTeKI+H1sT+cDRI35a52BOZ3WC74grad1aAzEmCG2lctVsAHfUveJRKXNPMeETnNHJe7FGDxlTc3voKGLXwCluHKjTy4T6OzXwAet5pRPD5C5BMFH2vlsRiesNu95CfCspIXy+WtgT5Z+aQa8vAzcVyavTrvbk9tjVSaHAufLi78VaMtc3BWNCyCyQWsV8T9nVJhZzePkPBIL2KsS7Kn7OlDxDpdQnPsUiUQ3l2txJigvWR3DbSwv2h7rLWl8wE67z/nLalbkIq2gEOqAX4SJKhuMHVqfNpS1PsMbwh7okp2FdUBzcptpEmgvZDVukIMWq+RM3jla/L0FoKijw0kaIBeNO8Qzw0uYd0RpiaL/orEubYLQTvhYDeA/fxqfSqnHByFSlEJQEvQVxGfUMJGPQv7vBalJj+8tgAEJqQDq8P4jgUltNjyCavy/FUWzMe
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086952",
"to_ids": true,
"type": "malware-sample",
"uuid": "a1e3ee01-7210-448e-b5ae-eb3028c3babd",
"value": "cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce|400c1c6312f99e4640077994bbfaedde"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086952",
"to_ids": false,
"type": "mime-type",
"uuid": "53140ea8-bbed-4834-bfeb-3ac446488bd6",
"value": "PE32 executable (console) Intel 80386, for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086952",
"to_ids": true,
"type": "ssdeep",
"uuid": "19ac177e-6286-4c00-aaf4-cce42a9969a1",
"value": "3072:Y3Jlggn749TgxSGZxu7yb6BGCKKMA/2puQYdyf5z6QmtJVt7:Uys49kHIyb4KKMfpuQYGAnt7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086953",
"uuid": "e92bb5ad-f7e0-4f31-a7a2-8091fa441d02",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086953",
"to_ids": false,
"type": "text",
"uuid": "d03a7d53-b1ba-453a-9ae6-eb1b4f8b42e8",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086953",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "c84431da-d6bf-47d7-9bf2-729af75c2cf7",
"value": "5632"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086953",
"to_ids": false,
"type": "float",
"uuid": "6bbfc2c5-9444-41f7-80a4-bfae4ab9f207",
"value": "5.0629575138343"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086953",
"to_ids": true,
"type": "md5",
"uuid": "68a008f2-e456-4215-957e-beced2c29922",
"value": "0dca461c1012640bb1985540881084f9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha1",
"uuid": "a6034f77-b46e-46ad-8641-0d98937a891a",
"value": "8c61e395d24967ebdcbff73eb8d32c460f606e44"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha256",
"uuid": "ec9bf6cd-0923-4ff3-b3f8-5a3a0a2b79f4",
"value": "2894f5e511f54f4c17452782967a436b750f0c7bb5a59cf7bb26608ef196bd25"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha512",
"uuid": "4ec76269-ea47-4330-9f65-d017c724984e",
"value": "18f5a748127ca2860aab7e0f409bac7ed508411da9d360524b35708a843a738314fcd08fc56568d6677ab8ce5de34cd623d1fa0643d098704c199f8aa43f775c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086953",
"to_ids": true,
"type": "ssdeep",
"uuid": "af18d250-d370-40b2-a247-ef142bb104ea",
"value": "96:wD0sc/cytcPa9M34/L6/sGVGb39Wot0F5tWVAZ20nQaey1ae:wacytIaG3GO/pVGb3ci0FrW+M0nQryz"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086953",
"uuid": "ae6ea4c4-1136-41b1-a103-b760a5d6b949",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086953",
"to_ids": false,
"type": "text",
"uuid": "8ed18e5b-7e5e-4f05-8c62-e5fae97974b3",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086953",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "f4f04e39-ce0d-4e7f-9e3e-60b3d09fde9e",
"value": "109568"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086953",
"to_ids": false,
"type": "float",
"uuid": "9b988502-fafe-4656-93ae-b6aacd3aa16d",
"value": "5.8356487190746"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086953",
"to_ids": true,
"type": "md5",
"uuid": "c7ba4be4-0789-4173-afeb-fee59dc4c715",
"value": "16de5f9c14fe90eaf907e43e0e90cd0e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha1",
"uuid": "53edcc6c-fde1-47c5-87a3-c973f99d2d44",
"value": "d0c5dcdf0f57839036d81f57e9b1eaf39dcbb6fc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha256",
"uuid": "822e4a5c-0802-47d8-b360-9f4f50e8f3e9",
"value": "28a43e17fa80f38df5d39a1e7f4a1cff93c4925f3ccf79b6cc1c67cb558fb025"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha512",
"uuid": "e831236a-a24c-4d65-9bc5-d5a66c7aca3e",
"value": "3699000880f31578366c5c46502acd84c6ddc82affa45ea3553487217fb6b857a742218e943bd2c094fdf9d0ac5520b705801041782e619fcdc8547e3e455e0e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086953",
"to_ids": true,
"type": "ssdeep",
"uuid": "20d12826-f7c4-4f43-8e2b-25a9b920913e",
"value": "1536:iWXOQwi6wEBxmT33U/aNyq+4lRX6IHnsOVi7s:iKOQwNOTH47q+4lAezi7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086953",
"uuid": "14cbcece-f046-4ffc-9558-8a1bbc704211",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "14cbcece-f046-4ffc-9558-8a1bbc704211",
"referenced_uuid": "e92bb5ad-f7e0-4f31-a7a2-8091fa441d02",
"relationship_type": "includes",
"timestamp": "1624086953",
"uuid": "5d5c6d04-25fa-43e5-96ab-622a0a06bcca"
},
{
"comment": "Section 1 of PE",
"object_uuid": "14cbcece-f046-4ffc-9558-8a1bbc704211",
"referenced_uuid": "ae6ea4c4-1136-41b1-a103-b760a5d6b949",
"relationship_type": "includes",
"timestamp": "1624086953",
"uuid": "4a7c6da2-6ee0-4c77-a548-0bb6c2ae3965"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086953",
"to_ids": false,
"type": "text",
"uuid": "f5276802-42bb-43d3-8d9e-3adb685ddeef",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086953",
"to_ids": false,
"type": "text",
"uuid": "7e5271c7-902b-4ab5-837e-53c1bd5024e1",
"value": "4203264"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086953",
"to_ids": false,
"type": "datetime",
"uuid": "38b06bdd-7c10-4536-a7f5-a84d51e8d9ed",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086953",
"to_ids": false,
"type": "counter",
"uuid": "0009d86a-0ebb-4797-a5c0-172400dbfa94",
"value": "2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086953",
"uuid": "48bba73b-ad9f-47d4-8c75-b4f0dfa77c22",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "48bba73b-ad9f-47d4-8c75-b4f0dfa77c22",
"referenced_uuid": "14cbcece-f046-4ffc-9558-8a1bbc704211",
"relationship_type": "includes",
"timestamp": "1624086953",
"uuid": "85b55cf1-bd38-4228-8284-826b23408b72"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086953",
"to_ids": true,
"type": "filename",
"uuid": "f702326d-2346-4471-9ee2-81debddd7c24",
"value": "bff9b75ae2eea49a765f79d9c67c997edb6c67a2cc720c6187dd2f67980acab7"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086953",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "246e6ef4-dbe9-44fd-a34f-7edbce9dbe04",
"value": "115712"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086953",
"to_ids": false,
"type": "float",
"uuid": "8e88bf1c-5cb9-477b-b7b7-2d6594eb3bbc",
"value": "5.8048256930179"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086953",
"to_ids": true,
"type": "md5",
"uuid": "b6a7f5bc-d6a7-4248-8907-376aec643389",
"value": "aa043913e02f124a4e7171fa40dfc9a2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha1",
"uuid": "ce15f332-b91b-4c05-8303-a1b2b9239b23",
"value": "73338b8931a3c265e8b544fa17de3056a3e56b59"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha256",
"uuid": "491cb7fd-7ed4-40f1-b30d-b6031ea78187",
"value": "bff9b75ae2eea49a765f79d9c67c997edb6c67a2cc720c6187dd2f67980acab7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086953",
"to_ids": true,
"type": "sha512",
"uuid": "4dcfe8de-3e12-4e9d-852c-b70d5dfca36d",
"value": "3a16091d8066245f2cd79df83af1a93aa2c8dc94d3c0a4e52fc52fd2c0fddc754cb4b30d868ebb0211803c71414b7a141a1595667a12d479a61fc2cbe33a1dac"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPs501I5h/AO2c8AAADEAQAgABwAYWEwNDM5MTNlMDJmMTI0YTRlNzE3MWZhNDBkZmM5YTJVVAkAA6mZzWCpmc1gdXgLAAEEIQAAAAQhAAAATeDEBT17ybGJxD8pYyLD/IL+elYD4B2+kkHogF8xalVWOt1afVbjWxa6KPfZQ/1FExq27YVN9y8weyTHc9V6ZtQy2qQRvg0/99Dd3q5qOGl63+SE5kwIiWHBNRWe/7ycSHMti2ZrEoReuWJgFR/MzptJBsqAqP5KUoO2G3p0RIqvQaiT/j3SAFwbCtad5uklMF+qGRuyNQn6JYlu+xUMYe71mYVs1LD+uwIAc+ilOWR5urUAfd9exB3doDQCghNiYEnn1Nbqmc3YnMAfyxyUHfokhRLnF0bQw6nApXJ8gEew78jRDh4GjrESEoECrM5VOjbtMNH15WHKYrVvoqcUBj/uW2M77QvHCIfl4cOjJURZAGQWQ7lvWtIGLpmlArTFCF2JZWb+U5JILYOK8/2ZeAJzJYPMOZuobWXP8d6HlcgRoRFFOpQQAG/wPeEVVojVrH9COH5aaKRH12PBj9Lm/ThQ2/R85oe93sovMB7bx2pGueX3GwseaIPob0rQadEeney48odsIAso2E6JON7MyXs6cHl9rykq6QJFH06wwOUsdDd+TR+KKpkQKkMP2HVkia8tLz9G3danijV0Ldjk21Kt/oBsTvfAqHZW7GFtpAj4yJ2bxc+8FoowlobBEjDiQ4ILpGpBMQLgODH+rZLwgnBaTxQVWWH+d/RTWdh3i6a22mFSS+sAYiDgOyxMkekGcWLIAEZNmw2PmdnEfNATSq6HcANYXoKHmRS4SmfkAx7afsBrF9BasG65lIS8c6P38vXD0fc43NmsvJ2QWgMuZ/o6gVJUJQKK+5El0tkDYtyU1BSK4Ge6WzaQRpaSGIS21KJQl7XNM0Zvfxs6o27Cor25OfbZ21S3z5ZR1/vTxxfVkdFi2E81M7D/qXdDUDgs1IEyIJjcSLBv9UC+YkFQK3z7fQiz7gbmZ/PMDBoq7la1H/YPDjNhzsL49pCXQ0sI8VPH170GLlWX0Rx4EWZOX2vyvf0tsNFDu5eSnsZSV/9fWyBnesyIpTwx9Q+hjh2v2KTllzywDA7KI20Z7RCVxrDZL3FCoPVeW1AqIpu/0OP5vaCFzRX4bJaYf1T0qhJSwyS08i/8/RCvPUO3WV6RJCwYQLypuJGF5QQ3hPpJEhs0q4CkCUjPWGFCvzaoS4hv8bQwZ856/RjItnJ9DStIvUD/n6CzsbeYlMF0RK+WIazr9kcEg+EFHq/10EzQRDb8F4zdHX0J8bqPzYmmLZReNXLawCYta8WcpUto5zg4GYmf80WvVnT8Ik44KhgyutlCquBcS8bYodA1o4jVoZXaSH95yJ+Lks0Lnp1nIVX7/M1zAUZBE5T22evqNBx7LB7JQ1U1hzM1SbxZl0EOCS/H/Ytugs/sh2nl1pPR/ddSFrVllRQnSKRADwiuTDZFCKfT+XjtUDUKIYxwXLhezU2B1wzguu6qSX5GiO01hRedAu9CGzhVJIgjg03q/pW2tQv8NiU6msIu10ty1yBdCzr6O1YULF0qa52pjk2wJztK3UULemRub7iOPH48RbS3FKzTYs/gOOfsiziU5alAKcd7S7gft0wTbFi0Tibpt7GpRwq3xk7lZdxDqXAR2PyK0a2G1D8GEYIY/jOdNF/AWdZ1SsOMnuzu+NXrm/8JYwOGrlCtLjMHk+X8pEx07XxGIHSAlU2aHZH9pnHt1RYxLMkmkS9Cx50/4/S3GIl5Upzv2RYilv/RCUkY73TsdWdvrII3jdDnOOPRRnU3XBErmL09n0LUoPB8yRZvGi7UeIU0+EwRH2O09va4u+MTXw/efE5tUlQ2Is3MBbOG0v/R49GlArtQxS/BljBz81ENPe28z7SdhNrOKLCz6U0rKMd8mnyIHlpbqa8tgYbLlJwp4Ej1C7STp8C4MMSLBkKNyTVAgKaumieWFEjJAPvLCmcEwE1ygVjBvwXUa10fWpr8HxRmBO6dZHle2XN2ec6uvVyMRgLfDZfnhx+w/EUTm8CqPJLv3KlGAryYU+Vtt6+5B6/Jxe00ECaRrPtbcWZN2d/q5welOKTBF1z72P/cNS8/+s8XaXzkTn5wComK+6onuvsQNMH64VAnXJDmUtO+LPWJj94IsuHiiZAHDrMYoTEjsaiFt/eFnmPghS3/aaAMftWINqGkoA69ZGYKZdKlaH/RNqKwrfIn+ZSM/2lSAuEM4e1zqjJC8T4bBujjxxEFs9Njdb/Gl+EluhTCemYWREAz0J9ba3s5J0hFo6oMb6yAxrR7ph3IP93JC5Qr7PUGkPUHER71XKWBLnrZRRJMfQ2/IbqVwRUp77XjNheypZvVLlUrkU2g0WFdJSxU+/QAfx90hhvBy3z3slw3eiWg9P00V2IR2U5CxmM0P4VHojEV/B3NnJSJOKLjl6jIuxgmTcpZJOrdnoRK8qVaF8egTeZFgdgfxxYr59OikkY97jNF7r1LVeTH4rWOq3KIla9r1OoMDNcQRjkeNNxYjJLVdgqy33Wotw8rBn6tWdDNsBJblwrKdpuyrnZldpORH/d0eqL4DIbJCSf7CwhrrVF5JQm8GKtRoaOIDAtganOtVuzIT3yWMkVu8Y2osQtwSgKSabkLSprdpl+mLRmu+uKpKQn/z7vd16Zwidp6vZHVa/9ao0W1KXkTt3/ztoOJ46oCPAH611gkGnMHV9a8761cfgXRfhIvYojYDFbMwSX6UHQDUVWDgTtFKIhVhxB3WmfFTcdoufIF//x6EBumZYBH/NCn/UioeHvrdoxJUFGdiBxOGyacpz7b+Dhn7K0ZEIOmMltKGilpVM15gsc5dwF7t8+2Mdtvkzj8V/C5wLfyahLwBIg0WtHIQIrvXlqCbSpF+s3i1Dj4udP9u3IOL0U8ie8WA4RIdFnRuOlB8W0pPeAB45dd0f2WQ4hLKTjvQcgylWAUH9FDMIEl1FeDG0WpQJKTRT7CkRtXNlcOn6GqG7ZURr+HF3s9Ib4mKaWX4tnDt5sQbjezLEg1EZTV1Doa0NXq6FATvN6mOs1mg4zatrJ4rIxjpS2r7+AK1z5lcWjfyd7X0DhjqUxq9F2GgW/Z2Tf/uqIsFHDWx1Z95ApPgw0ixDxqslQc1fvE8PwnMzgSbHIiBB1A2k09fnCn0SyVdpGdORzirt9qw9mZO3wcKDEcfAIttZa3VIZUiLPejspWjRhcRBMLU9TuoBLBMFLgYy7ghQQNKOZsm2XqivzUZJczLKCklRTcZGbI7mvDlJNEQcmZtK69fIUwP2UwuFAfc8FZS1m4jxA4kAHxSaWS/j9fMFEZrlRjRkXZ7mXKcreiVvzGT+ohhnshyXWfLm1JWSMHf4Vc4bFWxUtnseq9C5nxJ681wstCW3mkViGbH0LXxWwT8uWuv8Z65IOHAiveJrlePBHvIXZrsyjnq6FpDp/nzINwFsuubEaOZ5xoVGEkBhxSm0QFDPUgBh8rfh001zUJWQmvXhqP8lBT3nmXx2/8Ayo0ei/nJ/jVTVEmhwZowmaepPH7awR8bYFs/nlAIr7TiV1ljkhimgByhSO4wLV0EzaaXlb0EMfRcJImSq0B9LKfFEeT0/7YXigcdmESxmhyetpTxl2K9uh25cKCFNEaKyNScN1bjOCrBORd7aVds35KiKsuplPOLMvMuj+aT9P6tCzl6ZKx8tjZiOWb97DNc97B6PTPkTzc9CdSmvS9UYHuEe2C/ee4n9Zl280vxXZWqKd5Bm6Hpz415N04DMnJ+EG7O15xuhJbCDY99XH4QDO7EtmcJ7mBz06wO0XyzwkppDjPvY94K9si9wgV+NINjlCpcX/5QXcHWut9nAnpacA13tfn4pW8XIygLIiKiljjtIzW/RCjeJH1MYvKRAiqvwfQeOIkaJNl84yUGRpIhheSBZh4KNGCxpNv+fGZIvcRhKUHkEwNvG9/UKw11kwuxy9TLANo4x20u9PMlizlP3ONv3Z1JEFRU1lkOEDRZC8AbnMawAhliy
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086953",
"to_ids": true,
"type": "malware-sample",
"uuid": "8cb84310-84a5-4226-b652-0db33ee5cf11",
"value": "bff9b75ae2eea49a765f79d9c67c997edb6c67a2cc720c6187dd2f67980acab7|aa043913e02f124a4e7171fa40dfc9a2"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086953",
"to_ids": false,
"type": "mime-type",
"uuid": "99cb21fc-eebc-45d1-a14d-474ca3f0bf54",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086953",
"to_ids": true,
"type": "ssdeep",
"uuid": "39865cfd-6497-4de4-8a0f-d90d4706b317",
"value": "1536:HL+3WXOQwi6wEBxmT33U/aNyq+4lRX6IHnsOVi7s:rOKOQwNOTH47q+4lAezi7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086954",
"uuid": "98c6cb34-b6c8-46d0-a6ff-c5c01732510a",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086954",
"to_ids": false,
"type": "text",
"uuid": "2e0b8998-ae45-4c1a-b944-0b1e72261e10",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086954",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "c475d2ae-4176-45ed-bd1f-c0a75ad9c73c",
"value": "26624"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086954",
"to_ids": false,
"type": "float",
"uuid": "a7357e68-1a73-426f-91f4-7ced0116f7e8",
"value": "6.3151171440822"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086954",
"to_ids": true,
"type": "md5",
"uuid": "f6034d0c-e06e-437f-848d-a358721ce667",
"value": "cf0b16eca2aedff96b586a2add8e956e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha1",
"uuid": "adb742e4-6f03-4f01-87de-fb5285e677ee",
"value": "6b3099c00646a54d25d96c0d9a3394463394083d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha256",
"uuid": "66f3d0d9-4653-4ee5-9a12-2df850b8588c",
"value": "e64daa8926bfab138ddbe16a1f84ff4dd67984b06d0d908fecab21f051e7786a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha512",
"uuid": "bc76fbea-f0ce-41d8-94df-7b1457416cb5",
"value": "f408833fd42da728bd7f89f4e288a4fbe1651cff3a26fa911cd09f845302d678c70037ceb36b3d58dba910d1b93ec602fa0f9ac13ae63936c4332d4c0f89c049"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086954",
"to_ids": true,
"type": "ssdeep",
"uuid": "3738d1a6-ddd4-4443-b63b-138af26016d3",
"value": "384:T7ptyfdBgZqCq6pWKksgl2IYdSuC2WigRelS1K8C1x2i7JxhsmuH40m+wMe3ifsY:T1ZqCQKy8IYdfWiUelR36ihR6nmRYsY"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086954",
"uuid": "86fb9914-7d7b-4236-9abd-9d102ce95d08",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086954",
"to_ids": false,
"type": "text",
"uuid": "3b3ad8b7-b0b0-487a-80b0-be80be3a344f",
"value": ".rdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086954",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "747b77c5-a867-4a6c-9613-b104900f48c6",
"value": "4096"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086954",
"to_ids": false,
"type": "float",
"uuid": "975502ac-c370-497a-aff3-bfe13b1d7c69",
"value": "4.5653063746933"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086954",
"to_ids": true,
"type": "md5",
"uuid": "22bbef16-0cd9-4cac-a24d-1811fcd74eee",
"value": "d5cc9dcb8f2e36237c1895d9de49de46"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha1",
"uuid": "27d7923a-0e61-486d-a569-5d94e11138db",
"value": "c96c6dcbed0c58f3cc2253157395b66bb1e2fc9f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha256",
"uuid": "77f7e933-6c5d-4c4c-a585-1297ac7d8b43",
"value": "5d2c59d196897e18445d7dc7d3ff2875a32449ce55fc2d47d6d38661aa9f2a38"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha512",
"uuid": "c3a4ec42-543a-469f-8cb3-18005ee1242a",
"value": "1dfc4a8ca1abfbfdb93f20d13ef88dd589c837eaffe2c2a908bb763d0cd4841e78a2bba8b7598b520397cd57aa22de1eda324da1a35e44f5ed1323106548046d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086954",
"to_ids": true,
"type": "ssdeep",
"uuid": "b4ae9fbf-d9b0-4219-80ae-9f61f4797fcc",
"value": "48:rwcdILFDTZ8qNEFw6QNOqiKsBAXpQXQcPhhpHP52VosLHMEiLnRVsxO3YU4dTh+s:r4Cxefz4ZR2SsaROOrOBEM"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086954",
"uuid": "bc94cea5-59b0-49c6-b478-db6deb6213ee",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086954",
"to_ids": false,
"type": "text",
"uuid": "0685919c-504a-4904-8cde-9d978d104bac",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086954",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "dc928a7a-e274-450f-9ada-65a210568f50",
"value": "10752"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086954",
"to_ids": false,
"type": "float",
"uuid": "16f0e3bb-543d-45e3-b68a-789a637b1ec7",
"value": "0.6671192572015"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086954",
"to_ids": true,
"type": "md5",
"uuid": "f814fc1e-4bc4-4509-b61e-902e976ca152",
"value": "cdfba2ba88c72647f5347a2835bfd043"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha1",
"uuid": "3779cc80-fd22-4210-aec4-88dd6103ccb4",
"value": "da6a4ffcc7026a22fc6df5b886285f194680b0ad"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha256",
"uuid": "876955c2-d4c7-409c-ba61-28ee21bc786f",
"value": "b5ca2985dcaf1bffd87922bf5ae6425012d9ebea70b1f9ec5ea7bc212c37cb25"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha512",
"uuid": "4f57785e-fdf9-4a06-996d-3c054a791369",
"value": "6ccf8b884e64df2a4074d994d97f287f43a263614ebd91597dbe5de0a5f3c48b288260fcbf3e382b4860747a6da9d03e5f7c8e483d81f1e236dd59ba833bd31e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086954",
"to_ids": true,
"type": "ssdeep",
"uuid": "63f7e973-4276-4581-b53f-7beb3767caad",
"value": "24:W5xK9PJtoa+0SC8gTMCkzVk1yu6wnffu6wnfX6/1nS:aK9PJto8SbgQW196w+6wP6/9S"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086954",
"uuid": "244e9eec-ff34-4fd9-9899-5259e99af7f1",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086954",
"to_ids": false,
"type": "text",
"uuid": "52b91feb-574d-4827-8673-9a41b7b83489",
"value": ".pdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086954",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "6bbf9100-a7d7-4a7e-b3d3-a0ab80bb4f36",
"value": "2048"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086954",
"to_ids": false,
"type": "float",
"uuid": "9f2b4212-bbb8-4f99-887f-e5faeec40ad3",
"value": "4.4171417196239"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086954",
"to_ids": true,
"type": "md5",
"uuid": "f1a1c6fe-50a1-4031-9577-4433f2515849",
"value": "af11065588ff1be5e27be4cd684508b9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha1",
"uuid": "6f17ca9f-2da1-49c1-80f2-ba22e8536bb2",
"value": "5aca630b4b10132b3933a7919d630b37a2d77e4a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha256",
"uuid": "f227bc46-ad4f-4be1-9951-76c820a53724",
"value": "20b45bf068739ca996e0b62119b8f06045946193bd1fee9e963eab141b90865d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha512",
"uuid": "5e87e5d5-2ac1-4d8b-8027-c551e6f611b9",
"value": "67c859d7e9cc3a0a0dafffdec1e2cc1a3950c32a9655d38520b9670df9a213bf29ce2c00c2e50e3fa24f999cc45c3dc748ca75121244a95a41a8bc447e38d8e0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086954",
"to_ids": true,
"type": "ssdeep",
"uuid": "2695c642-e4c4-4b1f-a263-fc6cc31e60ed",
"value": "24:rLIjwvEE2vBxBtsyzw1o9/PlmOOKbcyIp341BqCLoosPTLiZeS7:PcwCBxfzw12FmGbc+CHlLi77"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086954",
"uuid": "c4f4dbf3-50b0-40bf-b658-9775ffec4b0d",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086954",
"to_ids": false,
"type": "text",
"uuid": "90df9187-12a1-4a9a-bc9e-ba9a56255030",
"value": "INIT"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086954",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "2dfc5d88-d058-4c9d-8d5c-1269500b5cad",
"value": "3584"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086954",
"to_ids": false,
"type": "float",
"uuid": "5fd52953-4a9d-4a06-9f89-a21b3712f5d5",
"value": "5.1718697425243"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086954",
"to_ids": true,
"type": "md5",
"uuid": "e9155182-a74d-49cb-9483-76002eb3bf95",
"value": "bf3aaff8a4f25625c50651a235f234ea"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha1",
"uuid": "5b3388db-ba5c-422e-9f98-18523fc7dcdc",
"value": "efa19aba8be359ef3d1671eea2533d40a8ad3574"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha256",
"uuid": "73fb5641-6da3-4133-9160-70ece5d586ea",
"value": "0df32b5ab983d4f13d1f4d350e1a92f66e41350711886943720894025588ea7a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha512",
"uuid": "51c07fea-a0d9-4dec-850c-0afe58444cab",
"value": "b3d5d87dfff44bc6cbf37f4f514c223bff7229ac93342c2754effb6d6b5a91fd01939160e5ef37c5edb66ae94670b7ef9387004102d1aa6aa128a32bd7f31bee"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086954",
"to_ids": true,
"type": "ssdeep",
"uuid": "2f69ab94-3736-4933-9f2b-844c7b1bf5dc",
"value": "48:qjHwcdILFDTZ8qNeDYDOjNe7kBtWt2BpRbD+KCm7MuINTg3nuO4EgdW/lLWfe:qjH4ChDY6A2BXbD1XN2EgdW/lLW2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086954",
"uuid": "d09fb46e-5fa5-49a2-86dd-f3d8d1804c8b",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086954",
"to_ids": false,
"type": "text",
"uuid": "6c0d541a-f913-479e-9c44-7dc09de2f4fb",
"value": ".reloc"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086954",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "c4a4e5ee-c908-4099-8129-1d666e41dacd",
"value": "512"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086954",
"to_ids": false,
"type": "float",
"uuid": "988aefc6-90d7-4478-b132-36017511684e",
"value": "3.6204816846131"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086954",
"to_ids": true,
"type": "md5",
"uuid": "43baf62c-92fb-4465-8e75-228d9e19c881",
"value": "fcb8a85ae2d11c0aefad6b5535e1bc90"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha1",
"uuid": "d8a7aef5-5374-4182-ae0a-251bb5cb8a6a",
"value": "12c935664a10eea034a86053d7dad2c872d582e7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha256",
"uuid": "a59d2d2b-aaa1-4ba1-bd3d-5dce2c938a02",
"value": "199727264dad79db742e501ee665c0adb8a5e08f70158dd23a8780663e330e0e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha512",
"uuid": "91f7ba58-af6c-4f65-9f9b-6989d2c3c660",
"value": "aa6cd28eb6eb70ef70229126734a359aed53a505608162ee9462c5bbdc9790e4c35336c52f39941988c3f7c9ee8b4c1d53c9e44b241bf2dd75cb827a61777419"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086954",
"to_ids": true,
"type": "ssdeep",
"uuid": "08a35045-8cfa-4523-b4a1-09018220b0b2",
"value": "3:X96q9llvt1CtC4/:0+6tC4/"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086955",
"uuid": "2c0b5972-cd00-4f8a-9e8a-cb31b9914593",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "2c0b5972-cd00-4f8a-9e8a-cb31b9914593",
"referenced_uuid": "98c6cb34-b6c8-46d0-a6ff-c5c01732510a",
"relationship_type": "includes",
"timestamp": "1624086954",
"uuid": "8bdbe630-4971-453a-ae2f-ad5a4d6fe59e"
},
{
"comment": "Section 1 of PE",
"object_uuid": "2c0b5972-cd00-4f8a-9e8a-cb31b9914593",
"referenced_uuid": "86fb9914-7d7b-4236-9abd-9d102ce95d08",
"relationship_type": "includes",
"timestamp": "1624086954",
"uuid": "0804546c-1e45-4b63-93ed-46ebc43acea7"
},
{
"comment": "Section 2 of PE",
"object_uuid": "2c0b5972-cd00-4f8a-9e8a-cb31b9914593",
"referenced_uuid": "bc94cea5-59b0-49c6-b478-db6deb6213ee",
"relationship_type": "includes",
"timestamp": "1624086954",
"uuid": "bdb85af9-3f23-4060-bef7-d90426588ea0"
},
{
"comment": "Section 3 of PE",
"object_uuid": "2c0b5972-cd00-4f8a-9e8a-cb31b9914593",
"referenced_uuid": "244e9eec-ff34-4fd9-9899-5259e99af7f1",
"relationship_type": "includes",
"timestamp": "1624086954",
"uuid": "9181879a-e9d3-4366-9fcc-19aa5e8817b7"
},
{
"comment": "Section 4 of PE",
"object_uuid": "2c0b5972-cd00-4f8a-9e8a-cb31b9914593",
"referenced_uuid": "c4f4dbf3-50b0-40bf-b658-9775ffec4b0d",
"relationship_type": "includes",
"timestamp": "1624086955",
"uuid": "de84fd4a-97d9-4bf4-89c6-701655a58973"
},
{
"comment": "Section 5 of PE",
"object_uuid": "2c0b5972-cd00-4f8a-9e8a-cb31b9914593",
"referenced_uuid": "d09fb46e-5fa5-49a2-86dd-f3d8d1804c8b",
"relationship_type": "includes",
"timestamp": "1624086955",
"uuid": "d0de0c99-7ab6-4980-ba55-42372ad265e7"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086954",
"to_ids": false,
"type": "text",
"uuid": "fa91f704-2537-4ffa-bba9-62d38d2adc99",
"value": "driver"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086954",
"to_ids": false,
"type": "text",
"uuid": "b45c4dc3-23fd-44cf-8fac-dc9c974c75e6",
"value": "5368713632"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086954",
"to_ids": false,
"type": "datetime",
"uuid": "3b19931c-f9b2-4208-8d7f-f599cbf8ca83",
"value": "2021-05-15T12:46:38+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086954",
"to_ids": false,
"type": "counter",
"uuid": "491fac61-f9b3-4eba-ad22-17345a708e22",
"value": "6"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086955",
"uuid": "9c23f0ba-8a41-464a-9bab-60fe4ec0034d",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "9c23f0ba-8a41-464a-9bab-60fe4ec0034d",
"referenced_uuid": "2c0b5972-cd00-4f8a-9e8a-cb31b9914593",
"relationship_type": "includes",
"timestamp": "1624086955",
"uuid": "e1f1cf5c-a9bb-4166-bef3-86cc4d4d3806"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086954",
"to_ids": true,
"type": "filename",
"uuid": "7f102534-90b1-47ea-8844-d26f4a8a1caa",
"value": "bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9a"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086954",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "389c2c01-f86e-4e6a-a0c3-59e361f04569",
"value": "57216"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086954",
"to_ids": false,
"type": "float",
"uuid": "a4e1fca9-f824-4a4a-8f17-e1a5488d4da6",
"value": "5.6520696939029"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086954",
"to_ids": true,
"type": "md5",
"uuid": "a082c706-de0f-4cd4-a2f7-fa2573edde0f",
"value": "530f12f8058199964d0b41f1856185ec"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha1",
"uuid": "07eadae2-e2db-47ce-9f03-42212c2cbf5a",
"value": "8b04023990d18dcd5cc4c5538b332b017f3962fc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha256",
"uuid": "8238e337-e2b4-4a1f-8e68-80d457871c97",
"value": "bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086954",
"to_ids": true,
"type": "sha512",
"uuid": "29b04d4a-e2f6-4c94-9eb5-2d72c617632c",
"value": "790a9a6e77ac065b53cb719092076c9d4bffa03082dff79ea86949ed03a8eb13d23c44e41e2bccf98d49afb12f1a44914ff7be5fd0e43bb51f9340011b1e404d"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPs501I0n/TP5WYAAIDfAAAgABwANTMwZjEyZjgwNTgxOTk5NjRkMGI0MWYxODU2MTg1ZWNVVAkAA6qZzWCqmc1gdXgLAAEEIQAAAAQhAAAA9gCUOop8Q/VEHLeyVx2fyzBSwHO0jzipQ5d4cCo+XKGY1rm+jTi7i3Qqy/HazGewnbmgqeCswtKaZtWppSSWWzaRZOOSki/xstdzRGTHPdY+nU2slR9Sj3RYboNkewqNRz5KPFPjRULuVXBKo/TLVeEt5Ll6TFT7KeJHKgkMYFmcsxt81Jrmplslr0T++ykIWL/YiYBXBoe5mzv0Iiu5MjCrbYnuN4Zo1zG19aN+4GUK+5I4scKiKvOqlyzNFMI56IPGT1YJlT4JZl0BocKSIGX2vNff8x5UW0I3YHT6xoCBgaRzzt+fVN3OMVUfMY8gPRgXfVo+euyp7Q+NhYKVn8qxsD5jYEKLOLJFLyifD9uWTI/Pc6ida1YDL9k0wablhReR3BML7SeIfd8/xNb691farAOZ0hKOX6wStQzohWpCBmpZnHDJbjxUFI+n9aFf59D3g7pP1oL1wDSYt7uX4EQgzYp23M2k5RHDLzinXasRPsKw0B/NvoRD1ircHznbwyegkVYF7JjAL9jz9PyDEeBBXLn6fBZToj8J8+MjaAGCRMdRnGLSou+gi+CeePpKe7tamuheXwlrBQb8q8NCAl6C2+ahzxPCnDHaKl+i9Q1rnfYRhskjgZSLyT3ebsLMT1FtIdhoQ8i6Wy/of5S4W3boNs9nqsD3pTAaHQGXbPAvZ9FV9aWGAu/GvOyYJtTwFZZHu/TvfZ4/q2gBHp0zjFvgIwIyD1y1CBRaOjgJ4H1XSZS00W1vyKZfVfldROeb0af7gqJr2q5aECKPWmdHh2jBulLqXkWtPLytl98EyoLqTuUH98aLHHiH0ZdWwvIOMq6JZwmCjNbFusuGbx3eE68vfHAfl3ojMn/BHGgpHqXfJZQ2aLO4Tx+gowKFHw0ouFcYyTHxMzRYuvDX7H7YWqR3UiO/htgWHtm2nwSaELr3hXXSi98SKg7DvIamx6iRO3/mBajU/Jrz+u5GdjM2M5IkweaxIYhCo6/J4RdpLiVrn8pDgv434BqqUd9WdAmlbIEVnVip6DCM7m9HXmCfzm5XF8ZOqg6iSPxN+XJTtaqYJyQqHCc6n3bBCNVaKtHqQHPZzK913j3E2JvNXXpaK8gc2/NdH1RoBZUpeeF+7lUyTiEv0BomE0J3r8dZ37BiGKIGur74JvZUeRsbGVGosqhBSDE6/qI224lHCD8C210g5n/8SQTQMqB6DevCH75rWQ3fzMWV1fMioN8bZ4wdOmNJAWHFL10lHQ4fCbS0nb1r+7QCTWRFH/pedWS1prBwZAMHfDn7MPSt3CYCI0RTZZGQFbrKBavGtTFlQ9Y77uY30Mlf3x5Pp6fkzuBHEKtk/Sq0wtmA9jS/rC/Kj0/wuuxgxR//ScYAXKuUXnYYR4IRvy6xVMnI+Oq5pgdYNckAap/SLBgi1IB10WFdw5XT17FknAAR014UkX7Ur/ZaNsZRsS8ik1flGj3/6+i4eFb7kf4jBYoiytfx4iSGP4Wrc2AbnGW4EDK2F22qGyPIuZ3gWCyyWZevEJ7JBDtpUWWNeYCXy6EEYZpOniLIbJzyMWww6vmERx8NfM2ylxUbFX2lp2TIJva6j4eceTlMwMxNAhGP2RQ8vP2puDublFadY5sgck5tEhz7DokvE0AzesRtYE9bfIconEXz/fPhShLV+Cnl7r19VBhsEJUr9uGGFTUwF1/wHsZwKY+ZhPNls5eTEH+MyeCe2neAPjxpT83c83fhi3VNusPd8X0knzNRZSuGB36Z5MXGePMCCePQVGIeHRKG5NhAjcWSW3biDosBWWSpW1BntP+WV/UE3R3zHl5CBuD0enE1K5qRigCTfvWmB5SUhBHZcFtg+oodG36VTphLFam0Qi7i8zyRmgP+7C1AJHgRjew5CaibZpfZcg+wt5HN6Is2qdih3pu8RyysEqgh6ldGbc6V131z3jzaMJfN0nR6r+tB8PCPiBxi9Os+o0XALGImr1eS2pav2+WiMWqN81eSvIXnM+1udfiuTwB51hLVUysvvCrauhuzJaIxHB//Ukn9SChvtxt6KTHA0reECIfiYOBLJvgADYrbjd5jv2xZMirTob4efWD6QZpiO7s7gcbZz0J0I27cdebgs9oGVgymoAk4JHT1TU6DpuI/UOkIhXl2xO44Dv0zBJbT9kgUbD7dTSIX62mdUwFo0tY0nsyXI1I7SIlxlqHF+dNqZfeyrB5Umdv00+1aoZjMKdYDA1mL3LNwvTjO0M2jIM/Tmku6UApJTrEFDuIPUPbsIIYnkMnW0uIlErOv483CL6yzlHNCPcY6GrxrU7Op5FDxN0qUtw552maJK6IOKllbNKrwLFeK3vdKyEIqC8h5cOZvkZeiNaKzbHoM3cRf1vGmX1ueouDRAn9T5r8CNy5hFwbbsgWTa1EA4BGISHO/mWfoziUec9uRRaq+e8O6J/Gi9+mkE8u9OhWW//QlzyS6ce9eGo762/xhyt3267tKY0uNCfu4sBj6e/88KsAXlC9aX8LQxNsI3BdocpIsoqNrh5Cb5g/NXMmjEiV7clX/T8Y+5YvbiLexHb4LG7yzLCZR0JNhqZlW54BkG9GgxqxiuSmIpWXVpDQ8+SqZLLNQcBENn3cAfVVL4Z6BdCAV6qhpuX5inh6TGdZrg0DEPjAtHtHV/YlxaGLGqIyqgqwCIW8kFK72BSpAUrzAjRdni7+9gUH7LzYQrJ0g2l2D7ZtoJ4c8EtCz/MPnD4GJA/rI+yldFBrXtMYRiSpPVvYCWHqpNu3cqeYvT5aC8j5oJQi+p/emdOE9ejdliJKhdVgvY5wtx110waaxW2pKj4LiYkssbcbFnaXE0Qg6lI80/FXjB2ZpsJRPuddDomBejLr0dCkeU6lgN3YDWFPp5SW+B7NxRnXAaAVcY/RMCmdxAeRQVqCfvmUDrs735f4Y5UAya1UPYthsQbmDcxwq9usQ3h9FeAAEIO3ZNK3P3Yg4Vl3AvS/eQdgvPS3gGoe1JNfm902QoUT5mk4W2IrTWO3YmXEss7kbCHe406Z0Z9C7xiIWbMxAF2bCBw1zNRVLKj8Cd9KGHaZgvAHZVOi7wAFNTK9pPG8S7kTkIppJ32x7h5ofgwBKK2ifUD6Kp4R5PsTkRrbgU/gNj1aDZflInswMe/DaS0nKXCZVtwxFxpq8Lvw6SJOHgTJVKX2SPhNdeJkoYW4A0ShfSaI+ndD2lrUt5Fj+EO0oHjyEliY5sFyV98LB7izEzDoI/XWmsqyRHOJpUKBr+yGxgb9EZPFc/mrr/1gvXAS3bnQZ5wlDMJQqPCkan+9sdA47EZbWnHAd1AvtCZPVjgag6T06LsGiu4VHUzu3Ruf0WmBBTaKmx0RiBr0VKKZaEP5ke55JZSbeUzkDK5OJGxJ2KobKHUhOeOg4jn8pduKg6VazGL0nDhO9kOS0v/dvwOEypbxkHlz0ewWtdMHy31OG4bk6ZeTegCAqmZ57z6l2CdSKYweM3AZQ47aymlIl7daC1XMSll7uofX/0kTYH3wPo1wZZyxPEQYM0hPJTQVC7O0dtd6NOYgd/YwtUfstctGAc6VGwuMhhG2lH8aB+jeA8C0a29D8FtlKXHJcUkjmXFvpztS3pK1S0xllvIqAvPKcOS+hmKs5pRBNYWdRzvRtA6KJiMBorkbVJ5yORugL3WbLrk6gxTmFkSWAQayU3UKG3G2/AMIn21Na0jNAE/4ShIsFQMEAj/H1MQhORjf8ywwR12FfvRTN1wIYMOvn2umdsQtqrMh5vsygkvia9xWUfVkZd6J1kdzl3njouWgqyoZDCuYbEOc7EmCejnX3TGAaqjbJNqF0TpXM4MYHPQ3U01MycdL5cxrEa27pX5VkMJsO7WKamatQy/ff755mnMQanbtUANkSk76snXz/WwvPJ0ffG/dOIf03bIpNEgPTAifRHS6imeelmxiHorPsHqsR0PCgAdSkW26tVxuRsX
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086954",
"to_ids": true,
"type": "malware-sample",
"uuid": "22647452-476a-4d2b-a900-6d7008f96c71",
"value": "bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9a|530f12f8058199964d0b41f1856185ec"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086954",
"to_ids": false,
"type": "mime-type",
"uuid": "aadcebd4-aa97-446c-87c6-68c5d03e3a74",
"value": "PE32+ executable (native) x86-64, for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086954",
"to_ids": true,
"type": "ssdeep",
"uuid": "37e7d8b2-bd93-405a-9c24-b0fe48a7a57a",
"value": "768:01ZqCQKy8IYdfWiUelR36ihR6nmRYsn5jS/OPNi7SbpG:0Nyq+4lRX6IHnsOVi7so"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086955",
"uuid": "e6358f45-c3fa-44be-ab85-eb8ae2b92b26",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086955",
"to_ids": false,
"type": "text",
"uuid": "5376e206-5b63-4dda-ab8b-b09cbc62dba5",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086955",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "7abee9c1-9503-4d90-b2bd-ad41c166e7d3",
"value": "6144"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086955",
"to_ids": false,
"type": "float",
"uuid": "22552293-f2fd-4402-b35a-090c3675e29c",
"value": "5.0220033275988"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086955",
"to_ids": true,
"type": "md5",
"uuid": "844fc2b3-3d7b-4420-88d5-b4f7b204b39b",
"value": "99a48e94880084ad9c1924a5dcaaf54b"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha1",
"uuid": "2d9950e8-d988-47c6-8b4d-b44fa7cb8588",
"value": "71b2600a416d9883cf9e063fc75ec4fbd9f8a57f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha256",
"uuid": "bcfafe4e-003f-4849-99c4-6f8a78289fdc",
"value": "76bafec380341efddd6ff5753c579f1aa5a6ff969d32d36747a0e9549149ebe0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha512",
"uuid": "86288a4e-4ad1-4621-9ae8-70d5f64ccf34",
"value": "951f54dabfc574acec7a32359214c3614685e306a96cae0b0d60cd51556f70c5eb0a246191073c094b64c87734ca177be8a94d8571eafc02aaf430cc47befd65"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086955",
"to_ids": true,
"type": "ssdeep",
"uuid": "12f620e7-b513-4806-a1fd-186642a6621d",
"value": "96:q86Bc6RteCoca9M34/L6/sGTmuViTAy3L4i39jbpSR+ePb+cSr:74teCocaG3GO/pTBg30i3BcPb+7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086955",
"uuid": "94756020-94fb-42da-ac3c-9307d2670cc4",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086955",
"to_ids": false,
"type": "text",
"uuid": "5120d398-fe65-4bbb-a455-c844c1823577",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086955",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "a127b6eb-363e-4f2b-9372-eb36bf1df5ef",
"value": "5120"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086955",
"to_ids": false,
"type": "float",
"uuid": "ed336a9e-459a-436a-a410-47d58265b082",
"value": "5.9696789438541"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086955",
"to_ids": true,
"type": "md5",
"uuid": "93c2dc72-a6f4-4990-bd18-217f207a2e28",
"value": "5254471169d40804343c29a0c7c2c756"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha1",
"uuid": "dbdb49d5-38b8-46d8-8bf8-f7ce9da4699c",
"value": "b879e7313f3d05f12df64bb127636e6da1d6b13d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha256",
"uuid": "220d5d42-9c1b-48cc-aa8d-1420ad1fb1f2",
"value": "e05febf89b27e15fff85688ebe072fe1c21a909a25c1c950283eacef1db09062"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha512",
"uuid": "f06431fa-5a33-4c26-ab92-e2e2ae80ede6",
"value": "bb20fe30a57a33e0afcddef4ffe80634714df3ee66cc0a1d9447439b5fb611679ee450c77d16fdc4f33992abeb2bb5c1a3cc548de9b420cf8be5ecfb40c3c6b0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086955",
"to_ids": true,
"type": "ssdeep",
"uuid": "19fde9ac-a645-4abe-899f-061249ef3016",
"value": "96:6oDC2bjNUtWh0G3yJR20gltKdJdvPf/4v9K4RV:RC2bJUISPNglwPv2K4"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086956",
"uuid": "8d7a063c-54d3-492a-ad81-5352128577a7",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "8d7a063c-54d3-492a-ad81-5352128577a7",
"referenced_uuid": "e6358f45-c3fa-44be-ab85-eb8ae2b92b26",
"relationship_type": "includes",
"timestamp": "1624086956",
"uuid": "23c972e1-27e4-414e-b62d-9376bf2b97c2"
},
{
"comment": "Section 1 of PE",
"object_uuid": "8d7a063c-54d3-492a-ad81-5352128577a7",
"referenced_uuid": "94756020-94fb-42da-ac3c-9307d2670cc4",
"relationship_type": "includes",
"timestamp": "1624086956",
"uuid": "d4670058-480c-49dd-98f1-4ff0cfc49283"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086955",
"to_ids": false,
"type": "text",
"uuid": "ba3db832-a084-4b7f-81bc-c35322452558",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086955",
"to_ids": false,
"type": "text",
"uuid": "fb9c3cee-29e7-4074-9141-d68e211416da",
"value": "4204128"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086955",
"to_ids": false,
"type": "datetime",
"uuid": "846e7a10-7172-44ba-bbfd-1e7a615c485a",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086955",
"to_ids": false,
"type": "counter",
"uuid": "61684f62-a2f7-47ba-89a4-7fa15e68f310",
"value": "2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086956",
"uuid": "7bbad130-f1f4-4b17-bb04-3d4d7d6bfc37",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "7bbad130-f1f4-4b17-bb04-3d4d7d6bfc37",
"referenced_uuid": "8d7a063c-54d3-492a-ad81-5352128577a7",
"relationship_type": "includes",
"timestamp": "1624086956",
"uuid": "d75121dc-c9ac-4b3a-8a53-844a2bb5bc3b"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086955",
"to_ids": true,
"type": "filename",
"uuid": "bb359bf5-07ea-46e8-b348-fe7ab91b3186",
"value": "b16c3ed44cd04b033621ada7f9ab89d830949b3c9dc26999d862ddbeb7cc5a86"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086955",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "865a4a89-cf8b-41cf-b6be-c9e00de8911d",
"value": "11776"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086955",
"to_ids": false,
"type": "float",
"uuid": "a2304bea-ddb8-4a53-966f-ec6448497ee9",
"value": "5.6165210899837"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086955",
"to_ids": true,
"type": "md5",
"uuid": "9e308fa7-54a3-4f6b-8c1a-e58e983d31fc",
"value": "31d3f0ae33c72beff48c9459b132d24d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha1",
"uuid": "41713689-57bb-439e-bf0a-96bba7007cc2",
"value": "f5bf9d483e0a204e7ff59fc092b4e580951802ca"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha256",
"uuid": "a647c121-cf15-4491-b735-9e407d213eb2",
"value": "b16c3ed44cd04b033621ada7f9ab89d830949b3c9dc26999d862ddbeb7cc5a86"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086955",
"to_ids": true,
"type": "sha512",
"uuid": "8fdbe8fc-2b17-45df-89b2-23b4315d074c",
"value": "e58997d351914a9cb8fa15672ae7ee195d131a9bc4ff991dc508869626c95e8514b75100ae12ebc4b08578e843863a18b248711862e183e50c5e81da29e42e07"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPw501K94cc47hQAAAAuAAAgABwAMzFkM2YwYWUzM2M3MmJlZmY0OGM5NDU5YjEzMmQyNGRVVAkAA6uZzWCrmc1gdXgLAAEEIQAAAAQhAAAAOXv99s0o/4tintAQp3VezQa2Z8cQOus6oV653C/UMM2FhMbr72k+bLMwuagXdmfu5AukI1wwoKKw/uR2JXtgspueoBtEeyoVgUfc4eNySgw5mnvVezIgSTYGDgJ+FqWt8DhXxZpx1Mewsj5Un9GtvjHZw+EwVeT5X5ot8OEm2XaeFKY83lXrQsfDD2JUWa/I1fgv/OrpaLtLzezNFmlLiYoWEWTshneAU5USIB+HZyaadXBOQVnD5/fjIyfPJiri+Dg+B7NzWEgXRDdQE5Yi7VXv2S4czYC+DdurTVXd1gCwqBWIE60bJiPQ5qK8qBFeMU2QJmbczu2O7/zLjPLTFHSk/+J8u3rdMh6vHcHM1WkeJ8B+Jlmh5pFU6358MtZs44EEakCWhlJDFQAnhQgTS+bfkw7fw71PbAxTsKWLaJP+NpSAXMbT8ivZrpmnryTHICV0b30pRBkYRz18jy4KjJWLWYYZP4JJ1cwqA8yrp8XApofwV0qAr0zZNQbMVtTw0R3hr3kZBH5rrY2xwiIMdDndpX7981958lDxAQoRe8KQhPFVKiVWHVj4gD9MgpTCk50sf4FVTL6TCVN2sl2lgg+I/3vstGQRkoLm7jFb56sqzLpTEgACC2uLyqrcZu5Kjdb6kuXWHoY6Wd5KCQMAlzpUdT82HBWv7to0Bxvhjy3sq6tW3IttrNQj+7ml61Hqy70xVhjpV5pf07qVLKizVGMITVw5GtpD1aHBzSlhlGzXOQIg1v1Za5GnE8D3JDma86Wbw+21bieFwCk26ziVrhBdRiZRcPIDz9m/se0nxRSpMB4DLESBvlLr7eljKeC3/S2okKFgitpI5RTS5obacd4vAv/eiz1v0y92N0O3U9zikcFwCZ2eA71iN5nComTUY978VbeYPLi2wm9THHMrqqe3DYFOEw/0PXn7QWi36XSVlQ5DD/MnTL/GXlihpJHWEFapMApGxGCHEeanwIea+sy8hqRoXSFuy6oo0Sn+0oN+dN2+lj6DOFimZ1mLrBWGOamzFcd6cbO/LvP6lC1hgFZTYxUZ9bHkeKMnb1hKEtg6gl/hfcaDsoWX3LBhcurwlIsQT/kcY4eZBySlIJ36WgWoW+Nr9bt0hNhENc2MmWb1D0CYOTMBbUmnpQxTOgOzyvAaXyebT9Pww+nhcd+/PqaAWzuw8USosZjRdkOnnqs8Ge3HyI2Jm5amUnSMkmkB9klRMUe61BonYX8U/vcRlRhcHYwSCZuavoGRdv3VsLqOVvaUeg+mYLKQ2mVg7K0GtZRe6aQGWO4E8w6ayGWZuw0cPywFRGqMmrXzlu0j1o6iZyyLwgac9R28ejaV8w2DVrOm8bYSRUGcR/fychMjgK0I3KPtZ6+zSd+V4V3noT4jtcL1/oCgBnW8hQh+6WfGh4hT6uzTuWlQJEWhg+1hZN4rxqZh+oZ7qAixVX93yz/GglYL6eAFwfDay+rtvrtsWU8Ir/qnRKmT1Gtt1v4Cg7fIC5th6PSVLx+9lz0OqkbrBe7dI4i+YmUlQx24TX3uyBC6th7WpB9nw4OrDFYh/kSZ/SDEC1I9RLQevoZXGtWWEWb/I4/RrnM+DN/HcRi2MfNm6LqJ7drlES1ktiJQN3eveE2VYubMKpLV0GJo6yxPkc9hc8hv3EDQNn4eAsj+FH382WHczUA/mCqJmNRRlcT+gteYA6pMPLzZkqI83zxnbcmdPvJgfEYCnLY4WadFAJSeOYmwf1EHjCoIOLnYJqCnr2dqLk36zfdIJK6wohds3AJduzVoqOaJMNG7HzuMYiOQLFQEz1RDPjLESVaXJaOETq/K2qDbDYlDaNNJ1QE1ubz6PPlggJ80DysrJLIXQlF/ZsMENC9rcwOCr8ADdrLc66u5oScwhvuUsEJR3bXhgMwCtygAzFL/H2aue9RiwWnHgxWa8FqknR2e2Zc5gSlcjon33YVMLqw3hKUznY4kiebm2NP0/PhhxFsyMtUcIGf6PkCRGTDxzslV1e0QohU3Jn1IDg7fCz/uGBmNS32hmvDAi2mx9nUM1ANSKJmpKslBdVp+Bv7QOOSQvO3iF7jlzPDVC0JR/4sZMPz7K2ffwan/mv3NIDWYEtfPhh85YIVlKMfQCsgM4iF7ZQYZkO/0jM3E9EwGrAjCAdxZuhTK+UnUUjAoln5IBvO3fVQoyN9rxVUS5hquwhOlXEM+zFrHimpotgojYXA8vtQlNCiBGEFpS8aVemiEwB6ZgWNKp7CNMLnFWRwQjze+64SDQvr914BJ1d8/P6jg+GIq944LUFQcGnSuj+t8DknANv5IZflvj/DbAQb10KhtUAAOfAxdX58QdkaFlZ6V8I+rqGjbkKoW20PyRKRCSaZ5WwsOMJ7UQmtMYlC043P6UEVujHN0lYhg9yGXjmbKuf+Nz883BTxLwu7ukyaq6SBDep595bjHtv+H5+fT7k7+aWVHPIv/qOqWd9GXgdE9/oFNqjN1FbFDqOqgtW6julJYotqi4DM0guLedW9H/CQgOyciKS7+RVrKkGDPmY+oSoS0oSY12TzNXCqOi7f5VY73Mp+7417UsH6J4ob2sd8BLP0iv+2q3TQ+VXDV0Oqs8b70hxIiGiTU7cZJBDCAHelA+lCZA/qFL/GIU4jL1bXhpn0J97EWpfjBTyLrqOfb9xdzaI9navq+RXv8xOUhVH1NLSDUzyESoNAVy0q6x2KIdoxjZsJ4ex0ba7kYbRcgTB4OmnN/9LcQiXi4Z22Gc7eE+BjQZrqSZgGExJ2Y8i9yTQ3LIYAsKKFvL50bfR15oZ+/U+kUZ1ymGz6u0McqrHCR2w746kVulr8/MF8It2foAYoScYNCnW0YZT0c9+sREInoxaKwp1VmIpi0X+p8DDDiixB4jJ3JWoFD0AhixHUHyFB6NY5/5jT+e0XnteWBPUZ2EWSVpQDI74VFRpXi9VN6mrVCAW98p4PrC/3jcl3eEXrIQ/vmiWRWLV+zKDgmn53BA+3KP6OZH1fuK7EJrJEQ4sDoQi6Sf5iPMvbyZ0g7bxlYr4HL8VffqmaOtZUOxjCcPfMRva3B2XbfiKoIfSTORFaVH1jvoxlf4MsHrfxhmnCG7YvR+TwUx4nTX4jaIwXUhtY3z8pqtndlABrT2BDrkzsjpVJSshfFPvyrgCSw+csctj0KiQx135HLl+ljhoCHgZTJRsdtKDKWYPoL7epuT+v6pmRXUD2OHPjFVXLnlPyzn5pgUo5ctgz9gourR3CGjvpb2dJDV6io2zjcq47HdEnsNZkLPiTLqOUwOPBw9cbF4pDrv0wL82VJa2j8eqCXKn/tT7z+rE8wv+69PnsWvlGgbndhMd7V0WTKkIgE3WNi5bfTGH2am7fHY3uvg1Qsjf9lStdrcYtsa3/+cv67ze1yRrHMwL7DYth4ufG2ZRiu715w2HEJaNvTA0UBhgNfAjcfPxmxlFn5wRXGEHNWhjqzOCRvYfBmDgJj7o3mTuJMZi0lO35A7wpfOY05XHK4c23kSx9Mpkg1Px03XlC/0oX0WLtdArO20dPhnkDulsKa+aJQmFZ6Afuk4vkZh2kSZbyVTyyKIJzLc3bGzmZm8AOkWWmtce9ivkzOoaQER2pXN+iiILjXwX4cCZfZ0PlbW2fXep8ITGFwaIQ1gfq0t7czukoLOcD2sf7eqV3W8skFLS/MbIEs0IYZ3YnnUJVkh8YJKJ0c3woUKKGYq1np2i7OxzyzAhn5B7Tljd7w1Rk4uBQ1go9WsyIw85J9cfVM/C0hWgGH+tPgEFJfhkOD3fIdduO3VIm1u+CFnEsC6dishdb3acXcANOU8pwxB66HxRyK3FkRWbGxP+eWHEN7QWIzepkG5WfrvOe/NgQ1O5WSf7nHkUMm3xAcQ1pdgWIr/kZzDiaAKMztYc5jEyLvjEgXIVRsoL+FvVYGPL/x6qvix2eJUAHR8T7dUDFDNnDBn7Dg3Azzo/
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086955",
"to_ids": true,
"type": "malware-sample",
"uuid": "0bee0483-279d-496f-871c-26605fa6358f",
"value": "b16c3ed44cd04b033621ada7f9ab89d830949b3c9dc26999d862ddbeb7cc5a86|31d3f0ae33c72beff48c9459b132d24d"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086956",
"to_ids": false,
"type": "mime-type",
"uuid": "c970a6a3-fb9d-403e-a6cd-8cd7b9484a1d",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086956",
"to_ids": true,
"type": "ssdeep",
"uuid": "bfa9438e-6ede-4e1c-a87a-0f37cdc341b9",
"value": "192:C4teCocaG3GO/pTBg30i3BcPb+NC2bJUISPNglwPv2K4:CeNt/xO30i3BcjaTJmlglwP74"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086956",
"uuid": "e85cde67-3817-48d8-b6ed-a1415aec0e57",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086956",
"to_ids": false,
"type": "text",
"uuid": "f0edcb98-a9bd-4aa9-bfd2-2fc7576701cb",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086956",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "d547277e-98f7-4a1d-a03e-f23d708d24e3",
"value": "7168"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086956",
"to_ids": false,
"type": "float",
"uuid": "cac6552a-345a-4d79-895b-a99ba82170d5",
"value": "5.0916181299081"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086956",
"to_ids": true,
"type": "md5",
"uuid": "373de5f6-4d46-4c5b-a5de-00bc611fbd52",
"value": "cfdcf4e026b658096360b3074dc64976"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha1",
"uuid": "58089344-1d73-461b-8fab-d97a4f7336cb",
"value": "f994d8177a07b53a4fd00e17fc1809815c4132d3"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha256",
"uuid": "f1b43456-23e8-4a0b-9c34-82271ed29b48",
"value": "1d797c47b69b5d7a736b9d5b898d461b37a303e1e70c1857fc572c5b92cc86c2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha512",
"uuid": "202ec508-615e-4daf-881b-9d9ad17ac87e",
"value": "8a52615ba3ee6d0f8ae42a11eb508236fb1530cd309c9e617b1f65bd5e4160d6d2a130ebb723a32918ee9b71903c4a94ce65d85d58a8c2ba377c9a608bb6b6b2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086956",
"to_ids": true,
"type": "ssdeep",
"uuid": "09848400-21a6-4fc9-b0b3-93396c21ca13",
"value": "96:iNXc7HaQ3oNa9M34/L6/sGfg9K8NIAY3L2J398FcXu/wVgYdEB8m:iCaQ3qaG3GO/pfg9m3CJ3Mc+YeZBR"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086956",
"uuid": "07a39763-3d47-44d3-bf12-fec30f348026",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086956",
"to_ids": false,
"type": "text",
"uuid": "9e7d93d5-9e91-4dc9-96a0-1e4a4b2f6aa5",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086956",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "856e1e8c-3048-44ad-9698-2b641eaebcc7",
"value": "2048"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086956",
"to_ids": false,
"type": "float",
"uuid": "83ce773f-3914-4cac-a750-fadcb6664e2f",
"value": "4.8235535794019"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086956",
"to_ids": true,
"type": "md5",
"uuid": "c2a88acf-886d-4c00-ae62-590862c69935",
"value": "b71e24a232cbf15c55c58f0bbe722b68"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha1",
"uuid": "7759e405-7d79-44ac-bd52-2883b17a7ff1",
"value": "5147860b708a336da3f27920a1b729390dc93e06"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha256",
"uuid": "f2f09075-86b3-4c1f-8d40-0e59ec6b0b01",
"value": "9dd20c4ff51c2ea26bc0acb7f8d64de68957b31616dad2ae6225eb204ebbd934"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha512",
"uuid": "c55de3ce-f08e-41b8-90d2-6a02b7ab968d",
"value": "8be573ee5247c2167275697fe355042439ac78dac64b228e095d60092ca3e46fc13e094b48d6dd533b8451b819f5b10567b07994f4624ba35e67e46d1686bbd9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086956",
"to_ids": true,
"type": "ssdeep",
"uuid": "a70a74eb-e8d4-4fd1-8997-1acd1e369798",
"value": "48:ChoqgiPO4TCO18D8aUqSt9RwkrXkr99dIAMnF9AIaPPTW:6o9iPf/uSpzo99KI7HS"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086957",
"uuid": "83630b45-1bf6-46fc-b17d-3a4c69127899",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "83630b45-1bf6-46fc-b17d-3a4c69127899",
"referenced_uuid": "e85cde67-3817-48d8-b6ed-a1415aec0e57",
"relationship_type": "includes",
"timestamp": "1624086956",
"uuid": "9925e99a-6fb8-4d90-9434-cae0b9ba01a6"
},
{
"comment": "Section 1 of PE",
"object_uuid": "83630b45-1bf6-46fc-b17d-3a4c69127899",
"referenced_uuid": "07a39763-3d47-44d3-bf12-fec30f348026",
"relationship_type": "includes",
"timestamp": "1624086957",
"uuid": "d2b7b124-36dc-43e2-a917-bf33abecb261"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086956",
"to_ids": false,
"type": "text",
"uuid": "0bc33487-f7d5-451d-b6dc-d57a0906f4d4",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086956",
"to_ids": false,
"type": "text",
"uuid": "a4d5357a-4c08-4a68-8379-c59209b66409",
"value": "4204800"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086956",
"to_ids": false,
"type": "datetime",
"uuid": "89fe2d36-01cd-4d6e-8dec-a52e527d76f5",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086956",
"to_ids": false,
"type": "counter",
"uuid": "18f2b09f-7b29-4dd2-9f85-6857b3ffcd88",
"value": "2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086957",
"uuid": "66cc5e31-e702-41bc-ad3d-c7d4e6f363df",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "66cc5e31-e702-41bc-ad3d-c7d4e6f363df",
"referenced_uuid": "83630b45-1bf6-46fc-b17d-3a4c69127899",
"relationship_type": "includes",
"timestamp": "1624086957",
"uuid": "cb2712f0-1f16-46e7-842e-947076097a60"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086956",
"to_ids": true,
"type": "filename",
"uuid": "63b57ff0-2e93-4be9-8653-7129b9c4fdfc",
"value": "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac4"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086956",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "155a30cc-5d40-4eb5-bb9f-b07a068bc172",
"value": "9728"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086956",
"to_ids": false,
"type": "float",
"uuid": "d8bf2804-bef9-4bb4-8ce5-be2a48093607",
"value": "5.1311954719734"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086956",
"to_ids": true,
"type": "md5",
"uuid": "6f08a526-a19b-4bc4-856f-3f6838069536",
"value": "8bf00ef4dd6bb308c76849901b03ccbd"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha1",
"uuid": "3862edfa-9263-4bb8-925a-feb5cecd177e",
"value": "04e8a8d30869cf60ad42825667224d5cd01ade15"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha256",
"uuid": "38edc669-1758-4b17-9f18-66b1fe93d367",
"value": "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac4"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086956",
"to_ids": true,
"type": "sha512",
"uuid": "8a061e2a-2d00-4929-9c0c-5b22b9e1f5b7",
"value": "551365e55dbe599a156d1de1e59e388878e13d3a491efe963fda241ec58c1c38aaf2d46775c4e1d3c46760d081561f9ab5be9468974e4693a9b3c60a4478b454"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAPw501J+3/kOHRAAAAAmAAAgABwAOGJmMDBlZjRkZDZiYjMwOGM3Njg0OTkwMWIwM2NjYmRVVAkAA6yZzWCsmc1gdXgLAAEEIQAAAAQhAAAAmq/oTH52EeeAb6sGmt+sXavJfnzBzq/X4KQFpCWrmedXYSe9LzSpPGM+VR8vtY1kWHQ3Cq+z/GoDVZw2aALMMcUOxWnzlEZFSi+KpJDvYGxAmCqeFVyqf7Vw586c3Wmp9tcoCFJtMLM0k176nokkDJh1lpZhckc97L/BL09zkpLWjgbaBXBq3AFBlZMVUSFxTNO3wP79RCdz8uPJ9SYF9SrpttZbv41x4WnGzZT43NLIXLdxqdUB1OlAuetyToOTZK52PHuFN3zjSNaPXSNgEuMjN8P2017tgxxf1NXdgjPB256kw3uHGjOvTyp/UA1Oy53nSiskHbj3aGgICzpgr4Jbdco6BXVxDsWPrQYKp33H9AGbN1dR0bd1KBeMa72iBJQde+m2X8ZmscKJ3qKYqqS+9TNSDWkuyHpvhwL8GYT9/Ye4JgyBRY+HWjQFqdMPCc5RyX2DugcfoLlezznYqHokm07laSjphu8SERru3oDDUW0JQTAix0L8vR29IlvmS6CjB6ON+s0DNrvPeGSruhhUR82r9HJ5epUpQ/XYEgf0jM91P5HK6VLKTMf00tuGOc1Z7U/kqAwEdvTD0bzOvtwDgJPs/RcSJDo+iq5q39+Mt6UIFRCmFeoMvoYFsdYohvMhjPVuI21LDq3S4Ib8Q0QBvrHfojFjbolX+P/x3Oget/C6vAuBoR+qLjOPPk9VEdqC2mNB7YSkv/PE8pazKuVuYTZ1mXM3LKf8CBN/wEfC65+HuATENoH+E1F6jQ7PYMwowx+kz7DA0+Qow4AXxy9ojLMUg3ZQHVI8FQ3JUEuHcyXYab5sthBdNNAj/sr5KUKhNgVRKKtwdLlCZcGDHkIKAusAbDQ02ZMWqnOVwBeQZ77tBgD0ELLN5WL2oSn8BKS+t6X17V0v0vN+dKHqw3k05YQz2mHkmiSJJij6fqPv0MnKSjZMA9QHn4V9Q0Jd8Xu+poOYkh34BwL2PTR18j+7KIzlCEAZlHzkmYkQzBnxypxHGDx/ObpNazwX6rRI4kgRHzCbF8hYLrDPbAgK5vZF0XFkPhbyE+MQ36G47yVaYPOjxr4Gk9imqU/ICbC7Zai4+ES+tph5BWlHNfGdHrVqEVMqnx0NMEGjZSiERKUscoY6l79lwUu+ARdFpDJTpIW9AJqZ1HW8vZ/YMKQ9XyqMbPl5Xa2tAXV4Jqy8z4OqJ01KFiD0Ktz8bdS9EZyczv7Yi7HFGZoOYDCS6SVvpZWq4TH/kvawAtYdB8sa9bONJTE0roRrfaQVH68uqQFHmr/MTJzyGHoFSuXpECLKNxqOHkd9bnRgoyaSMFw+3jpy+SoOlDPSOO4jA6mdGlytF6idZ2/uD5XSgtv8jjK/80KU2hEVd5GyAoL7Ltz/MZdx8pMVeJ1DpJWunGWGEPPMqnDz5wKk9e6lkslk3rVNcs5AxqqYLtsRmZRAz92iANGqA5M6eA/FkVMkNwZeZHORTs2L8fgu7waInJG1QEG60AWNWGM49vFOHbDsJFbN7+mNOz9aiMTO7DV57iIueZTyol+jtOPSM9dMHWsVKob5cxuy3XHiS4CwFqdHEGudBLOJ4cwGMkS5B+TNRTWftIaD6APLoiS4/uLYHVEUUoyFhQmog0tZh3a4u8BeFHsePvWGujhWSQj6MThOVVD8l34uUO/c2DSujqxXE/GmvliJ0kyat6FjfcGNKvBE62noZd0zDn4sOGvFz1YQNY1a7l2pS8V9yd2pWhsU+T6KzN3iLRiKEOkUHCXc/1NxyEBv62jmcT2JNIMdSvOG366ehPwDBtUdV6O9fz+MHUb2+Hms8et8NgG6jA8clhSwwVOjDVq9aUDpcfc60sH4lIJjrlGKf+yufqaCx9KlV/SYobcv8ahezIO/EpejmP5DxtFbvg+5IOcRdt1nMRN/rgjzStdGHs5xQ00+e3Tg/eOtGzE0Ywae6DFpHsZvIpkiaWTM3L0WUNB/XvY7FJh6sHb4DchwBGflZuNOMPoi5zrlh0nyyKZgTBt1FfymnuIG3ZlwVWpqQJosqiZiN7QHGCIW/UoPq8Uln/1TlcssE8S6qC6rb3AhSd5vcoBCqkmYq+EMwRWQoyl3co1se/recMKiKP9VtrYDHO80Yfm3r9juJLtW4t7JC42hE7w/tO20DyRzH9O/jzpIl2rii/fV9iTqT2jgwsG42z4KekZhma5Gr4R2b/VIdBl8ouCL70908Et0gtD53UH/x+BGr29c4HaDS6OBY5Fxp1yZmTh8Vlp2R1Y5xiE4xxQwZdcKSo+9Y+sxjiqmxp7FNmm8zfIGxQWX7tqRP3SfUV0Deu1AMQ9qO/EmHgqoqGF0IA5wAl+YEH9jXM0ViVx2PKiE7gzZ0w4bjn0k5o7mKwyL4jQxDTklE+1fiAHZy8Oz5bi8yNxuZTUIqrwjpUsY0POPwSMY3KRyxopo0vRbMSjy4GuqMg8+RpfYwA9GrjqdYrmG7weGMrZhThppfSkamxEbySqDQ+Zs554DYNnYWgdpwxY5yyG3k/py5/j0p4EYZQanhx3KRVzHogBMutxFMqxFUUPR2O+kw15/iXONMOuO2NkU9fvaP08YwCaHWhhb+bepgM3n1F2HebqrLEMmnbgmpNxWGX8aXHUELLFusH4KU9lF5L2HGUDeFKtx6AQA/uoSfOmYEk8R2dZS6WTaG5plgV5JzXtYoeXmfe+ZOpRJwgBSFT/gDwumGp2Rcc5oYgocNsvCEzK9z5TyAUt+mpDrcHdKTDIfTmTKCMMhbN1Jc/H9+EERjef8Dsd26j9Gfkbj/F5gsP8155mnHxjDutT4g7Qgv2zHDMxUxYo6UAih6pM5yBsK1/ZR3V5N+tM44gNiTqyVOVmalv/yCm6EaJGrUaEtpmxuVc49phv/JGzSoT6qAuxjZiBmLn6W8UITaMDtr10VYE9PwaLdwQ533h0z4+/KT5EHM/b7bVxs3u56hYmz3UyhIwUavPciJ/hFZuSmYYQRX26gEr54oSauhc2yIyTgRk21wfobr305d0Iht8UU1PZMkcTsdtv/xfkj7n8UqOfBQraYTaN2Syfx2fV+68QC1vAthHNr3+ICLUfxB2eJ19uf0EhSD236YikwAbMqgZ0wl6BwoTDbFDy7FF0UwGsCrUtdqJ2GDkxqKg5T6OJASNK1IgAp0CJSOMKzM8ows1qEL6qe1E38//toRqJWTUcMTzy/ojdDExEi5yJcKe1FZuxuCA2oMK/W8qTpW0CCDHRDE05hA1ViBP4jX9LSW52OK5OozDwBnZlKUj6y/2WAB5xIJXAXCh2TnImpnIisETBKf/3WhQD+j1CX023w8tqgCkt2cHcjOgxvkjla8g0WlfPcsbjY1kuGd/P3JBwHZU7hM5LTXEvUgPDzU6M/+e+AFJKFaG6aacGf78YUtIkcxlLGo1ZUw1OhQNmKEqNJ6udGyOlZG1L0frFVKSdzOb9GNb6LBB2YLwQ2neTTjoq4AF8J4+xDTQ0T1ecdUVpZeyzFfHtDUYF4vtADdreq1wEH+A/7GVlSui//I6xNOvMJJ9WsV2iZT+3GWFRUmDYzFX9lbmvvCt1Ph8fzF3xnIvQEC+5r82PYZIdOu2RNp0wDzsbbRFjr5FHR98D4l74/aZPqkvP2VjsnwZ2RaneTJCplGkMNNvLiJ506t3eKU/ZnDP3Uy012wAY3mt4qdqouojhpa5rfZuYkFkwqx3tu1eDnB5S074I3r0437dTX7GpQZSnPM+Xda3Yld07IULh1AGS2BhMp3p0WIbxTI/hdBLPd47PLYL3L8BkSFqt8Ot1CmVmFfA5F1H9myIPx9Br6wK64OtLmwlW0fl1E1dfSO5p7TUA5wCxmSPtmJ6ywx15fQYy/8gGPbR9VjyZo5GeP/IxoqND+W7+Gac0G2IHjfxIBUNmpJNNzlJLZ8U+Bs1RG375HemUmsynmBkOicYRto0+1btWXN9skJ9TLI6
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086956",
"to_ids": true,
"type": "malware-sample",
"uuid": "7b579b55-e5ca-4b7a-a5c5-e2528833d502",
"value": "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac4|8bf00ef4dd6bb308c76849901b03ccbd"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086956",
"to_ids": false,
"type": "mime-type",
"uuid": "b3596cec-5607-4069-a74f-03844f1b0d5a",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086956",
"to_ids": true,
"type": "ssdeep",
"uuid": "f23d5ff6-769d-4828-a906-367fa8e291ec",
"value": "192:oCaQ3qaG3GO/pfg9m3CJ3Mc+YeZBkvmKI7H:o5Nt/Vg9m3CJ3qZ0jI7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086957",
"uuid": "1fa704f1-5526-4c00-98ad-970a36b2b688",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086957",
"to_ids": false,
"type": "text",
"uuid": "3caad570-754e-411c-a82d-30e0ad85d47a",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086957",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "ddefdc49-61eb-485b-ac6e-87f20d1fffa1",
"value": "6144"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086957",
"to_ids": false,
"type": "float",
"uuid": "921cd159-cdb4-4ff7-abcf-7ff41639b69c",
"value": "5.0204417084589"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086957",
"to_ids": true,
"type": "md5",
"uuid": "ebd9453d-f93f-4e1b-9859-fea1d5950026",
"value": "54d67a3e6b7fefaa850dc0a355a95188"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha1",
"uuid": "a2889a95-d8b5-4285-b213-67e91adf3bbf",
"value": "22f269d22ce15e39755bcf324768ea33a1bbc5f6"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha256",
"uuid": "3b87ab8f-6121-4bc9-a87d-e2c866c065aa",
"value": "70016a2861fe99117c570b93f0d3fc711c3bfb2ef150ad2d851ac0adf82cb930"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha512",
"uuid": "4b885039-f911-46d9-98d9-c1384e409753",
"value": "970bec109da07499c4500396b597d0c4886b495d2bd0ec2a45f0e05e1ff991cb4466c9b68a22a914b8a5fe9cf2129246ee6b0ba06b87f7c2dde51a503442ad46"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086957",
"to_ids": true,
"type": "ssdeep",
"uuid": "f8ebd098-11b7-4db4-afb6-9496c3361a00",
"value": "96:bJhcyN+iiPca9M34/L6/sGyGOVCPA23L4i39D0LKapPrTi5DnDU:bhN+ivaG3GO/pyBg30i3yPK5DDU"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086957",
"uuid": "bdfcfd96-ec37-44e2-b012-6729b188db11",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086957",
"to_ids": false,
"type": "text",
"uuid": "ce168081-6584-4012-9a06-e3a00aa328db",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086957",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "04355250-4273-4be5-80c5-e6d517a54a67",
"value": "5120"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086957",
"to_ids": false,
"type": "float",
"uuid": "ea621489-5808-41e6-a261-273a5f9acf43",
"value": "5.9533285792542"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086957",
"to_ids": true,
"type": "md5",
"uuid": "feb8b5f9-7b66-4fb2-929c-e4a55f4dc0f2",
"value": "0597c666cdd75b55383579f6268fee5e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha1",
"uuid": "b1957ba2-9cf3-415b-a4da-72ddf6262878",
"value": "088f09b0e2b3fc880ec34578c1dcc2b6cc6462a7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha256",
"uuid": "914648d5-87c3-4e93-80cb-2f6697ede0ab",
"value": "b8725d7bb0162108ea5e310deb5542ccd74122d04e4772e577d0c0616455f15f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha512",
"uuid": "ea1a88ec-e076-4d15-9c79-dc705e8c7db4",
"value": "4f7df59486f72ea45f492a0cac12f9fc1c8ba01662ac11a081fd738160bdb2e5f9af6e40b0a7c42ddf35cad907f9f2da80b60a3000c91e68f7615b2ba673ea56"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086957",
"to_ids": true,
"type": "ssdeep",
"uuid": "eec3f598-d87e-40f3-a1ad-c91f0a5e6dbd",
"value": "96:6oDC2bjNUtWh0G3yJR20gltKdJlvPf/4v9K4RV:RC2bJUISPNglwXvWK4"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086957",
"uuid": "2a138470-fe21-460e-835d-0fc839b2a9a3",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "2a138470-fe21-460e-835d-0fc839b2a9a3",
"referenced_uuid": "1fa704f1-5526-4c00-98ad-970a36b2b688",
"relationship_type": "includes",
"timestamp": "1624086957",
"uuid": "30b3c4d8-fc7a-488f-9713-18b2b9b7e05c"
},
{
"comment": "Section 1 of PE",
"object_uuid": "2a138470-fe21-460e-835d-0fc839b2a9a3",
"referenced_uuid": "bdfcfd96-ec37-44e2-b012-6729b188db11",
"relationship_type": "includes",
"timestamp": "1624086957",
"uuid": "ffe39fa3-4350-4b6b-9b40-70c491dd8567"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086957",
"to_ids": false,
"type": "text",
"uuid": "ee7833ee-e157-48e0-8da3-7fba6f50b256",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086957",
"to_ids": false,
"type": "text",
"uuid": "c8cc59aa-b42f-4841-80c5-502f650cec47",
"value": "4204160"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086957",
"to_ids": false,
"type": "datetime",
"uuid": "de4b6c27-a66b-4f35-b5b8-722e58953b9d",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086957",
"to_ids": false,
"type": "counter",
"uuid": "b74d0b12-d508-48db-8c30-c9926287a3b7",
"value": "2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086957",
"uuid": "17464b7e-b2f4-4c40-b4a7-acde8e505e20",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "17464b7e-b2f4-4c40-b4a7-acde8e505e20",
"referenced_uuid": "2a138470-fe21-460e-835d-0fc839b2a9a3",
"relationship_type": "includes",
"timestamp": "1624086957",
"uuid": "1013615f-fe6c-43f9-aca9-6e2264852feb"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086957",
"to_ids": true,
"type": "filename",
"uuid": "71d626b4-621a-45ac-ab3b-d71b161a8bfa",
"value": "a3e8ea5e593176f9e66c17f6a200fa665c7ef409c97f49aadf5a55ad6b0be97e"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086957",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "3e5d5e0c-8617-4e12-840f-97d59c8e71fb",
"value": "20864"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086957",
"to_ids": false,
"type": "float",
"uuid": "c086d262-68a7-4db2-87ff-c1d41a3af448",
"value": "6.7096887877146"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086957",
"to_ids": true,
"type": "md5",
"uuid": "e6ca50cd-5645-4088-b086-94203cd8ff0e",
"value": "491a38f52692a88f5e97a1107c06a9f5"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha1",
"uuid": "831c2f88-8dae-4c02-ad54-9f357cdefe2d",
"value": "4a4609839b846f384f1b6f3a9a945bf3119d2f9c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha256",
"uuid": "9c8ff85f-265e-4215-a3b0-2e246ce3a9e8",
"value": "a3e8ea5e593176f9e66c17f6a200fa665c7ef409c97f49aadf5a55ad6b0be97e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086957",
"to_ids": true,
"type": "sha512",
"uuid": "ec5fbe2b-1f06-4630-b847-e95b17021d00",
"value": "a27dd60e06263a32955bdbdc1823c1d0185ae88d07f39098aac1506e78a22ea39d6aae6ddaad0fde31facb0e2140752904e68079f9dbe66a22b4fc0c9b7e3a88"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAP0501LfRmCSTywAAIBRAAAgABwANDkxYTM4ZjUyNjkyYTg4ZjVlOTdhMTEwN2MwNmE5ZjVVVAkAA62ZzWCtmc1gdXgLAAEEIQAAAAQhAAAADIVfvaJQkCdfnz1D2XVf3xkpj7cLakkfhRLPyAgRgyjBP6ubFxavLAQWAG+67Uzj2jRX14POw3lvJRol2gNGXqRDCHHqjegLmVBXGFjBipUzGwDpQ42rD4SKkmLxm63+ID8+zSaSuo3KjbwHxEYvwK+oClyTXvpow/MwYtXfN9KQzmIFoNpIqVdGAZNsXE41zHQL5BCt1KUPcYptAW33rCauWI/zG1eFIlwgsxi3u1mFsF6Wf4QhROf8Royp7X8epIMT3cXNhMOG3HkyJ8oEWrRRXX+oIQnloOYtbVWXF30LUgUvhmg45biCVzxY/M8mlx66lCdrye6h6gO6pJjWYy2Kai3WSsR1qsBO67IJFY7Z7TNa3mun51P1LePgnU8RS9ShQUqcUX0haRT8k6PcZPXBbp8poz7ayTuCvfqjgJ+/G3MEjPF5qRLq3fOfa278vA8UzRZBqWJWYrj/7xhKcYB7ImbHobTE33woPH8/YcHIsgrNRnOfEFzOvQIFzyoTOQ8IVkZ+KNqOGKtGQnhxYFyG7jMMiVOb1SQMKKi6TiMp4A7j2/qyLDkVwamGIWj012tr/ymSryXRS2dlSQr8iszV6tLkh9ZeAhahaFns4kh4Vc909X6D/R/wPr8ZS9KZDSRe8tjxUR9thoMWXK52LMQ32JKgLpqrYFomHeIw1Y8TrOO2JBa0SHAH0r14tkIy055xVEQZ1tOtQgY9JvsM7+T7wFvaD4tpGFoASf92eO3vOI7brDiQjQ24wkBPZCruZ0FKjypEv71PO+T6ykxCxuVgQy2XKNGlRxyAC7X5YJVEd9ylAluSlKTLuQu8BErrMqEmmvOneLRrWrx8zPoyzUOqpiDCWpHB7CbxF4w+xW988Svx+aGtWsPl09dZYS3g/kLtn14OMzNLBWjpxPOdQWKsTrpY9HtQicguyTss7hMv+V4t2hDzjhHgCAQgQ6oEBKaSpdh0L+AiOzTwvpt+fPkRaMQvvWgMGEmtOmRrwqjNcrwQENqfCEFLCUI8OUl4+jsNkDf7pNbemSe6g79GeEmlf85hJFLgld67pmP00qckUiqr22wn1ZpBRjbp0hV7D1X/QQg8w6VvSTYZR58BMi3rr7YkjsHbwV0Z1h6E114KhgEwLyW0/cNqeV5Vvxlmdl4VoQ3dgcwGSNBJKt/BUfvrLGslwFcjHH1M/Ro/I+NvjwrUzrwiTnzlhhqZOKWUuUHDykbbnSHDxMSVfjoGQ1TlqFveUcHdk6KMj4hw80NHOiyS301TFkB2jttZwjl9PDaZEO50tlm4KjLN2tNMEgCTxJWrO5fKedFoDS7Q1JqQYqIPbbhEldYSvXrznw/0XQDtcPabZFoRWfvXss/o55a/cOjwxyFAA5pDqubqMU3xSR8offn5DS2gz5hb8c/gDQ4iV5SR4PsAETUeyQNFAVminEfixGrTDbeFhBbysc2Db93qRvOJpxLukTIT1B+XnyH3jnRjNWdvCu8XhruxNUAXUktWajDM5oT+N2aInHQuw8YgGN0COjrtmAb5avGAifCpyWn+G9NVAAGvFWBLzuQDuMWnfjHnLGRdA9IPzzSjZNYFk5o+RMqP4F2fh7sCqArKliIxheI7wwHrakpqwUvITQJvgrFid/JHfDqIT8FtXSht5XTPNsoChMuTwbgMvcuHIOldV01M5wo4yTrC5fgMlS0cpcKqmi3t3cek3s2vPEXK9LL+UMRxW9Z/uqkNZD4a99ATqK7StvhTHKv7xhNB+hHlTUG6D5arMixBHwLhry1WAz0fdI/LZUSX9kWr+QQyV0t5TX9+/e3Eu7DOUzN6IIdn0YascaXDB2q8vIgd/BcQIT7LMS2nw8/BZcSZEh9GuhmUCYa/RxfqoTdXK+qoBBoVk6TZ/p3s8Q28x0I6+HKCI/Hi5LlD9zijmHweRH+pqk+HF/CgDqGBC9brVIP9PO3zkJO6CpNu6do6pdpHmUp/LxH0Ou8jVZW747rtuw9z05HLei2r9SMhSyy4lMw2l1zsWPb6WPNZSoyuwTH2zjkODJr39L0QBM1mdR5IuvkZlCSbHFR2So9MW5rZ8roOuPP5ihUT9J6NmQ16fuMzeQWV+9UWxBF8k2feo5wR7wR4p0wPpuILxYHNppY9hk5mClen+lAACfvMavCaN4gtQ5UWy6pFsErrgpHQPxx+XyPI1ZdkQhZVkeKKPEwnZDHLQnQnpQzrugFdfsKGIH9LkfD6EVbQRAJILoJMqrYX0R8X3Jr4tgMemQHxLL+TyoqCZIuJXoGBsfAIsstSHYzPVeIq8yVFLNJ6Eoi6/QVjmO+72SiNDdG/orDk7ZqgIy/TPVG5R4VZaC1FmKoxkL/zKuSxNeXa67sP9RsIGTwKiWPZjJdL+jQkvy+Y+AXP+mvtQEJkKqydnBsSOvBNkaDbe/dkMV6mTum7zDOEfD3zDFAfWhdSNZV1A4WjMvgZWdJQTw02XV3dYPjrkFnwPv8V0V3aZFYkpB4532+h7JrlRr3G2h84o2lEeC3/TubJb1L7indi5JbvReLBB1QQmBbgNybl3jahwaHaVpZxQrQflOrYTMbTjCUNo6x/mGSU8mrweReO/Q/ERPLoN/swXGNz9d0977wB+VPcGp4/Sv86PNphy2PlOxuYXR9YpmiasmEIeVsoBOY3U5W7WZOID8KZiC4UI18Kft7KM5a9lzGEnZGpSS+S1hL1lnJuffHg7BfbTLZtwC/LWjV7GmePJdW4bur7jxtOVer/UTHfH61u6scIHixy9mB/XvaQSdThEtMg/XfBQEEQuc8R+vJVP0RMLppZNi5FUOs+4TRnaFLbZn9kJkLDzcYVqWn0+CH7QZPrlU8nwiV7RnZ4U03J4FBQT0ZcevbeypqA3DFGY9kWAo9F+49+HjbAoYw9xJy1PYfjVmagKGrKbrtv5gSlfUryhlJ5syXbJy8wG8tqL/QaL9Oc4Ft4CmBt6/0zcoc434/ymZ7MH3eqsQ3/4YMwbUGXGTmqTiruqKQsntvYysKXQ8Dd7bx1kD2GiuVKhwLQZT1lr4WNRX3sBba+I8YcxZ914fVOaMTl/Xvwf/JvYNzJApC3Q1hxb2NcKy+Tg3ngYVOapbB8t6fOW8Gx4xkhbvqZsgeL6Ne++uPFKZAM2/+GuH8txi920uj9l7tRskAKrYLap28pkfZ0tEkwaOoRx1ZThmaLoWtH2Dd9TYcLlCXTgYBlQOEL52KiRBeX//kKtWT587RctS4ouGgpG6Udqt+ELWafcMEAAsgu533b2fsXUfN2B3SnldLKARHYx0zhm1eXIuJH+4WsrzgMBLK9WjRZJkegxmxepb5IbdbZxKa2TbYgu4maVQGk2rkS8rhoiOOoSXKDub6gTIAmYldRpFMVZBqNQmAcUZobHLXoNyIdmwB3eatWPZu86zIM0MMNnCjW51YS4F/V/2vLX0J9EGwVjygexO5nvP2UXwsd2Uy9uoj40jOBYC3kT1WPmBTRL1JrRSC/78NojsKuR7IsYP/8XbDEyGZadQi8F7V1VJz9JQoBiB7wawWzFm6kc2WZCfKQASGIUBd4xRu2X1pDr71X9IbYLxiMEfkW+d4Fs1fqVmC1lIq8iEWugfxAZ+afHMO9EVXkgi41aOkYtfTvZluv1uYmQuE2PRzW8wz5M9LEg9BbTBsTC8f+r554pSvrk7UkiS19zyiJjsVx9GIPwxFKX524iabhJBWpRF6/RyTv4WkrTmaBSXThMK8gWiCI6cYiG996/A8qNey09ysQ2RUQyVOFIVIFi2Fte2gTA6TKXjdjIoAvqMdKD1hoHN4ZsKYmjV/t5PKFdUrnik6eE+vmIsuQoYb9SN4crG8tWMw2hXVZbNENbvdrTtyytF+q5n17WLA9Y0eOiEnjH8x93FLy+7QtH+redyquwRUrEJh/IWtGlhPSUrqDwV7x9s7Wd1r8FBvHdezSSlELGLDvQ7gbTQQm8/
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086957",
"to_ids": true,
"type": "malware-sample",
"uuid": "760308a6-0b84-47ca-a101-c0aef32ab87b",
"value": "a3e8ea5e593176f9e66c17f6a200fa665c7ef409c97f49aadf5a55ad6b0be97e|491a38f52692a88f5e97a1107c06a9f5"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086957",
"to_ids": false,
"type": "mime-type",
"uuid": "6f38d584-cf2b-487b-b3b6-1d801cb9386d",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086957",
"to_ids": true,
"type": "ssdeep",
"uuid": "fc5652b7-c97f-44d2-95c3-ea0d9bb95010",
"value": "384:LxNt/IW30i3yiwTJmlglwX74b14gHRN7aW0R1lnNfq:LxLIW3SxglNX749Ilfq"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086958",
"uuid": "5a0ff8c4-9323-474c-8f79-6f56e78b57fc",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086958",
"to_ids": false,
"type": "text",
"uuid": "2bb66bc0-f0d9-4e36-83bd-e94c3d8d4c4a",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086958",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "a8319e65-c040-417b-a3ce-dd94f98432f6",
"value": "518144"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086958",
"to_ids": false,
"type": "float",
"uuid": "5f63af1b-f088-4764-9f5c-589629841285",
"value": "6.8673939918433"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086958",
"to_ids": true,
"type": "md5",
"uuid": "042a7180-b6ac-4bfe-9124-8ab0d494b7e6",
"value": "b969ebdb64c9563cc78851c96faea37e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha1",
"uuid": "9bc7e8eb-615d-437e-a384-017185e4d2bf",
"value": "76a2222080f5240f6e0dfd2ee22898b52e090691"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha256",
"uuid": "8a6915d9-b6d7-422c-af39-e8c29e114c44",
"value": "e3a71e645f99a738e8e70e950baf8b7bad489cc493cfaa839978b5b37d7d6bad"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha512",
"uuid": "b0581489-949b-4f67-b25e-e1b5873248bf",
"value": "25540461f6c90af0a52f721dd400f8de3f20f3f14def0316fbce729b3667ed938ed19e26750310a88f83cb6e70b3ac0b3d92856e88d07a746076e20223266ec9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086958",
"to_ids": true,
"type": "ssdeep",
"uuid": "b7be8cfd-da94-4c71-a8cf-4dec9cec9367",
"value": "6144:jzhRwaGlf2ofbRuNPMxJZWWXR6UVUmxTOdbRnveIks9HRizW9:jzLE3TRuNP8cU0UVUCINWns9QW9"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086958",
"uuid": "a13b139c-8971-44c6-bd15-771d74eef813",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086958",
"to_ids": false,
"type": "text",
"uuid": "31210ba3-957a-4b44-a73f-9160c9b0474e",
"value": ".rdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086958",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "f6703156-86aa-444f-afc3-b2b4ecd362e8",
"value": "24064"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086958",
"to_ids": false,
"type": "float",
"uuid": "356e8777-4b0d-416f-9478-3d8688fa2537",
"value": "4.9150635303897"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086958",
"to_ids": true,
"type": "md5",
"uuid": "71db20aa-3a9d-4576-960f-fe105a1a0ac5",
"value": "1d5a9d5ff3f1175261f317147e4f6dcf"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha1",
"uuid": "5d357cb3-f67b-4a1e-9d96-64be9b0ff213",
"value": "d85c9f849c542258e9966ddf478c84e25263f29f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha256",
"uuid": "744a8d8d-4d81-46a6-ae28-ca989b92319e",
"value": "08196d06dd7a83bda8222f41a1c164ef7d10def145796dbeaee09d1480fa60e5"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha512",
"uuid": "5544fd05-ff9a-4ce4-9f14-d8e7adf6242c",
"value": "1f1c58d0ab7287996ed1ee9ef1895129946c0ed276973eec79ff3fedffb5d889ae53e5ea67f6724211abf8d295247579fb1872a2b3b15d4eb4967bf436270c22"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086958",
"to_ids": true,
"type": "ssdeep",
"uuid": "38764702-7208-4d50-a808-1b1c8ba299d7",
"value": "384:9iuQypdcMUsowNRD9HPmYsKFWFQkIUKbFMfstIcxrX34bLNB1rRpv:hcMrfDD9vmYtd9bmfs2cxrX349Bl/v"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086958",
"uuid": "0c46da1e-551f-4952-b183-0bf6281bae5d",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086958",
"to_ids": false,
"type": "text",
"uuid": "c70a5ce8-342c-46e5-bc6e-a17a18ae09c5",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086958",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "30eb6ddf-28a1-4ec1-9df9-ecedb38533cc",
"value": "2560"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086958",
"to_ids": false,
"type": "float",
"uuid": "d40c15d1-6409-46ce-a9da-56b9e8e9c3d1",
"value": "1.7882408653491"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086958",
"to_ids": true,
"type": "md5",
"uuid": "d5e01126-d732-4063-befc-fba3141da780",
"value": "50efd9b25d8700e42055b6c74636e989"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha1",
"uuid": "ddaf6803-699b-4134-a2ee-68a80f52e7bc",
"value": "09f570be50a16e269e24318b22fe1175ae5c1b4e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha256",
"uuid": "dca8b99e-f2d0-4f52-8446-e78d1c42ad01",
"value": "10c99649385d6358095abcb6202fcfc3caf9a43c06caf9d83fb0365a9d94e3f2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha512",
"uuid": "261c4657-5c86-41bd-a0f2-8ac9238f030a",
"value": "7be428bf41aff729e1172fa04b7025b57fc798e669f69b91079f2b7ad326190d9893d0743a37b4246aab7c1c4c4c8a741fe5f61b424c0af3b29fc2d141cc55d1"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086958",
"to_ids": true,
"type": "ssdeep",
"uuid": "43cfee1c-5623-4e8f-959c-4b207522c6c2",
"value": "12:llTv6LO5SfXMvmNKzuW6LO5SfXMvmNKzuXhB/q0qeUcKgBF51E0anX6Ov66666TN:P6uSkeKv6uSkeK8hBSqCnF66666s"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086958",
"uuid": "c13b7e6b-312e-4ad8-bfcb-0ca5d14c40c4",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086958",
"to_ids": false,
"type": "text",
"uuid": "1e10d498-fd0a-4a86-971e-addc27ab781f",
"value": ".00cfg"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086958",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "903b5655-af31-41d7-96e6-4315a27f6270",
"value": "512"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086958",
"to_ids": false,
"type": "float",
"uuid": "b385082f-686b-4acd-8c4a-51edc4c1eb2f",
"value": "2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086958",
"to_ids": true,
"type": "md5",
"uuid": "001d07cc-f276-474d-ac2b-25043c97e43e",
"value": "c89f7a0f9778f92a5e219125b3610d61"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha1",
"uuid": "96e7b658-0364-421d-a21e-f2ce3e227f47",
"value": "a329b23c1e44534bb0a54715aa5449b9a6ba1273"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha256",
"uuid": "7dbb3330-b267-42ca-a672-fb54f311efb2",
"value": "184d506c38a5a5a9528f8394e7b0ba122b31031884745843b863ea8903d127bf"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086958",
"to_ids": true,
"type": "sha512",
"uuid": "56ed64e5-1ac1-407a-8834-a35752eeb807",
"value": "460a964985c9821b63904a28aca58af8af206acedaa9a6dca4cc563d6581c7d56cebe89bc53384a643e1c8baafdb88aa7c21dcf5b8cfd77dbe7a8e3e79853e56"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086958",
"to_ids": true,
"type": "ssdeep",
"uuid": "8a4aa359-3cae-45e5-8b59-6e25d392f1ae",
"value": "3:Vln:Pn"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086959",
"uuid": "9f405895-ce3c-457d-93a3-572d4c91dff4",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086959",
"to_ids": false,
"type": "text",
"uuid": "7cded3d8-0ab8-46e1-8764-20eb338f9d59",
"value": ".voltbl"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086959",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "c6f40655-319b-4ba8-8fa4-2b92620703f4",
"value": "512"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086959",
"to_ids": false,
"type": "float",
"uuid": "69a94707-2211-45fa-8a67-c2f708ee98c6",
"value": "5.5778529113994"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086959",
"to_ids": true,
"type": "md5",
"uuid": "e3440dff-b714-4528-b914-b665909e35c3",
"value": "40a0cfdc483f27981dc1db763d8e6625"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha1",
"uuid": "7db56222-e4e8-406d-aaba-417c0efaf78e",
"value": "630388842d3a04ede7a9632cd0f5ddedda3b167d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha256",
"uuid": "c53aaffc-756f-4115-946b-906146b3a09c",
"value": "889f9db49e469827c2d037407bbc1b72b3e5f6773d4e7ef14b8957b0a6384e73"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha512",
"uuid": "88c55d4d-2c79-444f-9b29-6205516f7505",
"value": "c68aed826791932e6ed98f33347b42290984b944ff4e0b0aff020d80fbb9c236e0324c66785cd955dcf6a91a46cd0559e674bcec8d782000ec5061764064cb41"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086959",
"to_ids": true,
"type": "ssdeep",
"uuid": "b186f177-d4a9-4698-8ad6-c680587d7644",
"value": "3:ggY/k26fl09zaQxNo9AXL+Eeun:dY/kY9zxx69Lu"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086959",
"uuid": "763f4304-eed1-4c21-956f-2cbcc23e338d",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086959",
"to_ids": false,
"type": "text",
"uuid": "448234de-ee37-4a88-8fa4-447836670495",
"value": ".reloc"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086959",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "b7cd39c0-bcea-44bb-90c9-dcb77639e51d",
"value": "24576"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086959",
"to_ids": false,
"type": "float",
"uuid": "caa71d71-9a19-4082-8c34-cea6f7e53117",
"value": "6.8135056523198"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086959",
"to_ids": true,
"type": "md5",
"uuid": "5b4ed82b-4372-4883-bfb9-4011292520de",
"value": "74844ffef4749a1b7298478eead63864"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha1",
"uuid": "e5726284-022f-4b42-b325-a0ce177db178",
"value": "4ccad7c12baa6c312a69e6c9e42cb875990d8848"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha256",
"uuid": "8a99e0ac-2311-44b9-a2f6-84bbee0f314a",
"value": "e144113e0a4424225dbc5051eea67883a4cec1b40e2a3ec680113b832a7d25c6"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha512",
"uuid": "ee2c951f-2f9d-4203-bbfc-970045bf6270",
"value": "c8dacedb1adf163ecd1ab0cd396bfc9ff392928c31b664cad26003d3aec69b7f938e2517fac873c3318ccec948cba73c64c98514a0be9469c001691089f29437"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086959",
"to_ids": true,
"type": "ssdeep",
"uuid": "9e953b60-3001-4361-bc7a-660e8d093b07",
"value": "384:V8OAwsGu8F13CPM4ACvM4ox8O+CbWriYr9dCHw25zLNqOF7kGXdaNjOdwW5ImiVS:VXoZM49knCtzr9Iw8NqOdkCAN2wWZiVS"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086959",
"uuid": "adca75b8-b784-410d-abd9-4b589bccf3df",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "adca75b8-b784-410d-abd9-4b589bccf3df",
"referenced_uuid": "5a0ff8c4-9323-474c-8f79-6f56e78b57fc",
"relationship_type": "includes",
"timestamp": "1624086959",
"uuid": "bd5bee2f-7375-4237-8de8-8c858249db1b"
},
{
"comment": "Section 1 of PE",
"object_uuid": "adca75b8-b784-410d-abd9-4b589bccf3df",
"referenced_uuid": "a13b139c-8971-44c6-bd15-771d74eef813",
"relationship_type": "includes",
"timestamp": "1624086959",
"uuid": "7187a94d-b1e0-4c63-b987-355ae741ca12"
},
{
"comment": "Section 2 of PE",
"object_uuid": "adca75b8-b784-410d-abd9-4b589bccf3df",
"referenced_uuid": "0c46da1e-551f-4952-b183-0bf6281bae5d",
"relationship_type": "includes",
"timestamp": "1624086959",
"uuid": "7f60d2e8-2da0-4c82-bee6-9e5d625792ca"
},
{
"comment": "Section 3 of PE",
"object_uuid": "adca75b8-b784-410d-abd9-4b589bccf3df",
"referenced_uuid": "c13b7e6b-312e-4ad8-bfcb-0ca5d14c40c4",
"relationship_type": "includes",
"timestamp": "1624086959",
"uuid": "2705a149-5b33-48fa-9b30-ad58919588f6"
},
{
"comment": "Section 4 of PE",
"object_uuid": "adca75b8-b784-410d-abd9-4b589bccf3df",
"referenced_uuid": "9f405895-ce3c-457d-93a3-572d4c91dff4",
"relationship_type": "includes",
"timestamp": "1624086959",
"uuid": "85dfa064-4479-4990-80a3-367acab7d51f"
},
{
"comment": "Section 5 of PE",
"object_uuid": "adca75b8-b784-410d-abd9-4b589bccf3df",
"referenced_uuid": "763f4304-eed1-4c21-956f-2cbcc23e338d",
"relationship_type": "includes",
"timestamp": "1624086959",
"uuid": "089b7693-72c4-4328-b927-f8480242c742"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086959",
"to_ids": false,
"type": "text",
"uuid": "1152cb59-51b9-4862-843f-74969d3fc9cf",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086959",
"to_ids": false,
"type": "text",
"uuid": "4eec3abf-1e76-4c47-b221-3a6fc86e43b4",
"value": "4670116"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086959",
"to_ids": false,
"type": "datetime",
"uuid": "967e3293-26d8-4fe7-ab93-797bd7dd3a88",
"value": "2021-03-29T10:01:18+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086959",
"to_ids": false,
"type": "counter",
"uuid": "d7f955f9-7e07-4893-8dd2-7e2788eb7aa0",
"value": "6"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086959",
"uuid": "8182373a-9d26-4be4-a029-209b05806b3e",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "8182373a-9d26-4be4-a029-209b05806b3e",
"referenced_uuid": "adca75b8-b784-410d-abd9-4b589bccf3df",
"relationship_type": "includes",
"timestamp": "1624086959",
"uuid": "8a7771c8-20c1-4317-b1d1-51c45c1e2f16"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086959",
"to_ids": true,
"type": "filename",
"uuid": "6e9d4235-2adf-4299-b8e2-a9e9bd23b3bb",
"value": "9804787b31e0025dd2ae9344ca1beae2e701cdf8fd77a60f424295dc9280dc89"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086959",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "eed2bd8e-6167-4abb-8afe-f6af2d466ca9",
"value": "577968"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086959",
"to_ids": false,
"type": "float",
"uuid": "2bea8f07-73b4-4c69-a38b-88486eb6e321",
"value": "6.9196749005789"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086959",
"to_ids": true,
"type": "md5",
"uuid": "7ee66397-61e4-4982-b25e-1d4de921c3ba",
"value": "145e3c224e4ecaf26d4638efb9d622a7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha1",
"uuid": "5f41accc-70ef-430c-97cd-389d99040d10",
"value": "70d5b0be6ed51e43c0a19b773cead8793257bbc1"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha256",
"uuid": "4ab553f8-e6ca-4571-ae79-af3a67a58732",
"value": "9804787b31e0025dd2ae9344ca1beae2e701cdf8fd77a60f424295dc9280dc89"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086959",
"to_ids": true,
"type": "sha512",
"uuid": "d9f06a31-962b-4158-a521-2f7bc86a85d2",
"value": "f6a45167238bff44410c528fdeaf417cb6fd5a563bb61fb6febd76a26f427657f4f93175cac25a09784029818190645fb9d40f7ce781329a2eda7ae669f3d822"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAAA601JPolCSRtgDALDRCAAgABwAMTQ1ZTNjMjI0ZTRlY2FmMjZkNDYzOGVmYjlkNjIyYTdVVAkAA6+ZzWCvmc1gdXgLAAEEIQAAAAQhAAAAcP97jXKgm+mIWwDggUtuSnVQouBPw0rdw93/dgk19JbC/+oqgblPoRFgyIXTW707X3KzuvLBfJvAxSxQjdSckQuqIaS9etPTMCRQHbxuHoiK5Whhca3TF2mbwsNUX7rb7ewEKsAZfyqgdJOXQ8ANuEaVUDoKWbSz7c7Vw8IePvKsruSmqUfee0/dGQgTcpPvrEuQ/daBvYCH6aPJJi6VFYyQhWLg27L/4FPnrrfFdbNw4VagBDYFJ9qIoFPv/uh5zMiRXW5MB0So9HcXXwGjb50iG6c5H1U2lqa3Ce5FAaSITWqEOqUrEaeWjkL2GzoewiAaN2d67z5bTPKc5bZNkMWXdt7gmDWw7eTtimNN+s0oonKJypnpVVcHUSd/tgzE0XSURRkT3wHyVLHpk0bGlcNVyw8G7vDLR7RdG4hBT9RSH/bwGUQCzJpxdPp8wSOwLNtxEKu6W0XiRC/7Xm/Nv2RPtipOAQNWw/uZdXnVflN3WMiTPOq84/LAZ8qoxMpivoBRBYpQ2iolecAp2sKo9LfTZQPj4pQSnE7J8hY5bb1oxUYupUQXadMGIKBqyrSCqfzhGJ6bYKFSRy+KGSqbs8GGEDx1dsZdseC8+/pdvYyTmyJBtwNgAy2XsN82XW4UlvXmLeSH9BDIfXMNQmTEr1yIkK81RYgUFhTxI1Eq2w0vX596ziZvOSvI/q9wFFKY+VUvsnHRhjQjmrbugaHjibmjv4+NBsMt2q+6bxsXR0ni4/bRrTjWrzxhe4U5feRMk1KTC43Ug8FgGItf2sJHb4A+d+a2C6+zZcrhWabDDTK+DFU9DDEzTHOJgnnuvBaesV958oeduiYMLcTkcrmvt5RLUjygaWuwKh0zWTmdM4ftH0ooopRdxbnSXABzCiKtd+0t9ajSnaqgdK16AZv4cfa1I0E57IJw10HsNnE4B7jz/n3zR6tHzU1BSpYYBRnwVdgp7AbqWKwJR5bcxs5YiFJciLkOR0V3iKXeGUrlhjmA0c3iEArMx1EXm21XuTamtDJWNlK/swhLLSh2h9DOZ329lVpE2upTBOKB9WM7ILLbEHji7ZmYhvsAwJj+nlOGsPkmxpfpWNm+uykFS2tBbMbUPfW5dLVEocK1sWpEoZz98/m8WU4vjRucDpTv/ffrOkywEuKSqPxuoIT/xQcUzec5yd9C25IVF/QhzVLYykney2UhYFs0hoT7fl4DnQN+tOKp7/mvxt861ueFrK4wiiBBjd+Q3qcLwhb6qGrOGN+XL1LNtrn5Er3KTWqzfoh0cSA6WSsjhrLwa9KqiP8PrKsDqWrCDobzVM8Mil7nZpHBK0YXdmZswhGB5EKIirTZfSoe4UQ3neqO3r7Ai+vsfMN5Q8sEPLRYicmBIehARSqwkGO0Xit4Ubq1EEqQHzoAiYMr0i+IRh+S+/Sp3v8UQofHBc9xbx97El6eNlYYAvknZOC3PPJFbv46HDBGSEm/ssJ7SKWsUlgF5fYwfCtsHUyWLFcI2MOYCOo1MdaYy2CpFWiYi4cgq2FMaNEyQ0XDk0zHeopEGxwWPy+GNpZrV3voA+tBJfifEGq0UEJisGZopWk1nO+Umx4sKyVyrgvDkoKMJrKDbERnHCovqlt/ysSMouTxZqcev9teErY3JBlK5pJzp+Rbq8ej4ddWsG54FRYRXIpSvAGL/OaqAJsizLTahNeDmDOF9z8OjI0Zu+G7Ne/te/k/LVrJSU71+jTindV5g0mbjlh8ex9sDHRk14wEbEobnlrA6oWCtgcNljyV28REVIRMzH1+DRGQ3ky2fpyDmVLBaIhK3Zm4QTwCobXmqfDKtF2auO0RHgNUnsouCzKGAMA5stIK1d6aNRpvthdqOQ4Mg8RY59VkvlcIyPAXRKZWRUjcONqZ/1mh7mFFE/3crdo3SOLUWPy7Jjil/0d14Ep+GNtLOBj01lOnnfzvytCBVzw9w+HDfTin50jxNqA6yHE6o6qTM/77WrrZEwq91CcP1LAhQBCWA/kcr/l3hTv15HxB4oZfDKJ6vF2jAyPssoLTUVFCG4yFZtAL86b/Gii8C4ONUNVCxdlAeBDqOmizbiAN7Pu4/uLjLhEMSZfu33CTlyQn8Ac1MeEhVDp5327OOEGeogH+8algGG2gk/YV56J9yEUL3e7W9oY12xzNmVDcV8/d1AsGaZ9/JVn6lZX+33CTcTSTPuQel3zIEIZCo2V6L3eSSqYOvqIl240BBMd7WeKZIcF8TB7wRrXYalqEuSQK/EtWfCqr0nnO/VO+AkZtAW2T5rh9ArFZgcexryVACnbt9xiiNAUnYkrqm/7ra4UuenY5pDCA0GI/DIA69Gj+6nlTRpNRocJvXTDEFCZgUMxa/EeSBDMUHQpovMggWRmCU7I8vWZC9+iLJRQjrkxMs+sNUXzy4y1fhvf7IiSTQi2WSJbWobfu4ajphyhqoPbre/rlmFSEKmcAZ+HVa6xrV8THs7k4GWJhmwEq7udZAzAZQdmN9KjgYmiQAEnG2e/iCE+HkvhsfIgdCf87yCXkinr0blWvraeNbrwRHuL+o6EPiEPqSH3ipuMCIMQTgxrUDJRiqpkVz4plTN3hRn/MZzhAtTW6Zy382xfe8uN3LmUtaPgNzrIRrwJjRS2pVs4JZsXHev+7EF/+TIi9PNCUGlDvyoopkIuyc0R+eNnYeR8zVOKoaQbONLwz4Gz0buZqP0y6Q+oBWbo+FQfQ9cvi0mWbl6QQ/rV5Udl+f+HaL6lA2uZ2DGYX4SR8yXAjpfPU7VQjBUIs2Us1+8wvsk6J900RiKobWKZXbnwULW5EgSHNtUMMStSIW4Us2iTqi9NExJ03ToyYJ3uXotyoCiQFiDVQspMYcM3aJoYU68WfIfrx5Go7TTPQx/sSI+uwjHMuiwmW8lzzNaxh9rBazDxQcSAP9rzPZKUFwJwZXhesbyaD446bGYFVMYodjD6s2q47MCcuIRxekdxLcX8QjN+CR7yHKzofSiEmKV2IpsErkpevMEnLaQpRCOK/EEGAttG5GIl77LjsgllcG8Bln/TEUvE+DpxRZsZ182ngEHBdJAeqvxRRux6/HqEmKdjaYfxm/YNRjbxM5lbk1UkfNBOF93YOVQPX8majzSwecWIED7yZnZW36O6wk3oWB4hgualxTlR/o7KCYCi3PlFs8EGLXU+jsDk3Es1LkdMhy+BI79DTkfUiWjcm4MrIP3DjCyoKlbiRI4bGQf1lboZok73p+/Q9/QeG9C/gSkwHkYrxs1tg6n42Kc7f8qO+coYb8uewrnA9DBslLOfqKeRhlCBwwbimwKhMd7xSxN+n3IIM0LJjr3l4fuS9LTm6QVmbg9eCHfgY88teXDTZo/Y2x8fLCevD2EgU6J1qRukfhPK/dkmAIeJdHtJYFdiX0+WuTztF9c/v7pIfnva/5EpSIx38W171o1+heDVuNBqbwHvw3GD54DXlzGKr7KGVLqkyuMMfZ2NL70vulIvjhOU8BaRFN2PQdRm8I4ixsh40ktXudoZWc2e50VUJYtG7sG05IJ1fO0wG8W4lhka7CbOqxrhvOCTdOfilZMHWsArx3+7XqvHVhGsbt37KOYg8Q46f4ZvD9+Cf/prK62crW/ZjTpFK9Pz9FTJu/BoLXudGV4O4v9nFah/noDXTdUQk8vcPKHYJ9yLFTgCx1xql7nM4jP1lC4yTdygJg3/rM/LzCODKxKkD3vZ8uY6NAgh01sFZbiSpLr7RyR9rcKtb88O0i2kdgngYe3RqBMxLDGue3qq5MtoAL5FMk3w5ZU9euAsJasSJAHL+UW47G+o+J46qwH/r6dmVQsrbNZL0v8neamjoB27aSF8+Vy9vo/ZlmKX+6eTBhZEJdg3UwRGw0qbfWiTBy1AR/MY6FzFI75LhFnMayxPIk4D//ggCkyBK4KQVUaqdDegqzkqlCNv5HqE1tviSy3dOWQVSX3askaB0h1
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086959",
"to_ids": true,
"type": "malware-sample",
"uuid": "5c160059-1f4b-4704-bb34-b37a27f295d7",
"value": "9804787b31e0025dd2ae9344ca1beae2e701cdf8fd77a60f424295dc9280dc89|145e3c224e4ecaf26d4638efb9d622a7"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086959",
"to_ids": false,
"type": "mime-type",
"uuid": "61307b09-1bee-4100-b1d9-4e2a7a1bf25d",
"value": "PE32 executable (console) Intel 80386, for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086959",
"to_ids": true,
"type": "ssdeep",
"uuid": "6a3b7c4d-6ea0-46ab-9bc7-616932ddd537",
"value": "6144:+zhRwaGlf2ofbRuNPMxJZWWXR6UVUmxTOdbRnveIks9HRizWtlJVv:+zLE3TRuNP8cU0UVUCINWns9QW/JVv"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086960",
"uuid": "695b2e91-223f-48cf-abda-0b224cd0dbe0",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086960",
"to_ids": false,
"type": "text",
"uuid": "b069a73e-39f4-42e2-944d-e607f9286d97",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086960",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "14cd008b-50fa-4832-b73d-cae63ef145af",
"value": "24064"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086960",
"to_ids": false,
"type": "float",
"uuid": "d768b582-c7ce-4e35-9660-60aaf38e325e",
"value": "6.3405794123405"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086960",
"to_ids": true,
"type": "md5",
"uuid": "71fee3ad-da5f-4924-a8fd-e80300055746",
"value": "776e79f0764eff801aae771252c3fa02"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha1",
"uuid": "9fc5077e-7b14-4565-b91e-6fde2ce617e5",
"value": "4024c296618817b9b35df8e78a2e610e3a7e2251"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha256",
"uuid": "bd14bb07-55e9-45ed-ba5f-9fa7772ce014",
"value": "b3a1f978c3c288ba58f7540ab0d596d698eb1a450a57abda3c1cc07e19114407"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha512",
"uuid": "9d0c97ee-d861-47f1-99dc-0f582ec4c9b1",
"value": "a56dcd5211f03861d13d14f04142c262750d3717bf589277ab47e1d496dac3d2cbcb6a6627486a33bde3202ab1d42ede030d736f597a7314ec2d3db82dd79ca0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086960",
"to_ids": true,
"type": "ssdeep",
"uuid": "ecdb08e6-66a5-4af1-b588-1bf6656e82e3",
"value": "384:h21YxntngRRPOQaniVXgMmZku8YcTTO58N1ZQdY2x4qyg+3h:hWetQRPOQaniqkpY0O5w8dBxmTR"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086960",
"uuid": "63384292-3560-4fa2-8a58-2c7f60f64260",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086960",
"to_ids": false,
"type": "text",
"uuid": "cb47e4f1-7e3d-472c-85d1-9360eb4d69f4",
"value": ".rdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086960",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "83641f64-5997-4a0d-a9c6-69ad022f37b2",
"value": "1536"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086960",
"to_ids": false,
"type": "float",
"uuid": "3646fdfb-a79c-419b-91e1-f9b47894e3c4",
"value": "4.5724257089827"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086960",
"to_ids": true,
"type": "md5",
"uuid": "3c83bd12-3123-43e8-bcbb-b03d2a03ccaf",
"value": "23e21b5423c0eb4e7c8dc80651c96527"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha1",
"uuid": "a3651ebb-696d-4832-9b7b-86c9af9421b1",
"value": "a9d589716ca04f76fc41d2441edc5e9effd615c7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha256",
"uuid": "051fd022-7e2b-4abb-9ea3-39d50aa96d85",
"value": "3ab921929a9cf31f030f4bd6bf70921451510d7c7fd99201db4fcca566ad8373"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha512",
"uuid": "10720745-f4a9-4f1d-96fb-95bd7275b845",
"value": "1394f2b35f5e05e957a274f38e4a784f34b822015ebf0af15b7e84689268bf556761e40d91ed2fca15da1084fa9f7f65b0c6f601fa13b8856b7f267c0a5b87fc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086960",
"to_ids": true,
"type": "ssdeep",
"uuid": "b2b8a9d4-b31a-4697-9d68-1f176f2eeb91",
"value": "24:VuYWgpPdowf+p7n3JAlYHj4OoSSWMU1w6QO/OOGrBOdNcSaFDVNyfwfQyxiEiTXS:sYbp5+52lWSWB1w6Q4OOeBqKSaZqsQWL"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086960",
"uuid": "11687ce6-7ff4-4aab-a60b-39ae2517d112",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086960",
"to_ids": false,
"type": "text",
"uuid": "16832906-6dbc-4f70-ad7d-260686e39c19",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086960",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "2ff67ea9-ffd8-4287-a90a-2bf746e95605",
"value": "10240"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086960",
"to_ids": false,
"type": "float",
"uuid": "2b13d034-cd73-46b8-b147-3a5d94422a16",
"value": "0.68903575703687"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086960",
"to_ids": true,
"type": "md5",
"uuid": "9ad05960-be10-4e50-b919-df3ef3c86fbc",
"value": "24aba87b5ee0f8eff228cff35e7fe22e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha1",
"uuid": "38eca73c-14db-46d5-8ae8-7a959b46f455",
"value": "7a44172ef63d69fcd213e024f94b532ceb8855ec"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha256",
"uuid": "3b040581-6b82-41ef-8d10-651a973d7859",
"value": "2df8a31269ff695570b9909bc7537c4c2883e95a6ee89fca7fb2ce90e8c6d559"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha512",
"uuid": "825bdd6d-f930-42c7-85d3-9bec23206aa4",
"value": "599a37e0ff591cb06be7f8f059222c2c2315c8bee65c213347a574228faf8030d1c0692e27f533738a36ec0535d0f575e7637098f8815f00fe41d0192fc2a3f5"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086960",
"to_ids": true,
"type": "ssdeep",
"uuid": "778b5e59-1384-4229-8ee3-ec1d8cf2b900",
"value": "24:25xK9PJtoa+0SC8gTMC0zVk1yu6wnffu6wnfX6/1nSBtN:6K9PJto8SbgQm196w+6wP6/9SPN"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086960",
"uuid": "3b50a303-b6bc-455d-bf36-3ebd14302773",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086960",
"to_ids": false,
"type": "text",
"uuid": "1a209102-e737-42da-ba28-1a7089334445",
"value": "INIT"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086960",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "f30adec8-b753-4660-95ea-7dbb7d458659",
"value": "3072"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086960",
"to_ids": false,
"type": "float",
"uuid": "536d71a1-9a3e-4885-bf31-6730d4e8698c",
"value": "5.6744050867927"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086960",
"to_ids": true,
"type": "md5",
"uuid": "e70e9b37-5e57-4e3c-95d9-da36916dc168",
"value": "5900abb4cd3dcf41ca91b58504b690d6"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha1",
"uuid": "f3b39fad-2ed6-4b40-986d-25cf37f519d0",
"value": "6c02d86e3aa6caf28bf4c17e5e9ddb0113999b78"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha256",
"uuid": "6c8a34ef-4cf5-4787-b69c-ffcab26f253c",
"value": "4a819123fe7f7360495dec76b6fcb73b105bb87c5255df7650b15421b95f45e4"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha512",
"uuid": "a7c19af8-f193-4cc6-aab7-38042ad87965",
"value": "55fcc8138926964081972710e6ad7756dd42639dc25c65e166533c980720cdf489aa62bf6598e3ad871d12c6d5c7e0890c220cf12bb0fec6d010d755b4790679"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086960",
"to_ids": true,
"type": "ssdeep",
"uuid": "ae973a57-b20d-4c45-91ce-6c5ed46043b6",
"value": "48:OM2DYbp5+52l1DYDOjNeYrOENPMgFBBTd98bCMQem7zPaTgcV5iHrXAm/lLWfU:Z28p5+52l1DY6h5PbBBv8bCjTvTAm/lf"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086960",
"uuid": "7e34aa06-bdea-47f4-8831-8df457b51504",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086960",
"to_ids": false,
"type": "text",
"uuid": "ae4de669-f1a1-4588-b696-c33bbb755b3c",
"value": ".reloc"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086960",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "f53702d7-764b-46e6-af2e-f3305fcc59dc",
"value": "2048"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086960",
"to_ids": false,
"type": "float",
"uuid": "b2c77ffa-7957-45fc-8336-8c41a4a08c7b",
"value": "6.678416291454"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086960",
"to_ids": true,
"type": "md5",
"uuid": "55d2ad83-a9b4-48b2-a62f-2c68cc6bcf41",
"value": "5697b274e4aaa5fdec318fcc871f591c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha1",
"uuid": "3d86d61f-5657-4dd8-bc5c-3cea8c8b26b8",
"value": "385859eef08a7554e5988d1c0a71b493c40bfc54"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha256",
"uuid": "5d5863af-c84f-4944-8f00-b13141d72137",
"value": "a35fedda00d2ae53ae9fffaf7307f6307f7c9c91c4bcf51c6973b5391da8c211"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha512",
"uuid": "e5aa9142-94ba-4f46-8c62-ab9acafcc6d3",
"value": "a6594eccefe7cbd618ad9f03662c0cd3ee9fae5460ead576da8b902c6428f8a753132614c816efafc6b4b18805a41d2741760843e160fefae7029d2222eb4a7c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086960",
"to_ids": true,
"type": "ssdeep",
"uuid": "b34ab6e2-7c3e-4ff5-ba51-f697dc46c280",
"value": "24:yjg+3sYgvUduAGpW2VBpYXhzRMClFvlXfFwXyWi11g2q5GjtBe2BLfJyUNmZWdeF:hn8kGXZvFF1ZqkjV5JYTAw"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086960",
"uuid": "3d608d86-3642-4eaf-93b5-f9a2e464d0e3",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "3d608d86-3642-4eaf-93b5-f9a2e464d0e3",
"referenced_uuid": "695b2e91-223f-48cf-abda-0b224cd0dbe0",
"relationship_type": "includes",
"timestamp": "1624086960",
"uuid": "8f2f9907-82a8-495a-87e4-a8a5028fdd1f"
},
{
"comment": "Section 1 of PE",
"object_uuid": "3d608d86-3642-4eaf-93b5-f9a2e464d0e3",
"referenced_uuid": "63384292-3560-4fa2-8a58-2c7f60f64260",
"relationship_type": "includes",
"timestamp": "1624086960",
"uuid": "38c66fe7-7e39-4539-abbc-d2b4847c6c98"
},
{
"comment": "Section 2 of PE",
"object_uuid": "3d608d86-3642-4eaf-93b5-f9a2e464d0e3",
"referenced_uuid": "11687ce6-7ff4-4aab-a60b-39ae2517d112",
"relationship_type": "includes",
"timestamp": "1624086960",
"uuid": "bc74c06d-1b9a-49af-b39d-6d2ef1e994eb"
},
{
"comment": "Section 3 of PE",
"object_uuid": "3d608d86-3642-4eaf-93b5-f9a2e464d0e3",
"referenced_uuid": "3b50a303-b6bc-455d-bf36-3ebd14302773",
"relationship_type": "includes",
"timestamp": "1624086960",
"uuid": "213b4c00-8d6f-4f48-ae20-dc31cc461058"
},
{
"comment": "Section 4 of PE",
"object_uuid": "3d608d86-3642-4eaf-93b5-f9a2e464d0e3",
"referenced_uuid": "7e34aa06-bdea-47f4-8831-8df457b51504",
"relationship_type": "includes",
"timestamp": "1624086960",
"uuid": "bce34984-58b1-4872-8bd7-7588fe09da28"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086960",
"to_ids": false,
"type": "text",
"uuid": "94d57c44-cce5-429c-9a3b-d6d488337991",
"value": "driver"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086960",
"to_ids": false,
"type": "text",
"uuid": "463eeefb-f408-4582-a58f-235e0e198d91",
"value": "4198720"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086960",
"to_ids": false,
"type": "datetime",
"uuid": "fab0db07-563f-4ab0-9358-76a8a03c6390",
"value": "2021-05-15T12:46:21+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086960",
"to_ids": false,
"type": "counter",
"uuid": "a692cc35-2b77-45e3-86a5-37d26e000cab",
"value": "5"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086960",
"uuid": "67c2f5e9-cb76-4e8a-b758-f5b944e1cebf",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "67c2f5e9-cb76-4e8a-b758-f5b944e1cebf",
"referenced_uuid": "3d608d86-3642-4eaf-93b5-f9a2e464d0e3",
"relationship_type": "includes",
"timestamp": "1624086960",
"uuid": "d937acc0-517a-438d-b8d0-03e5de53f3f1"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086960",
"to_ids": true,
"type": "filename",
"uuid": "3b522311-f36c-47df-88f7-54734d46fa99",
"value": "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086960",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "53e95cbe-b4a9-49cf-81e8-c93c8634f96f",
"value": "50560"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086960",
"to_ids": false,
"type": "float",
"uuid": "b573f0aa-b919-42dc-b511-33ea3377403e",
"value": "5.9270454532992"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086960",
"to_ids": true,
"type": "md5",
"uuid": "9b525385-7b7c-4e4f-b586-5faa4119e308",
"value": "0e2d4679f68796e9dd0d663137cb9e12"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha1",
"uuid": "5122187c-fe25-4cdf-bf2a-a7438a0a5fb0",
"value": "7cb3ea53660dbc1b4fe12e0c03c7bfea0a3c92a2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha256",
"uuid": "d19da1b5-ef23-4cef-8708-d6fd8258ac63",
"value": "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086960",
"to_ids": true,
"type": "sha512",
"uuid": "b1adcff2-82e2-41b7-bb1a-079d8411ee39",
"value": "d6d72172408f4eae8dc6d7453f3e1d6878a45eda1fede6417a188f776142b10fa3d3cf5727e66f6decae2dd25bbcc3f1d4fc337ccf039cafcb47b4b704285ca2"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAAA601IGXAkeTVsAAIDFAAAgABwAMGUyZDQ2NzlmNjg3OTZlOWRkMGQ2NjMxMzdjYjllMTJVVAkAA7CZzWCwmc1gdXgLAAEEIQAAAAQhAAAA6gXg6wTh5xW8mRj8wnLfpV3dSca+1FZwHd1MQCmpYN2R7brffGo4qxygKRffBJU1KBGBToMZfa90mEe0ZEebYJDLBSHD3YBXHZZM8TTJhahjCuDzjlU7zBL1ryAz9Rk7oIREaC9bD1jacVgvTYQGOR9g/i93TSLVEoTf5wavliXwvOm8heCPUl1/UiJZM63bwCvc/lySWSVMAMDTQtXg29WpJiE3/0FWvoswIQMLBt5ja+KxUG4eT2mK5hzxcbul13po8rjJyY5c8tLQhzSqpCbtfcErgzu48Jct/l7Tei0Kz19ZMbnw9YuvjWTxqJhPvoavO/2hDLmrmbDbAibD6+s/mlkyPv9iuWssLTnZCD6mQNlmVhn6plinxTD4jB5B0vOE+JNmLnxniwHb+KUYabIfHW8P+L33UhzDzz4S7d66J4xS+Do4dJUjuIKydKO3RzK2wiHfXRJCIZXVsFPcsKeFCvnPatFu8XfC6YML2cW/VRf2x09j+So0L6XY9NlIls4i7dFuxglaAbtD2HGtFYrwgdH0YqiI572VsortpNGfeXc7zfzMExMdae/rbWpYpR/yom9XyB2/pdrAmTHLnzyv6c01E8+YIFsaKDvX9jO1TlGphrQBI6ISXxH93tuDzqzkFKcFpvNls23rp4+Kv9x8K30qDZkoSQTXqmbVKsRDr1+s/2crLtnRp5VrG8pkSbQGqieYx68nprjfLcGCuRNaONa3HkEVppL6A3VnKmHMHyUaCTQjGjRnbJDeJwAwZ1WfIldLS/BA8TbsZGlgekxRqJHT0GQRMC/a1D9FN1DSzWn95q7IS7ecLW4zrpx57w/zc7fZrvI2lBbC0MAp5EWo+nzf/uL2tUB8fnrDUpIx8kqD7a0u0h8IEGmJa33Ua+5lf5QCrAxpfPNdtkHJDnZoNZfnWkVgc/lwsvsZ+8Hso1j8KJSWfg6b+Y3DTWYUA687q4U0MXFQNu6rcCWnzeOsUOu7oH6A0z7mCq62TheZ4OBi4Ye0I0WpbvS01NsWQj5XtsrUFFX+yZBGODZmOw7XKqa+RFaNkDa1TLiOMKJC694bmMIQGtieuilmr4XcPmVJEb8zXWCUi/AfrcGgb6kGa8BA3qxvZ8o1uuXXFzaahsCuajFmXxeSN7A74ikXb5RlDp62X0f8FGQt049wgXoWqS3teEfklZbWyIChINHl+x8injO2pZp1LbYd6A/XqlZ+dsbJiuME3aNXR/aSlZ5LEa+mFFbd+xVoFeZonq2uqwzg1C6JC/lPZ1cdEoW3kt9qqD5kTomHGOQcRbaNVS1iGA8OnQiP7KEK867M7rhsdJEvXhGkOh3IjWTHfCp6Sxrhsl0w2ol9J/5pMUWXAMXP2mgfSG+dTHJglGLD3bOvg5FuoBW7IZBiDoPOgv7JitbgjDQEdtrTKNkyrUBi4QuBE9Z4owHHyNIvsxXUXtsdauzaP+KhrkTWj6qB6iidrkwNGfXmXcCtOXk1LJcw4PsAB4VTYP9PSa9U4tCG0/cC4+k9B86okmQChf7sqSLHBBdw+9F2z6uoiLQadXJ1K6qBLsI2Sg8XBURMjtTlLBvCzj+GD08vvm1IFM8Ygrl/uyRCoXdnkjLt3NrrG6BS+0O9WYy1DOMeqN1pJpPJvzYsES5okQutSYMr7zUyx5fcBRLSBC0y1wlvEd81FEEbGjcUa4qkaDbVAxmPCUMrNgkfaB7TUrNciFb8u52llUbue3gyQaPwkkaF/4dr55dwHnHXdrgiADUnSrqjgyvpw7GO52wf8+P5ilFfJBsj6Lq/MuNKZLChjoBb/ukBq1G6o8v1jD1uHQi4Mx34zGl+BxLLecX5yNH/A3NdYBCM1/zihMCEC7JlgaCMbdkd204QoMrW4ALcuFPFsXvJH3ydy5n8o9VRFv1tmc9yay15h6c1LSo45F6pa3eP8OcBz8VprIf0brreqeQHVc5O5jRoXmB1s5OUAhRYA+8y017yvYmT0c6Dmw0rH9k+GyCGli/AW8whbCGsICHQ9wIl1l1aqihC1xoQEgWQx3kvR/6L+KfLY7dRel9JdEQuNzcv0sHBzmzJNU4+NGYw/MnlkXlWQ/D9TzfURG9UqLlz+CloK/Nk9qBCBQGGwnn9kAniUGNL7yhPMF+bCq8fmBFEPwq1q6hA0yBd6zNoQ2lcjynobg5nMQUIAYhxbOL3GTyuFP34/WKBbkuP9poOqoNG9OkkV/1rpmefLQeAUGt1oQJgMxSHNHuvXgUgAmP5eWqgmmBtDyIM7eiqo6oJMe/Gv6TkGQ227hjdxOJdngnx6EfOfkmXxxtAkpUeHRBOv5aL67lOsCaS5PArv0MkNsum8IE/0StaDue/p8PwhUM0hBz8YdUqLiYq3FFApoE2/lmH2NGQacQlfbcuakWGzjrBEh/2v/JqtvU5y7m7YZ/q3sIdHHtsfoqb8mQ0VAk7Nw3KJYcV/vfNYBE6Qon0F26wxYgPopbLcig9Pnu3BjMmeo4226wQBvUkfLWT6lO+Cwp4g+wUDPtxhShwBEgOBpSQMBSn9xuyBvpilBJ8c36VDBA/2hNXc4iTLGE++WhwsHjJjeqz5ZyxiS7wVh6HWxLQbPJdb43UBYcvTZ0pheu/o+oZNRubAPe58avcqs3Eqm84oaxSoT+Gmv3sUyMLXzPiP+R7Pmlp6kcgET4CtylkH7Z42UaZcCxdPVvT2YFCbyTqW9uD5FZWGI/nyeA0jZ6jMKkVcKiKBu8nccZ7NrtwLn4xzNZR+mFVY4hDoDAGHJQxuCMBRhxTSzK1NaPyFeCvqU2/EnXIvBgvqxV+Z4KSGNy4k2hfaw98CT0HXPtSEV3QctDImB53z3Fb5mQokS9xgBqcG2kYRdiWjZvGIMvPga/eOIMndq9bDqb4vjSE6mZQYMFyPfI0Anf/JAhdwZ4SdGrAKmI1sc/QFI2Ipa8PB97Z1rnVBbF6Aru1lI05jbO6SzN0v+Z7FP0KFXfI60u9ieK/KLhnItTEmLDeSD9ydeae52MnzxlFHuqwPXdgliKlP8d3WJonguGTGbejaecMs4Y1sTtOwU4/rBQ92DIUF+iC7i75ag1SH1m2LVubZwxiDnwGqcoNrJNPu4bOqlfs2PhvXUtE5A0oPWT1YrQd7Ffu8JNVBq923k/MKNEyiknvHcmYSHsxfXHhlEIaJle1JCRDIxy4Ys8FzC/vqrgUG8p2EXtqk/vmQamwldSwuHSt9B4m0I49T2w7Hk6rl/Vx/luzF+nAVHBbDrEAEWSlqyrX5PrdOCsnoSYrRk5atE1hS2FfixpFgkRBOZiCmBlQC6/pKUhPZ3peobVRif1QaiQvC5oO8M12jng+X49Q/p434LB9LqK+08B5/MD5oSUUNcziqFWKaYJl6EpZtRsPDp0xUVQWEhO0EMLXKEmVkVb2MtVryDC/qeJOFkivhslmO6C2W0BHVMEMuy61v42vH1F7pAqWHFc+KX1fcSwxyZx4Ah5CU+4pt7ITxPSkSVaUYHOS5K54c9o9SjXDdx2Y4zf656/zkNM2JHQy8nA9YUqxLn20b8VfaZ/uLVAhaP9fB0X+tzt2Em80wAT2F5xjOj8SVy6cFe2SUKFB4kG6i56bfZjutZO3L1ktFqxqReoRyBYv9CUD9cpUjZtP+yUIfMU7ZvAuGaPLmt5SBCdwSUhysVykrKkDSxpwDI0vgbvGgHyEQIKbXlJIXhns8hip64H1x5HvOzZWzWSPCT/mAFmkAyP1YO8jagqqJ2uuzFkRYAmip1EYm09XVMIW8FQJ3eIxoroYdoUQRK4DPy5YaPTeZ1tiuXdgRZBLVUxQfTLP8H19HbzGAskcusc8nF54YcI1qvl93O4oz3ZcBibfdMG82Ba5EMSNuuB7Q74hKGc4ZuryNjUEr1wDoJE7Valz6pu9g97j0+/3yXYI979fE+tB7cr7neCAu21XaTuiuJYeRH+siepbziMRjE
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086960",
"to_ids": true,
"type": "malware-sample",
"uuid": "0f424d26-663b-4cc1-9b5a-2d4a83f4eebb",
"value": "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870|0e2d4679f68796e9dd0d663137cb9e12"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086960",
"to_ids": false,
"type": "mime-type",
"uuid": "1159404f-58e5-4395-b9c7-a5ecd3a8a756",
"value": "PE32 executable (native) Intel 80386, for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086960",
"to_ids": true,
"type": "ssdeep",
"uuid": "6bac11e5-15db-4e61-9d2f-d38bbf3b2bd4",
"value": "768:2WetQRPOQaniqkpY0O5w8dBxmT9y2/jSPyyihNfVABb/J:2WXOQwi6wEBxmT33U/J"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086961",
"uuid": "a7655859-ee97-4f41-b84e-2e1fcb0205b2",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086961",
"to_ids": false,
"type": "text",
"uuid": "808f5279-22bf-4af9-a194-d51f4de3b082",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086961",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "3b1518a9-e328-4535-b0d7-c266d8ef47f0",
"value": "470016"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086961",
"to_ids": false,
"type": "float",
"uuid": "b9ced296-4885-4566-bc4d-9d559a3f734e",
"value": "6.5436924987407"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086961",
"to_ids": true,
"type": "md5",
"uuid": "f7431fc2-5675-41b6-a31a-03d169ddbd9b",
"value": "fa7c25533908f8ca133a569f4d05ff19"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha1",
"uuid": "97b885f1-7ecc-4273-9af1-b09a0f0cfb60",
"value": "0dd36081fd8d797203a9b66f53fd4156eed45f88"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha256",
"uuid": "0dd1117f-56bf-4744-902f-4330e534e2a8",
"value": "501612dbdb3dc22040a30897a6e00bc7c6971ef5eebe85ee1e26f052ab33d053"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha512",
"uuid": "d027820b-cd9a-4841-a655-7d8d9c7801fc",
"value": "14a433bb50405afbb084b490d9382d662882a1180a253e6bcff07c98e412ada52d80eb4e344e746b757d8467067a4b254357b783cb6ccf57d75f3eb6b788cf12"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086961",
"to_ids": true,
"type": "ssdeep",
"uuid": "385d4c5d-49e8-4678-8c5f-ec0d87c0b0ba",
"value": "12288:43yoMayFrZ6j7CNWYE3EY3yWGnJmF92UO3Jr7v3t306zGo9:b/aUQ3EiEUF92UO3JrxnGY"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086961",
"uuid": "304b08a9-d17b-41b7-803f-9c572aac0bd3",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086961",
"to_ids": false,
"type": "text",
"uuid": "1c6a2f9c-ffa2-4baa-9a5d-fa845e783658",
"value": ".rdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086961",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "9adb059c-e761-4ac3-976a-7bf66b56aeed",
"value": "102912"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086961",
"to_ids": false,
"type": "float",
"uuid": "529273f5-543d-4886-85c7-9c86e2ee5577",
"value": "5.9050219782688"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086961",
"to_ids": true,
"type": "md5",
"uuid": "e4a95cd3-7580-43f5-8c00-e70c91efe6af",
"value": "9ca50d952966036f9014c2eb7c49966e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha1",
"uuid": "fe673c90-c8a3-4a41-9958-53e4faf82c5c",
"value": "dec3c1387042dc4972e4e47ec22f592128b55dfb"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha256",
"uuid": "fe8c1cc6-d747-4bc8-a8b8-48a6f71e205b",
"value": "a113f5722a6e05ab62998e9981026ea0c3e9921c015bb17f16d2e6a5a941be86"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha512",
"uuid": "0dbdf25b-edc4-4119-8e10-f5ddf74bcc49",
"value": "41b61f0ee1a785b4b50dc6bb6d3fb406de79fee78d52cd7f082f536bcec70e2bdb2285b4f9e9fe65a243ce9fbd3c74534b13e7ffb4b80586318f66464ca3dc48"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086961",
"to_ids": true,
"type": "ssdeep",
"uuid": "6e2cab76-605b-412c-ac64-7fa51bdfc84c",
"value": "1536:zbaNtsWhhcdSp94GvDkBBSz8crW4dYrml+IOlnToIfI0tUE7/1t:zb0GACjSwcrVGUsNTBfIEz7/1t"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086961",
"uuid": "2d0875b8-37f8-4c74-a96c-0bab0a77af8b",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086961",
"to_ids": false,
"type": "text",
"uuid": "9a5eb5d2-214f-4175-b616-807b437623fa",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086961",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "9e2770da-f69c-4b1a-80f7-3ffe7a36c5ab",
"value": "3072"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086961",
"to_ids": false,
"type": "float",
"uuid": "1039748f-9c20-4339-b84e-87ed3bf8aafd",
"value": "2.445945983115"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086961",
"to_ids": true,
"type": "md5",
"uuid": "64219115-abd3-445c-a6f2-54ffeacfa715",
"value": "cc5f99a67d584076176fae2f3822a191"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha1",
"uuid": "65b9d621-0ae6-4ca4-a3c0-ecae12c57f08",
"value": "5772e72eec839165cb29caf4b52e83fcbad5124c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha256",
"uuid": "f5c1d832-e7bd-4caa-97e0-03394bec9879",
"value": "a0e0e3344e21336ba23f866bde4aa5b5d994cdc9a5db9441d1ca39a055ba49ee"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha512",
"uuid": "daccf9fd-fb93-4eae-959c-dfdc694d5235",
"value": "a9b1aba1d5914c051f2e8a1331e1cd68a7feccd73c90ac1f62281aa54a7c18bd1b319e3d5ca29739b77275f4a1f62d2f8db96c8a2fab31290fecce3a1cf56866"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086961",
"to_ids": true,
"type": "ssdeep",
"uuid": "93c76331-21ce-4a2c-a27f-43d9330ab0cb",
"value": "24:gCccccq6uSkeKv6uSkeK8hBSqaZVUUey7UrAX/43KKKcmXu:gCccccqTk4TkvkhUnWAK/43KKbmXu"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086961",
"uuid": "62f7447c-fc39-4d03-8172-ec14eaa04460",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086961",
"to_ids": false,
"type": "text",
"uuid": "483b6a43-5878-4f10-a165-b5dfe4ae7139",
"value": ".reloc"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086961",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "92705f82-bc5f-4414-badd-acfa6dbae84e",
"value": "19456"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086961",
"to_ids": false,
"type": "float",
"uuid": "659d8b6d-ccfe-46c8-8a14-eec4fc641635",
"value": "6.6971722413812"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086961",
"to_ids": true,
"type": "md5",
"uuid": "86f23273-10a1-42f7-987c-51964342e3be",
"value": "f84ee5798792da4db33195dde77b6e91"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha1",
"uuid": "050a977c-31b7-486f-a53f-e86cc1e23282",
"value": "6b0669841917fa3b0fa6a62503d6cd3330ab9bd7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha256",
"uuid": "edf4a79d-ebe1-4dc5-a8f6-53131c17942e",
"value": "1723cc719741456e864cf779983360b269e9ca2638ab4e8b95d70f044aef02ca"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086961",
"to_ids": true,
"type": "sha512",
"uuid": "22ec4e14-b368-4e5e-bd59-7a107e5eaf5a",
"value": "70219aafb3e592934811ed93dbb2d78c67f09bd8b2ecb99d2967a18a3b15c25c24101f50c90afa80a5b2b58794ed2a589e0349c6f6c8bee5a3297c60e23dce3a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086961",
"to_ids": true,
"type": "ssdeep",
"uuid": "e8682cb0-a1a1-403f-8c14-7117f83179b5",
"value": "384:zLAv35Bi9RFgKcQvd0ZWA5FtuEYftV/G9astHmKiRw9LFjtbzlN803i:zAPARamd0W40ZftV/G9astH7SkBVl6Oi"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086962",
"uuid": "a9ef8fca-738e-436c-8664-130419d87650",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "a9ef8fca-738e-436c-8664-130419d87650",
"referenced_uuid": "a7655859-ee97-4f41-b84e-2e1fcb0205b2",
"relationship_type": "includes",
"timestamp": "1624086962",
"uuid": "d49c6f93-4b7b-4aec-ba2a-ffd7d8bfe769"
},
{
"comment": "Section 1 of PE",
"object_uuid": "a9ef8fca-738e-436c-8664-130419d87650",
"referenced_uuid": "304b08a9-d17b-41b7-803f-9c572aac0bd3",
"relationship_type": "includes",
"timestamp": "1624086962",
"uuid": "41a56bd9-1e62-4773-8c92-e6a1795173c5"
},
{
"comment": "Section 2 of PE",
"object_uuid": "a9ef8fca-738e-436c-8664-130419d87650",
"referenced_uuid": "2d0875b8-37f8-4c74-a96c-0bab0a77af8b",
"relationship_type": "includes",
"timestamp": "1624086962",
"uuid": "978e9bfc-12dd-4030-8099-18da56266062"
},
{
"comment": "Section 3 of PE",
"object_uuid": "a9ef8fca-738e-436c-8664-130419d87650",
"referenced_uuid": "62f7447c-fc39-4d03-8172-ec14eaa04460",
"relationship_type": "includes",
"timestamp": "1624086962",
"uuid": "30c3414b-a789-4814-b5e9-b133035f5e31"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086961",
"to_ids": false,
"type": "text",
"uuid": "e2edf92b-9210-473b-a18d-488933c75155",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086961",
"to_ids": false,
"type": "text",
"uuid": "0b03c519-9cdb-46fb-83c2-56580f62e470",
"value": "4211558"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086962",
"to_ids": false,
"type": "datetime",
"uuid": "2c3c24a3-f62a-42c7-ba76-d7a20a7c1b42",
"value": "2021-04-06T06:00:16+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086962",
"to_ids": false,
"type": "counter",
"uuid": "c1899eef-1a60-4e84-9ef9-3a168e64a02e",
"value": "4"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086962",
"uuid": "4c53521f-ba6a-4919-a7f5-1a486177bce3",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "4c53521f-ba6a-4919-a7f5-1a486177bce3",
"referenced_uuid": "a9ef8fca-738e-436c-8664-130419d87650",
"relationship_type": "includes",
"timestamp": "1624086962",
"uuid": "6fe93c17-096b-472b-a9de-bbe66f509a2a"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086962",
"to_ids": true,
"type": "filename",
"uuid": "f4b590a7-e589-4939-9542-9da522fcbfbe",
"value": "6c856c3c315c0f213684045da3203692c07c3da5df755155fd8b128fb447c437"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086962",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "dcbfa1da-738e-4134-b05a-d88f7f66cd4f",
"value": "612032"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086962",
"to_ids": false,
"type": "float",
"uuid": "4a53bdd8-4502-48c0-bb9e-7a418765d263",
"value": "6.7224920674499"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086962",
"to_ids": true,
"type": "md5",
"uuid": "fc27af64-77c8-4a79-b719-cc21d434a2b1",
"value": "5bf9f601188a4b11a8baf9b2abbd18fa"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086962",
"to_ids": true,
"type": "sha1",
"uuid": "5f8ce93a-9954-4f70-8dfc-f32123db32e5",
"value": "125ea078bc3cc79b34bec8141391acaf2d69ffe2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086962",
"to_ids": true,
"type": "sha256",
"uuid": "ae7b0387-c019-4f68-8de0-94fbdd1ec0e0",
"value": "6c856c3c315c0f213684045da3203692c07c3da5df755155fd8b128fb447c437"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086962",
"to_ids": true,
"type": "sha512",
"uuid": "c2dc9087-172f-4392-ade0-748b0482f5b0",
"value": "98a53163bf8fa255a82931829e2e79fcc8dd73a0b5adfeec0510a20d2b188c27ecf519131465489a4eb1df46aed6a6289e560c740d4705297b1a08a549cf0c53"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAAE601JzNB1kCx4FAMBWCQAgABwANWJmOWY2MDExODhhNGIxMWE4YmFmOWIyYWJiZDE4ZmFVVAkAA7KZzWCymc1gdXgLAAEEIQAAAAQhAAAAqw3qSYC6VmxazIR5EYMtlCKqnZ4bL6M4j2L+YBtdzcU7gutu7lWlr/Ywz2ywT/peWd4x8VCjfojIo35cu8SUGQaqtbKtBQ/d3t+ni+AZPimMfcQl+nqhenQ712+++RCws7SqJK4aWqWFyqgVEBNjz6owgewV7pEw7rtf9C+DJeRuDtArTj8gn+3Sw0Jvx0py+z7rDf6kZ69wExTsF8zR+XMOMJSUKBNhT+29Rj5lcHRYd09UrS43JCZP31A0mnbPckZ2pkdUz6uvaRWpLObNDchFloR0Ny005mV+NtVhf8xvwUBFpBDcF7l3Nke80eGakVjsGMX+uWLOs9nBoI4hYfHJXoet3d+MreQGudEUaB+qhjkbhCVG1KWjXIYZs6gP/YpMDTCgqmky5PlniK1Z14nvW52fB7qb4Cf66XmC+4koo5B8D1rfP4ren9UHdu60gKNfiFOWa5BrA7H92l0LlAeTJUktn3yQKf7dj8B/hbqrnbkdyTIlDzWP8Ik08wBe9C4zSKHTw29yyvrFXtMAPq15lR1tq/wgVl26DSg3gM8gpZDu5y3A+Ur+upTHf7nJyHN8dK+vbDrphnzvCxUp1DD2gUOi3IGRjTDpWTQstx0tTbkPqhTyLQcTmn7CBvHa6f7jUBc2xSvFEViwrWKz4CIirLjZpJT6OojSnwEtcwQGPBHCTIKfWKhucCbh4aNuPdJ+DlRCRFo1oL67pUhJ/Sa7ibmCR+PIHFKZYO4EQK3PBFmiABGrr4wjRwPybWo1cZqPMIXyVVmjtIA+wNhOW4Sj34nC56tvGleAxQ9gRdmHBHpW+KiPdpdBVGqdyo2dosWJzzzQzh+mSCLqnHpJ29BYv1a+oGB4z0NNzlSryuUyi8HPp6Yf6DvsERqpI5sF5O4tMSYfUuJyanV4idnBNH0R+6ZxTfw2nVTD3PBkrQ1N0p8JuKHf7pdJb9Y+VEkXgWf7GHB9WtpXZqwt2uzsMHB6GP+mFS2zx8mBbuiPDuKsxoPjh0ZQxg2sXbhGxznAkzuX87MiIXHYtR+xQMei0ejvx7jmCKDxg8v0R7pFptaGgNC+6Hom1pfDM2SPGB9Lg8ThtijqiY3FfGm2UizrPHJvjULatE8AIBsRrUi4iR3yf1CIbzmgXMp3O3VXx0S97v8GsWgGVbTiaYgH+6Lsqh9j5NXwJGqUWdh6WbTQQ6kECWJafB372ZGGOBfM1Wolp6lHrZVGretSYyFxCIZ02uPLhnZryiw5NlgqOa+cbUsSsw49EEIcDjhPguz8sBfz+FEL0wYdQxehyjKdgm0mgjWjg0VQgNT0CIdLvS5l/wrDlyp7eLa0NqExDVzexCgkRFMd5vSk+nB1YkwVsh8ubFgFt5BEq/wHl+Dt6VFumaGALRcC4ES1HWug8ktT2/SPBlwbrgNlsIe4g/2zVu4Itaw6gH7Lr4W+XGJ5Z2hj3s08N1zKz7nGGmjKdurErckY4JZOx/Y2X14ZmJYENd0D3uk5NW9abNorkZDQmAu5C0AsrI+38sTa7d0YxE795Pu9mFs9IsYDmtrWjWSgmfX9BZnFSctodyYl+pFhItW+LyEjvtcFCKiLuXAH/Zx68r5Q2+7p1JDHQpwGk0cKhyuphxNFACs3aMPkt8PXAFV751aOqeG3hpGdruS5fU8XyJGefiL0ASt1/2CZur38wj2SmIjy6+2kq1eflfqDpACNKq3S5RF+Piftf+a1DvWUZNxv2nUzmjBkvIIZk/lyLsBp8M3pfy/wVDI5JQOKhzZzYc9K43goUC24+WMasxq0xiuCmpOzh+wrP+HNYGnPDA9fsA1zUcOHRGDDalK1vVP0+CcnWS3tUVwijVQVK8kMLYuqWhIs7z7n4zCa02Z60TkTVLvQ7EwMd7Zg3SlOkLlXffytQBcqk5e82hrCzy9lD1pC9OdAi3nPe7oOf80abD1vbfo2nSBbpX7jShxczNu/kdYV0p9xNOgKhjOZqSzkeSGUAUJhLr0wiClMniquh197h5+yXgnIvu14nKy8MBSSZOfl5myYHAXNzFPCehwqcsOH/t3RcGwUizZsqxA6v3WknEFrrWmPYW+q9LznbuugT8Wo49MFwF92gXmCsoNq71Iqi+IzQ60cUARXfa5WrVysg9tq0Ev12qV388dLdubENzOofohR22Yv7Ggi8cFyWO0RLiwpPRtjps9xFjE59kTCISl3pY0/u4sgD0e335hHc56JyNpWVSH+iw1mjfr0uxk/R0xCI7xNygAcoCecPUPTNcMPEEq/AuRxcXBjzt4tiCBpi4r6FgGnmaBWCDFwhsHH/H8TJa7+l9WbLcZ3FHxptWtfT4dJsh3Ei7WXAl0QjsTqqsTFHx5eSYoW2XzGZkXCmrTrHmXuAPrxgu3AYb1rZmvtGYRDTC0tAUAhKRxYD+J1dKMys0SRZlI9cmIX0mL/bLgl2F9nVGEZgKg1W6roQASIJ+2YH0UZFrfmMd+RFnJXiy2JY6esUenRaIVQhBH4OgQIp5v5tvzajzGXAvQAzVhk2svPOZDAZDUUKO7JyZ5ibdtEpxm3IwgEwY2ey00u3Lu5GMHxYGkWSIKJJZTMIbMdJ3ufHYLGdruYyEu8kFdkgxMXEKeYGEiCIEIMqwwu2S9xxxj35wtWk8AsCv3EpJc18mP2hVcOuB81/Zs55U+ehGg9qT38cgWEFXmFD62HWCSeZJ1tWcqJM66E2XsAXemtmybTLBXJfVUyjHnjtCJRpiIZCR9UNqvdZ90BYozxi5EswlPpBp0IXtSWuVmHqL8r+CpcbsfJQFeo88nSycKRVzSrsC6Oyjr92gTjtoaY1z2G4tOZl3gUy6f7JPWvB9prlHQ42mFLLfCgptip+cUD1tmP5oqGKkBjssrmAsfBmIF65cKUFUNKGqsQi//FhiMzpAYcrrN5aDHp/inUHb4znuiDJJV5wpiEELNh0rzviEumjpKrngJGKucFYIDr+Yk2bnE0GEm0Uk+lqqa14/gEvEEmxn7X9rHg3Dnv78qFSd/NF/7vpaB3oyDCTozr78tHkA0xe99SyS8ExdAIRfWR8KXmdEplF0qV8jc2vIgPqzs0ZkJrOAjx78U2LlSQDXPt+KKRUcqlnXBHEIhlExVeZ0zvRfPgkShW+BSjl1l0Edw1HtlisDRFWu/5P3W5dofHSlb8Tj72OUHfNSxeu9qHo5ElgI7pTktgoss4emjCtM/k0w9Nh/OUme/n0m7cA6VbP9NJhh7LJZou+ppesMDYu86RpeQK+mrGy6QK4lYdvZXQZW2k2rGHfp05fFQVywl80daH1LJa3oQr7YJPSlVvQh/8lBvnizxW0IYWHW1lf/IZ0CkRHrpH6I77O7F7rEN3uYnJn9iduh95Da4Vc3pXnLet3iZpp5g3p25DqmHqVLeNwg+0nUHrq702ucfmN5mmqtfK76AzNKt0IbYb7B2qtWkAvVtdJnGpDHcVA4KLZYbQs/2VlP2p/w+D2qrrL8JKsPHmTPjsJaiFT65ybqGNdDKxRcYMk2ZluqWylxRWEPDn8Q4o5ryXYWkrdtKIvEMBLeeREMP8QWJwt9n8ldfEPC28SF9d272qaeAG6cguO9tlKRYJURB7fw0JTPusir9oLU4pECWMO97CFM8KxKZfGKxEs5Iun+gYH3wM+V5o2E4TRCKVxpHk1lV3NTocnxNzjDb6no4iocWmRYKgN4+gLTrWbJ5EwgV+WjAqqI/WL6esrKInPPRXp4LlouqwZXo8q5TCmpJZyPCjo0FvMCyjpefAl6TV1fLNI/+qM3CizMKX9p+MBXmpmgqRXUtRmhkC9xbD2LL7cCE4L3L0H+O47zmpwgKgqQt3CbkPeHw1XT+jnSObyuRuul5vmhr6bouFyLJh2/px0lq8w3C1TrKvVWKxKQvohwElADyfPCkcVyVR7N+Ykk026qtITkLRAI//iBOhzy2URgwnbHAq4wKpBnvuPQ
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086962",
"to_ids": true,
"type": "malware-sample",
"uuid": "139b82ad-5845-4014-90a5-1b5433675058",
"value": "6c856c3c315c0f213684045da3203692c07c3da5df755155fd8b128fb447c437|5bf9f601188a4b11a8baf9b2abbd18fa"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086962",
"to_ids": false,
"type": "mime-type",
"uuid": "985628e5-c8bb-4b26-b4f9-63ef9a7ae736",
"value": "PE32 executable (console) Intel 80386, for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086962",
"to_ids": true,
"type": "ssdeep",
"uuid": "8b87993a-6116-4674-8c8d-c80c9f637506",
"value": "12288:E3yoMayFrZ6j7CNWYE3EY3yWGnJmF92UO3Jr7v3t306zGo6ANT7oc://aUQ3EiEUF92UO3JrxnGuTUc"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086962",
"uuid": "04314631-c3a6-48e8-bb9b-6d5bd11dabc0",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086962",
"to_ids": false,
"type": "text",
"uuid": "9bef26cd-6816-4709-a67f-a8f7a0d2d766",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086962",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "953a4d03-108c-4510-8552-55bb4748939b",
"value": "7168"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086962",
"to_ids": false,
"type": "float",
"uuid": "caf47a04-d970-4ef9-ad1e-9898030f163d",
"value": "5.0935798215195"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086962",
"to_ids": true,
"type": "md5",
"uuid": "265f49be-7d74-457d-a040-27004fb6ea25",
"value": "57118168edda6878c97381cdd163ffac"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086962",
"to_ids": true,
"type": "sha1",
"uuid": "af07c6d3-5a43-481d-884a-d5305f053c0f",
"value": "9232bb5492e5f8974534f8d2a37ba003f561d70d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086962",
"to_ids": true,
"type": "sha256",
"uuid": "57744c29-9875-433f-9fbf-c708c0b311e9",
"value": "4fad497162606616d236882ae69b6408c6deb777e2a07e6d28232a612f879719"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086962",
"to_ids": true,
"type": "sha512",
"uuid": "09ca3df6-8d55-4cba-811a-caac946696a8",
"value": "f0f6eeade6d50faf9436e6c05b67eb53bb2db64349678761a8ed9d5135a7860ddeb6990f3440946aea5658fcb81bbd5ec225d4d8d0d2e5c511290bd5110eaeaa"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086962",
"to_ids": true,
"type": "ssdeep",
"uuid": "628182b9-3d6c-4aa7-b1d8-4e805869b267",
"value": "96:CvjcT6wXINa9M34/L6/sG/gj2v8NIAY3LgCp39myXOfQVvn8h8m:C06wXINaG3GO/p/gqEQ3UCp3syXOYWX"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086962",
"uuid": "70c9a0a2-55e7-4801-a1eb-38428b7753d0",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086962",
"to_ids": false,
"type": "text",
"uuid": "bd2342ca-082e-4933-8273-8d8d6c639b07",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086962",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "74c89eaf-ba9c-4dc3-9205-083c45e7a7f0",
"value": "2048"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086962",
"to_ids": false,
"type": "float",
"uuid": "598d0a44-8978-4727-a00c-d4b65d34ef2d",
"value": "4.8235535794019"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086962",
"to_ids": true,
"type": "md5",
"uuid": "860e0f06-a82a-4aa0-94a1-31e021ea714d",
"value": "b71e24a232cbf15c55c58f0bbe722b68"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086962",
"to_ids": true,
"type": "sha1",
"uuid": "01013ce6-9dbc-4521-bd0c-a8bf3ac95864",
"value": "5147860b708a336da3f27920a1b729390dc93e06"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086962",
"to_ids": true,
"type": "sha256",
"uuid": "8cb12f07-a471-4b8a-9d95-675163bcb54e",
"value": "9dd20c4ff51c2ea26bc0acb7f8d64de68957b31616dad2ae6225eb204ebbd934"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha512",
"uuid": "77f32174-8ff5-4924-ac8c-9028941870ac",
"value": "8be573ee5247c2167275697fe355042439ac78dac64b228e095d60092ca3e46fc13e094b48d6dd533b8451b819f5b10567b07994f4624ba35e67e46d1686bbd9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086963",
"to_ids": true,
"type": "ssdeep",
"uuid": "59d19c93-976c-4352-8899-3b03f64abe94",
"value": "48:ChoqgiPO4TCO18D8aUqSt9RwkrXkr99dIAMnF9AIaPPTW:6o9iPf/uSpzo99KI7HS"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086963",
"uuid": "4badc42f-32ae-464d-bb86-d335c70e8821",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "4badc42f-32ae-464d-bb86-d335c70e8821",
"referenced_uuid": "04314631-c3a6-48e8-bb9b-6d5bd11dabc0",
"relationship_type": "includes",
"timestamp": "1624086963",
"uuid": "188f9f43-08b9-4ab2-823a-43b6739fd010"
},
{
"comment": "Section 1 of PE",
"object_uuid": "4badc42f-32ae-464d-bb86-d335c70e8821",
"referenced_uuid": "70c9a0a2-55e7-4801-a1eb-38428b7753d0",
"relationship_type": "includes",
"timestamp": "1624086963",
"uuid": "27e8990b-7257-4695-b9d3-2ad6bdaa8950"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086963",
"to_ids": false,
"type": "text",
"uuid": "8e6fe6ba-63cd-4805-bfd3-7e740f89e350",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086963",
"to_ids": false,
"type": "text",
"uuid": "445a28be-ab7a-4571-bd4f-62b59f58a51f",
"value": "4204768"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086963",
"to_ids": false,
"type": "datetime",
"uuid": "adf02abb-d593-4cbd-a9e4-f58bbcc054ae",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086963",
"to_ids": false,
"type": "counter",
"uuid": "67dff4d0-05c5-456b-bad9-90b671bc6cc6",
"value": "2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086963",
"uuid": "110ba31a-bcfb-4b6d-b365-3bea15e6bc6f",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "110ba31a-bcfb-4b6d-b365-3bea15e6bc6f",
"referenced_uuid": "4badc42f-32ae-464d-bb86-d335c70e8821",
"relationship_type": "includes",
"timestamp": "1624086963",
"uuid": "fd12144c-5106-4252-9820-8ef21ec4c531"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086963",
"to_ids": true,
"type": "filename",
"uuid": "54456424-399e-47ba-87d6-40895a2fd2d4",
"value": "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086963",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "e7d37064-1dad-4d0f-83ac-430546791250",
"value": "9728"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086963",
"to_ids": false,
"type": "float",
"uuid": "d0cd1ac8-2f77-42d0-9878-d41ac5329aef",
"value": "5.1217021698625"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086963",
"to_ids": true,
"type": "md5",
"uuid": "910a4197-7e81-42af-81e9-703772e34df8",
"value": "83720e64aa1388d55324a22536bd39cd"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha1",
"uuid": "aef90adc-96bb-4119-acb0-6061e385f704",
"value": "8fa3636a7697f953d7daa02a313981b9e3bc98e4"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha256",
"uuid": "cd6954cc-d69f-418f-9665-b03822b47748",
"value": "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha512",
"uuid": "8039a58a-41df-43da-8c33-3d93d9f434f1",
"value": "0ab402911cdefceb9a6ade0b968b10c628fed6da17097b8cd943f76527078a597425c8d0845bb86f0318ee1967dd3f43aa951f822b79933da475eb1ace70922d"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAAI601I26ojmEBAAAAAmAAAgABwAODM3MjBlNjRhYTEzODhkNTUzMjRhMjI1MzZiZDM5Y2RVVAkAA7OZzWCzmc1gdXgLAAEEIQAAAAQhAAAAX9HwcCzOMjdHOAhXcAX0gER62JlKJoGUJD+YBwXlarXITeL/8GHUt+5JmdFWWIIbW4JYif3D/IStnU1h/tRpNnc8iGHIEG2/I2fGq9a1WrzdkPs4gYJ1Cx4Az3K2zM8zo3AyigKX2eSw0OF6hynm42txpK6FtXf2B5Ybem/ivLRFw9JSMFRbYDG+mlJKhPJuBo6IabQaqMFHA4jJZTp0sVm6mi5OETfJ5fA3Ri6BiTjIthG+OxKFsMmPXQTWcyPqrNRtgLyNAdsEokxEsz4QFa3+w/wAL6Jx0P6Txrv9I5JFc/kEMRcWnvF6i+6Pv2All9+aJ9iNHCYN+315X40m8yy+dfz/kxse9LJg15+JLMwQV2Qi7BkZ7UWtN3X+5spwOwK52ouRDmcpHsTRWrsUee1rMCKik0mGIQUm7jA9cyP+dki8+goOM7Fv+k9WaI9HGzx4tRhWLawQuhLJ3jBK0wQOY/bhwJnUV5AjgYDUU+pwRFFveL0/A/xREydQgWKyy/tyYi76Bq0j6sHFxen6j1TL/hzlzADt2TSveIYzyL4C9m/VAl0N6+y5ldHIPd3R5dEMG/NrPYe6Ai++l3u3Ao7UYGK3E5gv/AWUBU+/PpstTDMAd316SHh0Q6C5UsyjDqwCY+Ix249PbIWRfiI62aWvCq5O0O7hqnKUZVQxZXtZje5yy5UpxSr0t4A+QCY0jsE67Uj9QkSgqsClKAcK0Kjy879sOglLaZ2ZwTRl+hIF150joDZKyIXnVxsdHh6/EqQVajI6RmWwQfqaQKoUoWk+G7Y2f7vfzhOfUih2s1+iygYYhYia0xAIRcwcwVVwZho1as/poosQCpvnp7GTj2oBHx9++31NYoj2U5luk8gmGRsarXHU2ZhNM+Iva0dhqELhurS4fVYMomTL97PUc8zq0JSwLA3xwbVEs4JQmV7OeEr4Bm/Aay851BWEICq+6c1IdeDnhsVVm+oL2YfMjNWsKpdjj8DVAHywdbyDOqsX+6Px/H9XyN9zVOokngck3glhjtnGq35VetVC81EM6oAGvlgpXmUkv5v8VEjyxs8mqTOos049D+4+R8xNvsLLM9X68aGXpjQf4uMJocSPjk+hVQSQyhUXdEtjb8SIiyHZ2XkxuWOBLBKofseqcGV7ihS3JtA/stvQy20ZTqNIXoi6DmMTf4YuapQKpLOGadusACrDrie0COSaeazDnJyl7a23+8osXbS2n7BLFlZwmq1KpaoNigIyH9M/QQTXq4dPYn3Du/4K/vk2oZzdbKPSwQYrgTRNmos00cQVIUQjP8fZBtUF8n8EYuCsNm0q36X6H4jfSGbEfdjb5NQB7+P7/Y1AS5LriHlhySRJf1toKda34vlga41blvwtBjGb3yWkAlG9/fhMASdPYBXiPRvtbaxLT85nwOoWPmFysvsPSp8wN+N4vjxYXq0NHGYMSBDjtopIdPyGwJWkDSVU+rUrDKclzKuHk8AWBg2J/WjdpneP4ZJby5evplsXNbKzqvK2WsnkV/t7xj1E1GuQYfeYYsOKKSnXMa1HWc/+S466D+LCP9mj2syfqqM3q3Y0qCBUdkDjcqI1963NFbRyOcbmvy0JCmLvekQbF9q0si+Q6zLX3zh16Xv5CJpCRHaX+4b5bF2G17cchmk0azfoSNf7MAx4RtHyL2CCbFTfU8liHM2T2aF+ayx3vfMkJ1N+uQ4MdoItIm4fAcdslC1yUPHNr79Dn08LvudTOFMcnhUsR+KopHQtDHvR1RieaOPs5RL27RK+jAn/psZzoIPoEtKsqq6KWZW3FmoTgFtc5LPpVr90yVH0tdwDaqugR/auDDEL6rgu5jB/A+bBNifrf6AY5HmjNwEC+8JjpQYuqzIrrxsu06pK5YFKqv/9fTY4ogIAQeJ1Sv1Hd0SMcI7VGhFwu9jJQ7EKypsU1167I8ZiPCdZfTgslkqt5msIEiHZI7iJEefmPY5xscoxXKCF2wuNdbItWriNyX5x8Lw2XmX78MvsVwT7XyWFznc4kst0c9r710n0aFMw2+o9FfsKLALlWGq3nI9q68FwwF6GkFGfdwoplqhvfiXxqANb9FoY493/vRhAr92IgVj7aMaHk7QlOHvuAQogg3eFCEb4mF24UWRtonCknV9Mbg8CdsnLVbaWYb4KJLBYWyHqiQ8+73OQGLtbpvc9pInIqv+XLUtZz5ndZ5ekOvjR7bpOUZsGRIbzxdAaZsMY4j8IrY3Lgr9LFIJ4uQwTY/pGodsEwjtFK7pzXGeUQeXphSKgjqnjZIGOz6up/iO1ZvdDhaBoXzr+IiDDDCPCSfkPl2LKwB6njuJOwRCLdWATxGXhgmhM5asuoEx6fyE13YtexDi5cDiZM12Bpc/zsSZtXXAzvdNFGcBNBh55KttcEKvK1DY91m8y8CCMtYsOVP5W7p9+ABprvr+Do+Scq5DklxB+rRbmUFuKTR442UOPMlEkSd8CYs3LuOgLxeU2++1AO/O8EiaXpZICbhdn06sa7C7YJY7Ujz9dcvbWqBazm1DzDgW6r1X03YMsjnCLW3FneRzSvod7Ft60mwCzQvjnzumgfIFG5Wd70V8YKBnpa9dTN0kjuu715gKtjCsV2axnjLQvZkZkLLv2otctzQqaEINDhF+EgHlpJUtfeLPSs1xwbK1kWBqWqLhovmx2ABOJIeBCgNCRYboct3CvI2Y7FFAYI5Abwlwlx2Ya/ZykGfclExrD1Y63s/EQ0/egcL6eZ+xyyBd2NbBl1o4sKLntRqYX5zwnp+ugbSVFCcUgEPx9QE3lz6pif2LxXYKOTGj7udTSRYarhJmuyOvoDP5awx/rNa4dyXnFBzS9hYxgPSQlC2foBMDcujhJIxm3E6SE2y7vBuSWogkqYH8eoWAj1dyrJ2zXhFuVXm2OlIeu3eLNmBoxltmbMyc1xj1bEwTUp8XujlY4yDzT3A8AsKEbrQJ4tJuYla8jJwyyD0MF1mXhEgvsKBIuHOO/7kzLtF96IH9Z1LsWsSAn7fsAKYFIPUZLH3CC8zK8rFrjibOox1M+lylP+LF/8uXLFLGJ0mzFgsSibYu8b+fDkrb2ALqr2I3LPv5mDG5f1mqOBktlDgMWV7suJCkSo48KHElkL0TEJ7eVX6IIIs1/+Oc5Qdn4C/999XFV/LHe7xGOkBwMnhal5YgCUbSk2Yqqx7UXyy9ifOtlmKNpp4LkDE3Bbl839m4DUJLXkCzKVOelQpvhV2mWrqWXOv/izi5EzWQctlivJiSDqwpDsWlCzTg1pOuGxPLd+9sTPYUDR1QTA+J5amQs7i8xGmguDbaP485Of3rhA8evNJy0CjWgOrpfMpG8V9xQKkeSMJsvoemZcLkHru3jXEe8odrsS/bPXZTJqbCXVmM+GVobCBieiZ/EGb2VVcnMlLoFlUvgF4bvKAVW/ozh3G3B8Ts3gWM6y3+wnsbnp6BcM1HI+jATjAyXtTGt7uqpEHMLa6NBbLNF6Cz+yLy7qAQxCengc0ku1F9RYIRwboTsfNT945hkcxagOdE/Szs8TnYgX627utbvEY5aA/qf2vds59burCAmP6o4R3NDReDBo86mjdyIzWLDi9rAmZ2e7dBu/oPvsakGSpbpNMRjwnxFDQV040i1xraK7CDTFUkVVfT0eMw44So1b5JRY4PZ8cUb/uZhoqQ6VPpJFhVVRKPPSZVBHEwEP4S0aE1k8N/05++QpAO1/OU0pV5IpfjKshthFWLDL291Nvkah2kTGM/CVAAj21hL20V6UYyN2yexibh7ORG4yd2NldpgBCcpEpP4y099TFS6VyVKMe26Ew6IE/sWZkHNN5Bsfr0DKUjp2O0Ry524b82jP66WsLt2uLdzo3jYEVgHbQHfSQlFWWotFSZb1y0N94DBeLGD/vQuEdhomlwA6WbzxU7pZc++v06OJpw78YKMGWPZEUYBvF1Q5YwkSRwHLh
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086963",
"to_ids": true,
"type": "malware-sample",
"uuid": "91f9b04f-3e82-4546-9de2-d4a0fadb258b",
"value": "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9|83720e64aa1388d55324a22536bd39cd"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086963",
"to_ids": false,
"type": "mime-type",
"uuid": "0c31f178-2c1d-49bd-9ccf-84e2dfb0aa80",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086963",
"to_ids": true,
"type": "ssdeep",
"uuid": "e0a3a5f9-0414-4490-9654-1d1bf5de092a",
"value": "192:V06wXINaG3GO/p/gqEQ3UCp3syXOYWmvmKI7H:VnNt/1gG3Hp3ToUjI7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086963",
"uuid": "d7b4fe9a-b4f7-47fc-980f-a832d5436af0",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086963",
"to_ids": false,
"type": "text",
"uuid": "35ff0bfd-b6c1-487b-87ab-b142b77e177d",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086963",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "3642f81f-06c9-412a-bf2d-c6fedbb58c04",
"value": "26624"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086963",
"to_ids": false,
"type": "float",
"uuid": "6fe58e3a-bc98-448b-bc10-afe2c20ee24f",
"value": "6.3151171440822"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086963",
"to_ids": true,
"type": "md5",
"uuid": "0bc9fd2a-3c11-4eaf-bd9c-fe2d3665cc9c",
"value": "cf0b16eca2aedff96b586a2add8e956e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha1",
"uuid": "0413784f-b90a-47b6-8d3f-4fd23a0bca57",
"value": "6b3099c00646a54d25d96c0d9a3394463394083d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha256",
"uuid": "a5cff96d-ce55-4499-a2ea-8c0d090d6baa",
"value": "e64daa8926bfab138ddbe16a1f84ff4dd67984b06d0d908fecab21f051e7786a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha512",
"uuid": "4b927828-da7c-49dd-bb6b-311b1fe61648",
"value": "f408833fd42da728bd7f89f4e288a4fbe1651cff3a26fa911cd09f845302d678c70037ceb36b3d58dba910d1b93ec602fa0f9ac13ae63936c4332d4c0f89c049"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086963",
"to_ids": true,
"type": "ssdeep",
"uuid": "445c7bba-45df-4a35-86d1-83133ede8de8",
"value": "384:T7ptyfdBgZqCq6pWKksgl2IYdSuC2WigRelS1K8C1x2i7JxhsmuH40m+wMe3ifsY:T1ZqCQKy8IYdfWiUelR36ihR6nmRYsY"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086963",
"uuid": "1567f95b-65c3-4730-bc4d-93bc73d5892d",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086963",
"to_ids": false,
"type": "text",
"uuid": "f92dbb37-647a-4047-ad4b-6c22939029ab",
"value": ".rdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086963",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "8ae0a71a-1e36-43f3-826a-d3f6caaac33a",
"value": "4096"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086963",
"to_ids": false,
"type": "float",
"uuid": "801b8b84-340f-4ab1-b98c-eac2cabd3a97",
"value": "4.5671717525546"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086963",
"to_ids": true,
"type": "md5",
"uuid": "49b3ee44-c48b-46a3-97fc-fce1d414e4db",
"value": "aff5b1cfc5506fa3a5d8804efc11d698"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha1",
"uuid": "ad4c5607-06e3-4ea1-9f94-c9a460d18f3a",
"value": "c46d865af7939046f409156a9f50cacf86a70d94"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha256",
"uuid": "a541e783-1fc5-4f3d-9d55-6d1117252c33",
"value": "822da4186064486ce61c2d4f9840ecc9e962c0317e8faa62460944118a439eee"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha512",
"uuid": "10ca781e-74f0-4434-a1ee-25a6c6115897",
"value": "4ed646b46f415c4d9eb9f15e19be64e8924fa9db941bdfaf5d4452319b099c212145a1c9e211560d03780644070c0c04afe425dac13d037f62d0a2a9c5bcaf14"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086963",
"to_ids": true,
"type": "ssdeep",
"uuid": "abc211f9-0943-4f64-9f62-c695b28e3568",
"value": "48:rwcdILFDTZ8qNEFw6QNOyjKsBAXpQXQcPhhpHP52VosLHMEiLnRVsxO3YU4dTh+s:r4CxefzfZR2SsaROOrOBEM"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086963",
"uuid": "020e7d50-df08-4474-ae41-7f5120f0e7de",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086963",
"to_ids": false,
"type": "text",
"uuid": "102ce2a1-79f2-459e-aca8-4c282221ef29",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086963",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "034b4f4d-1c2f-4ef5-b46c-0224e98a009e",
"value": "10752"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086963",
"to_ids": false,
"type": "float",
"uuid": "c2ccf7a2-99fa-4a6a-9376-845d8e975940",
"value": "0.6671648510441"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086963",
"to_ids": true,
"type": "md5",
"uuid": "4157a669-45a3-4ff0-9d46-ca91d3d1fbb5",
"value": "4c60b1abdf10c563cf887337d224e16e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086963",
"to_ids": true,
"type": "sha1",
"uuid": "fb820d47-8390-4cc7-aaae-1359a2cc1f2d",
"value": "1672fe96a78d97957a10d762a4e4be151feaf820"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha256",
"uuid": "6c6616a7-b663-4b81-902e-f82e439a0601",
"value": "5c0948fdd61baf6a4dbf6dc1b8d2980edcbe81ab47a203e73358432c99607d0e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha512",
"uuid": "523f0b32-18f6-42b5-93e1-24a537c2568d",
"value": "1bc13c7564fc100b3bcb7e0b269d0a0b089810247cafb43800987c0ff4438748f335bb1e6bb5d9e33644c490ddeaae7f3066f55ffb3c3a8eb0de09eed93e9613"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086964",
"to_ids": true,
"type": "ssdeep",
"uuid": "40728d43-984c-4d5b-b2ec-c0773f108031",
"value": "24:W5fI5K9PJtoa+0SC8gTMCkzVk1yu6wnffu6wnfX6/1nS:MmK9PJto8SbgQW196w+6wP6/9S"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086964",
"uuid": "5762f80a-2219-4fa7-b847-5d16c739f152",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086964",
"to_ids": false,
"type": "text",
"uuid": "0d892f5c-3c0e-4399-a5c2-d7b3503389d4",
"value": ".pdata"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086964",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "65b7cda8-b0db-47a1-affa-254b69e646e3",
"value": "2048"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086964",
"to_ids": false,
"type": "float",
"uuid": "db55d821-dada-4280-9e24-989010f0260b",
"value": "4.4171417196239"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086964",
"to_ids": true,
"type": "md5",
"uuid": "1b7df6b3-f97f-4cbf-8c66-9c46d8899c80",
"value": "af11065588ff1be5e27be4cd684508b9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha1",
"uuid": "243ad98c-05b4-43e8-b451-7c35a5a1987e",
"value": "5aca630b4b10132b3933a7919d630b37a2d77e4a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha256",
"uuid": "4b82b047-9d72-4db1-bc79-89f4db20d541",
"value": "20b45bf068739ca996e0b62119b8f06045946193bd1fee9e963eab141b90865d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha512",
"uuid": "b06ed357-6a1b-4a15-9d71-e6ed85b8571f",
"value": "67c859d7e9cc3a0a0dafffdec1e2cc1a3950c32a9655d38520b9670df9a213bf29ce2c00c2e50e3fa24f999cc45c3dc748ca75121244a95a41a8bc447e38d8e0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086964",
"to_ids": true,
"type": "ssdeep",
"uuid": "eb702ec8-13ba-4bff-acf5-15b6a1bd8283",
"value": "24:rLIjwvEE2vBxBtsyzw1o9/PlmOOKbcyIp341BqCLoosPTLiZeS7:PcwCBxfzw12FmGbc+CHlLi77"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086964",
"uuid": "3573f36a-2d32-42d2-bf5f-2d91a580510e",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086964",
"to_ids": false,
"type": "text",
"uuid": "2f9191ac-ca9f-4745-8400-6399dafe9998",
"value": "INIT"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086964",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "c4bd0a97-188c-4e49-8257-180560e20684",
"value": "3584"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086964",
"to_ids": false,
"type": "float",
"uuid": "44bbedb1-ed0e-4ac2-bf97-979da77bd8fa",
"value": "5.1718697425243"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086964",
"to_ids": true,
"type": "md5",
"uuid": "d6922e1d-c35a-44f2-b47f-4ca6f963cdc2",
"value": "bf3aaff8a4f25625c50651a235f234ea"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha1",
"uuid": "af6d4c7c-bc6a-4d1b-866d-92163ffb3a44",
"value": "efa19aba8be359ef3d1671eea2533d40a8ad3574"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha256",
"uuid": "0e74e8ac-63d6-4521-96ea-1ce8dd2a9af5",
"value": "0df32b5ab983d4f13d1f4d350e1a92f66e41350711886943720894025588ea7a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha512",
"uuid": "12cdad28-1e42-43e3-bee7-6a38637c489b",
"value": "b3d5d87dfff44bc6cbf37f4f514c223bff7229ac93342c2754effb6d6b5a91fd01939160e5ef37c5edb66ae94670b7ef9387004102d1aa6aa128a32bd7f31bee"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086964",
"to_ids": true,
"type": "ssdeep",
"uuid": "cfa7891d-cc95-4bf3-bc9e-03c097a238c7",
"value": "48:qjHwcdILFDTZ8qNeDYDOjNe7kBtWt2BpRbD+KCm7MuINTg3nuO4EgdW/lLWfe:qjH4ChDY6A2BXbD1XN2EgdW/lLW2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086964",
"uuid": "eee305b5-1d33-4751-8438-e4e425dce7cd",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086964",
"to_ids": false,
"type": "text",
"uuid": "d91e4256-f293-4c45-a630-518b5d6c4b9d",
"value": ".reloc"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086964",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "b8628b7f-67c5-4fd9-9a7d-aabff5c9ddbe",
"value": "512"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086964",
"to_ids": false,
"type": "float",
"uuid": "244a9eb2-2db8-45a3-af55-4656ed8cb6f2",
"value": "3.6204816846131"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086964",
"to_ids": true,
"type": "md5",
"uuid": "baf359d5-ce30-40c2-8fb4-e1fca5914020",
"value": "fcb8a85ae2d11c0aefad6b5535e1bc90"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha1",
"uuid": "ef2bf816-5eac-4098-8226-9ad372724aa6",
"value": "12c935664a10eea034a86053d7dad2c872d582e7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha256",
"uuid": "6e26172f-5fac-4fa4-8740-b66db865c103",
"value": "199727264dad79db742e501ee665c0adb8a5e08f70158dd23a8780663e330e0e"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha512",
"uuid": "f5de927d-5aa4-482d-8a67-b37ce7365540",
"value": "aa6cd28eb6eb70ef70229126734a359aed53a505608162ee9462c5bbdc9790e4c35336c52f39941988c3f7c9ee8b4c1d53c9e44b241bf2dd75cb827a61777419"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086964",
"to_ids": true,
"type": "ssdeep",
"uuid": "18e0a65a-c0f6-4dd8-b4fe-6536d2e34ba0",
"value": "3:X96q9llvt1CtC4/:0+6tC4/"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086964",
"uuid": "03846d30-1141-4004-9f4c-cce033977a00",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "03846d30-1141-4004-9f4c-cce033977a00",
"referenced_uuid": "d7b4fe9a-b4f7-47fc-980f-a832d5436af0",
"relationship_type": "includes",
"timestamp": "1624086964",
"uuid": "0ffd372b-667d-4ac7-8a9a-be85914197a7"
},
{
"comment": "Section 1 of PE",
"object_uuid": "03846d30-1141-4004-9f4c-cce033977a00",
"referenced_uuid": "1567f95b-65c3-4730-bc4d-93bc73d5892d",
"relationship_type": "includes",
"timestamp": "1624086964",
"uuid": "325821f2-ad05-43ce-b861-0066caab3fd1"
},
{
"comment": "Section 2 of PE",
"object_uuid": "03846d30-1141-4004-9f4c-cce033977a00",
"referenced_uuid": "020e7d50-df08-4474-ae41-7f5120f0e7de",
"relationship_type": "includes",
"timestamp": "1624086964",
"uuid": "924cbe72-3047-4872-8f1f-6c935c902de4"
},
{
"comment": "Section 3 of PE",
"object_uuid": "03846d30-1141-4004-9f4c-cce033977a00",
"referenced_uuid": "5762f80a-2219-4fa7-b847-5d16c739f152",
"relationship_type": "includes",
"timestamp": "1624086964",
"uuid": "14ad588c-473b-428f-8caa-14a9b214cdb6"
},
{
"comment": "Section 4 of PE",
"object_uuid": "03846d30-1141-4004-9f4c-cce033977a00",
"referenced_uuid": "3573f36a-2d32-42d2-bf5f-2d91a580510e",
"relationship_type": "includes",
"timestamp": "1624086964",
"uuid": "9a9e575e-6cb2-4fc0-a6a3-2356c5f20081"
},
{
"comment": "Section 5 of PE",
"object_uuid": "03846d30-1141-4004-9f4c-cce033977a00",
"referenced_uuid": "eee305b5-1d33-4751-8438-e4e425dce7cd",
"relationship_type": "includes",
"timestamp": "1624086964",
"uuid": "da58e340-9c86-44b0-a69d-92c416e1eeb5"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086964",
"to_ids": false,
"type": "text",
"uuid": "9c09d6bf-344d-4db9-add2-87af8c5c9e4a",
"value": "driver"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086964",
"to_ids": false,
"type": "text",
"uuid": "efb5e51d-bed3-447b-bc0c-75eba3228ce2",
"value": "5368713632"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086964",
"to_ids": false,
"type": "datetime",
"uuid": "296caf19-cf2c-4196-995d-f4f624c5fb66",
"value": "2021-05-15T12:17:21+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086964",
"to_ids": false,
"type": "counter",
"uuid": "91fb7479-0cf8-461e-aa95-41803886d266",
"value": "6"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086964",
"uuid": "28b4a43e-ed8b-435a-9e3b-d7fb6b69ebd7",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "28b4a43e-ed8b-435a-9e3b-d7fb6b69ebd7",
"referenced_uuid": "03846d30-1141-4004-9f4c-cce033977a00",
"relationship_type": "includes",
"timestamp": "1624086964",
"uuid": "afa31780-53aa-49a3-9847-0855c0b01776"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086964",
"to_ids": true,
"type": "filename",
"uuid": "6adb1c1e-d828-464e-b38b-0bb65113befd",
"value": "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086964",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "0ddaa2db-2516-4b19-88b3-29d57b37bd8e",
"value": "57248"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086964",
"to_ids": false,
"type": "float",
"uuid": "3ad5cc80-54df-4a5d-9eea-23355953b718",
"value": "5.6510794679565"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086964",
"to_ids": true,
"type": "md5",
"uuid": "efcaf345-b0a9-4868-82e8-fad79b7e7761",
"value": "0bd3b9f55a2d3a13f506d9d8b970e0de"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha1",
"uuid": "0c177111-a2a1-43ce-a972-92bfc909327a",
"value": "f023177aca17f6dc90fdd9588240cb16c70a9fe2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha256",
"uuid": "4be80038-0ace-48f7-996f-425ff956ac7c",
"value": "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086964",
"to_ids": true,
"type": "sha512",
"uuid": "c15c9275-dbd6-4bef-adcb-e40c761a654c",
"value": "3cc2d527725a7c5d5add412b6145a141a3368388d9957864b308886ba6ad376b552ebea6272e4291581eccd0a6bc71bedd9813c28983ddb2f3a31e06e607a8e5"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAAI601LkRGA69GYAAKDfAAAgABwAMGJkM2I5ZjU1YTJkM2ExM2Y1MDZkOWQ4Yjk3MGUwZGVVVAkAA7SZzWC0mc1gdXgLAAEEIQAAAAQhAAAAhw/fm+gd8YK/P32Mgk2irDiJw72w1OZwdspSUb+6I3eH6HYg79820Qn1ELY8ItQ+mTtKfO7GpA0TaCYp0o/6MZ1xvpMdtyx19PXNCFQbD1EjJUQ3tre8fy1TMkn7+RCLka1JVnjUMVEiaIJImHxCONxfIib5p7N9++lxBv0LKuk0P3KziowHVSnSwf1Thcm7X3ZlnVruDpGYHVvTsYDLrw0N4oCbRmTj1G6S7mamovVltuLuR808IK1kG7RxZZufeqQy8sB7xYanAqBuByHFE8nUlimAqMkNVRqjZ9ZRsoDgckuQHk68Q9JchWXH4hGyFqif15ergZG1NNaKZURspGESuR/HBgOwQhBnzQBW6vhEUKI/90vrNLRlIHgU9tiwKCSeoOQ33KdI+toiIQnuIiA3NrKlDImqu7NUX6dMVGChgxWUFyhyLeR2UA4sVzJowvsaLV2kvH0nc8qvsEY/5vIwvh2oAQXP4BuH/KSg+K1ink/e+NHvb0NrL1caYqu3Sx9pZgbwrocsYQjOapSm/WJLrKBaZR9RbI8Ze9s15P+gO6eNVYhHSPgZVsR4KZZDxDB9oVnxyDuO1Yr7bu0nzHzI93P1TM6YwbP78SdbQDu2TjuIptnGb9XS7GYuj6w20ovzpJq501KbA6advysSo8oKiT3a9BRDIunxTxbDp+Zgv5S5NP2V+/p42yop8Siu2pDiHeAYlEIx+DBfz7vUS1Eg4g7ccyet2ob3hmrSkImHYAAd42Br7wlbMd4vv4axPmicODeloThVfQknB38y610qwdIXR0gNfUEDB+99bevaMZ2bU2hjhcS2j8adYE/kGHFXm8e4iULt16Aa37oqFJP6YDK05tULrHrNSPxzXXJcVyYyidFif65e5E+PXkXq9O9CCnb35z+ht/LWuGIM+letj2WCINxD+fTOBzzN0wIuYO4ZW0t8GNxJKwEZJ87GsywiJGH6qlMRdfGFNBxtlGSHmfOIF4DDCf0gCb88bcs2TjhovOvAaQuaMM2rHp9oyG/kHMDKDC3zmnK7GQncFaPl3Xj/12gVdglAMjpzfovhvJ6cWIWhXAy9Wv0Wjhi6pO1yFcqvQ/ODGEcW+LIagmVOURJmef0+n4n8jEivO9nKcMra59iHpJ0CVXl43WSJcSKSNKboZsAT5gjQ+Hlk5AaibyR93ECen4ajScNHkW8ka4is2i9hR/OYcmkVoAZ2nKi5GEzqR3YMeJ9PVoGu08BX8KzpnaB1DInJJsiTVz88dW1xxUgLo2fYFoSkB2yGt7207iqclkyV9ddejGvHLnu8aplePAaRC/gFcbfXPlzstg1B0NpWnV+gOgfOWKvir/PQUed1uSryS9+LTbZzHIweE+OYyDGWSHg3C8vfqZRynKYKCrNuCQ6EyEml8fyr/TLDFXys5cjv+Mv8+f1HeRVcdNU4KwzQh6WSAxjmYBzbCVPoCTeIIsYj+bPwDgvyDoCdz/F/DBvFZyml+BN5KnvLJCo0zIFeWnzsxZPONKlKitQH9SY9EiZPNy+pgDLsXQoS3SdxuOQHCIzOJUnoQ9f0njSR9I54Yu8bvfgk28bkiQdVOeNuEZKB5/QczP4HTD+w76QW8P8H3bkdPl16dWW+oLPw2XSV3d3utI1EZJESXQvq6xBPfJV0o8cDmHPBiytj5cd3LjY9QBHFE6S4su5KA3dfCPNkvGmF3OcfUMjElufO9+YB8hp6CrcHaM76s2uvfGGNVN8izAX3yd+n2qWGhi0eUcKRnnB8lvJnncH3kZnI3yU7B7/q8E3TLqPBBJGOgN9r2H3beGb9mf4LT6QqE7m5blwTxv8THw6zGxtDTpOQmGld3HXLfzP+AiLdae5p+qJqQdkiQiKMsbtRRWno0gmIjVhXzbGuQyJYmMlMXKQXAQQ1zCPFzZyEOgYQfFdMaL9xTOQYAtaRrddgU13qWqTzkOc3/fai6pXGkk/6EVSwdW1pYnSkktV5rSdPYpdjsmoOBrM8DpKAZtVOEGoTpqgI2o4GVA6Sll9mKWZRi87Wx+2UYzZWDCWo6ptJKX1TyQ+eLqX3aTiy6eGZqHX30H21vNttO4RYANC2VD/oN5cg1o3/NU8l4ON5cgpxHDaE3Ry8vVLTgjsB2JvwrVhkAKVJlMD6k0jO/aPR53AfQXVX/ama866yEM7eFUw/tOwAvowJZXaFMb1nLKvo6spa4aFqq652JhRN0uuEtHDX+p5mqti1ZsvCsHDMkwRpdxQ9EalBNGoVXniQ8r5Isl20nq4A+dxdjrECXochXHCPVXBWqnyhcL8j09FW3ZEWOo7t7PxxgoU0DlSJ2Vj+m4iZVNt5PHKEoT/TM+qJlWhBlNPgmS/tZiNTJAnbVpU75Kx68w5oW45/55MIbSW/tE2bjF4L/2CWU3tQ4Y0nwzydtANU4JWLM3y+iyIDxzHkYvXLSWqv8Fw1HemoxSbFxCrCjHuiQ+WOaM/rZyELABAfigD7VDQltu+2TmLnf+mQhwBIBG69zijDFcqZaPcBGpvbb9SmrmGgv3Z3KNvxL/mTe6gkNb6lGWA3cTL319FHE06hN8azejhkgZaSRtqvyrF8M4CAA4vkXRuMJ6c3dIhSIIsP/H1/QMez4Ss7F44p3QZ26MZCjPiv1K9S1UsTFcenCwqW7LQPXklIBgq4/P26jM2cyuR7tp9L0xHSD3+bPdLoEp393eXyMNZ3nimvBaocTLB3W2zQSdDH5LiTrpqzqDxb+YPaG6dbZfetU3L1twmMqWdEWQ2qSbtfaXCrJKl/yeE77MHIhTrSWRLcq2vBGslYrtabvc5bUap5ezdOpgmlt1ZIddLQa5VJaTJn22Kt9cdqt6vkhNbUZVOzA7R7LB4YITDKgZoUGsTvnDkpOMWPVDbYkuPEk274lK4u1b16fug2indyo33c3g80TsurUAgg6u5lR/TSlYsfJacpYxVDr9jvBM1U7wvn83INNz7MEuMMNMmpd5Z4rVnJ5pyML8gB+GitxlNRJwWg30bLtBm/A8klETS3twBG0tYU7IO3d5xCMYqff0ZJrLE6kw6zKi64Br5gPy4+Z1dIV9Ii25lbjnf07JGtamqhx2jP5nX1Ew1QsMddeLfJmKuB5gq+hczwxpv7s80hBOrLQHlfguGY8eB+UMAewo6OAstK0ZUgt6dKqspqAT29fHo4HOs2BFH+q7KGiFI3ZhxPPjrWN5DIq469Cn5kIHDKZg/KCnXOnJngILILGpD9AY2pdAmCsIdPuHJRC/sENrel20oIMZvOff/PyBara15+cMdeP08xNaMvjdmV4qFb8NuKaoYdBhOvZLqoI0F5LNdztCjc46RnnmHzWYkGst7JRYYWqIijsJK93mN1M5xttbRNup/O401VdpAnwkqEZLZbs4AwtD+u7YyYNkGqV/SVD3kMxUTAZPD/VNM1nBfCz/HP8jDkqL+0dwJs43hlNfAx8QaAn5o9SjoUkzYNPEnqKpQSYfYxKyZpdoCP5QuJjZ2wqKTACQ7/zzVigUB5Z7oWjsK8gWnOq9hRMJzU3Wf7+NnYpmeKms7JI+wCRJ+1nzZVThJgUjqdEd8/eY6kGCOUN+4koYf4Vpz7bn1WdCh7lgV+s+UGUGDArKjczqUwgaDkuf9bc9FKLNrWaAECIVGtBsBIbmmovv77cfFTZXnTAjUreQGDp9FasJ0EQaG9JFXYZaq5+Iup5bCQjX2jFo5hZWibyN0EJz48CVsPSE42jpVp3o+P6RDT0FaUPbW8OqGXRNTGlEUbr1QHau5Twa9PRd2pEGo0mb6D+MtE7ZkJ7JHwPgabqhSi1XBiaN6AvpIeDef9m0EKcUp9Nm/tUcq977hUtZ0Ehz7inxu8AYH7TMqb+DWuFWLVzXMNT1hb+VJYfIR26PIzBAD9yBj6s2taHQp0E/9iBHMiUhQ30rhNLF9rK1+uLBhsptYUBsLrN8LBBAc9BOIYuq
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086964",
"to_ids": true,
"type": "malware-sample",
"uuid": "8f6a6c61-364d-4cc1-af96-fe860b632495",
"value": "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0|0bd3b9f55a2d3a13f506d9d8b970e0de"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086964",
"to_ids": false,
"type": "mime-type",
"uuid": "22a368d8-7fbf-44bf-b0ea-436bb95a0e78",
"value": "PE32+ executable (native) x86-64, for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086964",
"to_ids": true,
"type": "ssdeep",
"uuid": "3499f7c8-d36a-45ed-85fc-99187516f736",
"value": "768:o1ZqCQKy8IYdfWiUelR36ihR6nmRYsOSHjS/OPNi7HbB:oNyq+4lRX6IHOSyOVi77"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086965",
"uuid": "81b3754b-947e-4508-abe9-c9485907355d",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086965",
"to_ids": false,
"type": "text",
"uuid": "92a9ebf2-7c9b-4f87-87ff-dbece271679e",
"value": "UPX0"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086965",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "85967f2a-4219-40cb-899e-68f79ff4c6d9",
"value": "0"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086965",
"uuid": "5ac0e594-a97e-459e-822e-a5817e4a7164",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086965",
"to_ids": false,
"type": "text",
"uuid": "3508ff9a-f36d-44d2-8e2f-9243711341b6",
"value": "UPX1"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086965",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "3807a3c3-f83b-4c5f-939c-730b8773963d",
"value": "5120"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086965",
"to_ids": false,
"type": "float",
"uuid": "43e0f8f6-1d39-4cf6-bd3c-06c4bedd0196",
"value": "7.508942901406"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086965",
"to_ids": true,
"type": "md5",
"uuid": "f3d605e7-f655-4ba1-af73-d21385b85ef0",
"value": "ccae6ab3ef57e1a2745c58bf1c5ff494"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha1",
"uuid": "09cfac7d-eefc-4d4e-8756-c1879f78fede",
"value": "3a19ec072786bf350b7561e638bc15b44c095d16"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha256",
"uuid": "89a01a0e-7ad0-4862-bac7-71adab6152b9",
"value": "29141ae55c5d686794d357ff09dc8270f1e734652a561f37cefaebedb283bae1"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha512",
"uuid": "a2c119f8-a106-4be7-a74d-ec003a7cc9ed",
"value": "69550da8fd01abbd719506505797aca6fdf587c4d1b54d864004b4cab1fd436013c8c5358c9075f063e6a77b3e04c4e5f15064e37e5fe6e56eeed57d73f9d24c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086965",
"to_ids": true,
"type": "ssdeep",
"uuid": "1bd6f798-d184-465a-9f04-c233418b43b1",
"value": "96:9nXD23Cm0IShlUrCWHVwsMMej2TQu20p05ZPUcNVG7lEqhZRi2wot6xMvazl:9j3IOUBVIuQue567lvhZTHtdcl"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086965",
"uuid": "4a858930-96b7-495e-9d9c-70ead6e7652c",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086965",
"to_ids": false,
"type": "text",
"uuid": "60a9921d-e030-43c3-a5a0-d63d46c1439f",
"value": "UPX2"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086965",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "496ca0ab-96a6-4f8b-a2c0-7f8a09c3dacc",
"value": "512"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086965",
"to_ids": false,
"type": "float",
"uuid": "e2aee878-48c1-419c-9357-2c9a154eb8f3",
"value": "2.0018429810303"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086965",
"to_ids": true,
"type": "md5",
"uuid": "7f4fc03b-82f1-4cdf-afb4-26ce260bd373",
"value": "6788768dca66f72f50487409a60d2178"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha1",
"uuid": "843a08fa-61b0-44ad-b2cf-9a1bf0a94837",
"value": "f52833e57211e02f15c0ffdbf9b5212fc5e5eebd"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha256",
"uuid": "6b47c0a8-a576-4f9b-bd41-cee87554b0a3",
"value": "6e2d461d20a0b424272beb9d17ae5687b46fea1dbee2b398b5ec0ab6c52097f2"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha512",
"uuid": "b1e6662e-e10e-4232-8beb-b8ac8d34253c",
"value": "d22b7cc251b2527ae69e3fe0ec47b9d637d8390c766abdd2bd7f69cf436c6e5c912dcde530df218bbf01447cfca89fa00880fade34d91af356da37d6d13d24e5"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086965",
"to_ids": true,
"type": "ssdeep",
"uuid": "3b5725c5-638c-4f60-a97b-4987fa39c790",
"value": "3:clf/llVLNjX//Jrs+ctpKklDIth6lizJ1SgzJkJCRJjdlgKaXRRAAHhHt:cHrklGSedloBRAQ"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086965",
"uuid": "fb4648ae-f09b-444c-b713-50e55353621d",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "fb4648ae-f09b-444c-b713-50e55353621d",
"referenced_uuid": "81b3754b-947e-4508-abe9-c9485907355d",
"relationship_type": "includes",
"timestamp": "1624086965",
"uuid": "6d14ea2c-bc3f-4146-80a1-d729b6d94b7e"
},
{
"comment": "Section 1 of PE",
"object_uuid": "fb4648ae-f09b-444c-b713-50e55353621d",
"referenced_uuid": "5ac0e594-a97e-459e-822e-a5817e4a7164",
"relationship_type": "includes",
"timestamp": "1624086965",
"uuid": "98966175-757d-4253-b6ea-51a70805618d"
},
{
"comment": "Section 2 of PE",
"object_uuid": "fb4648ae-f09b-444c-b713-50e55353621d",
"referenced_uuid": "4a858930-96b7-495e-9d9c-70ead6e7652c",
"relationship_type": "includes",
"timestamp": "1624086965",
"uuid": "c97d8a23-9ea2-464e-801b-cd6c96aca314"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086965",
"to_ids": false,
"type": "text",
"uuid": "2fa32c9f-b5a9-4e56-8d55-eda3212f1d3a",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086965",
"to_ids": false,
"type": "text",
"uuid": "b780e69e-a7d4-43a5-89a0-c209f6e81f1a",
"value": "4215296"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086965",
"to_ids": false,
"type": "datetime",
"uuid": "2146b145-dd65-46e3-96c7-3ec61f318ad1",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086965",
"to_ids": false,
"type": "counter",
"uuid": "caedb20a-b678-4281-94f5-905513baacce",
"value": "3"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086965",
"uuid": "7d7df2f7-091a-44b2-a91b-4ea03d806a22",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "7d7df2f7-091a-44b2-a91b-4ea03d806a22",
"referenced_uuid": "fb4648ae-f09b-444c-b713-50e55353621d",
"relationship_type": "includes",
"timestamp": "1624086965",
"uuid": "5df28b00-56c8-4b9b-ab35-6262e3192164"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086965",
"to_ids": true,
"type": "filename",
"uuid": "c912e476-2ca4-4eb9-963c-45b60930e8d8",
"value": "4a229ab274e364df92cc46ecbc9faab32f7b0955dab982658313f2faf9410863"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086965",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "f9bcd179-0bef-4e68-bb4a-2e40a4509dc1",
"value": "6144"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086965",
"to_ids": false,
"type": "float",
"uuid": "088f3f31-4d39-43ff-957c-356abf65b8d5",
"value": "6.975584966292"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086965",
"to_ids": true,
"type": "md5",
"uuid": "410a76c0-76bc-4a2a-af5c-35fe3a71c93d",
"value": "fd969b03b439284ff7a31c39cd336f25"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha1",
"uuid": "95e62cf6-8005-4c8a-aef1-cb89e470195e",
"value": "6a8c00b703a5d6b8c82878628978db9bf282d6ae"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha256",
"uuid": "9627613b-bb2b-422e-8eec-29c1b4a4467d",
"value": "4a229ab274e364df92cc46ecbc9faab32f7b0955dab982658313f2faf9410863"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086965",
"to_ids": true,
"type": "sha512",
"uuid": "03cafed4-daf3-4582-9326-a4d4e9ddb13d",
"value": "3bd433a6488c0284c3a1ab22a8ddfd60f433488e216d6323c9658fd4aff61c5abcc6b728fb13fe218436f60acb2b311cad7cf029abff5f589c143c9193643f90"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAAM601IqvyQKGhQAAAAYAAAgABwAZmQ5NjliMDNiNDM5Mjg0ZmY3YTMxYzM5Y2QzMzZmMjVVVAkAA7WZzWC1mc1gdXgLAAEEIQAAAAQhAAAANQ/n57hQBhP8RHwmoHnLUG3cJJJeMvlkPN+cBFmIlLGfbMWGNTr2EBuyu/14Wk9OPrczCTkLIpvq9K90RKHvE9fYdMRhAJxpAyciIwCvuE0iRzEWOoXJu5nBs1d9WeAfjasXWajJ/vAGYFIR23QcTUNfK02KSqDNE417NXwuzmDRikiNetnrd4uvKAdXLgSXZTcFT/BTwGq+mpIIcxL9MYydiC6LNLIiDDVIK+4+CAr9SQxnm3WsPx2qmpmzJHaKHHxaoMYAxMZ+t7NdjGV2Sxqp+do+FH+AOhvVVZnMC2gKz3U++XeN833vfscpPT9sMtBOlR284RF63yJiu2qvCZfyV5qPhJiFq+8y3Kwog60e3uKDCsZSsM7uous7h9CqLQVTEJnTQcxkvaPvK1SP3Tsc2F7UZ0djAtT4a+yosm7c5FiAcqYPWzMZSGQDhzpXPbGGM4HpPKWEHvmCSx7cPqD189o+sWiiq/MLqbv3aqrz3xfUTzPS+7DzA1jmT3nsBxmGXRyhj76x86u3Evo87rUl3vj3q4Efu5IbNKy0rITQlthtCIu0j7OvTub28SSJS6LrhtED2wQBbIIVHqWVsMtIDMG1RPm3IZdB9a9gLJPbHCw93O658CN8rl4GO/jCDiCQsL3yGVPBJaae81rZf+/sHSI/sQ2o3U3hdMYREOld70wxgWHBDc2YmnY0bESW+fO22x6bOE9bMC3G2KoNQO4DmiQjUHQcn5m7HfM1WJOxs1EkXHm+rnYVKI/QtrGmUM/4/HTmco3P63UfkMaIss5lx+br5S+Te0XxqkuMxTOSASW6/guy5+TGMTt4F6mEVslzos6ZF6Y0aYYPP3owpliUNn/AV1G2yshmH9l3FxUFCLBQwWAuPn9PX01DN2Non7911Nup+0Ntjm1t/s+wXSA6HHjLqvotX0sOKemuNxmYlpsdyhMZxWIolt8f8hbZp+6Ad05Z2C0k1L1eaWAC7ONro6zMfD2eZFSSgjVSMdDkKHD0Gk5qObriirSRneE0ZlUPYEl4/P7+lLsd5AGoJsm3S3r217unsqeW6XA8AEdHjCZznWN4WkNtSelcPi4Lz8MGIhbt7cB9e4z5M5J8t92oTIGW9YX338HQLI5+D21qMzSmHXfKa9xT+vf0cK5tZLeOcCfrFzImMlERRmUZ8wLaSJKu101ZysgnNj4MQslw6R10SrXL4m9wyPELrwDxEk1GFx3uLvbWv4GIW1gxKsqHeS/ItX672SJ+U7dOdbfiL6WgAyQ8oLLoTlZQKkiR4qRHw/M/BUtSmIGMsZL4KRSpnKrT5ZqHOACUZ/6H2D/Pw8tucUUizkD4NPj6UwVx7M3A5QelDvaaZrMNK6NX4AO8eSv/h8uhs0UgW5HlaAZYchK6roIlh1MF2OLLQ4Ztut9kKggKysHPuFWKSr/nFHH3sSnApT02bYRsYJJhh9g9LV8a/kzC1lD4Hc+siwDPuYI7hTbiMljiOEUHISTKQ/VzSehU0tbDF4Y5GFA9YzJqKJUlqAjMkDr/aPIscZJessMG/obKmgdDXTR+KKdda41I/zdLSDgJhy9PVsM0kfPLiamoEpvM0mOI4X06F63659oy2oNCXm9J5UG7NndUpsXPf6Vezb6N1n9lj5VhtONGq4ktGwwB6q/dgYIU/bi9zgv+Lke+PAiT6kzb7Htqll6+/xf0Yi8ieB/OLKFTlr2gVf3a0fwfuxOGeh0w9crKhipxW4ocYj68flyX19t+FBLPU/StNRT9+EWO9ujPTy72DrrinOKcqWnqWo7MiBlLHo2daesfy0IikS9HQav/CrlvUeB/1/Z2BZrciS6CROWMeWal03z8uOgr2DTF/tQfj2Vc1qQMifc1lIzcaIwAaTQP8GsREJV4VELibeXRVpEAER5djnCtWG84Uf98S5KcWdPiTv2c+E7CvMeS1a16ye9BFiQp4UqC69jIZcPzbwTPZj9nC2QpTYKlwVRr7MsWA9kgMXtH/maecvKsqaIaStfn2NUM56F5JR7YjbVQtmEkZTrmmkIpAt0bwQwwvIhj4vG2vwUYTP5SJMJwuYHWv/qEDpTSwD0jPWoF/PEzyfEbAKX+WNvSXJ+HFiTMJWX8QkvONovGmo8Vrwb6gUealKkfrs4O1TSPJlwnOD1NELzEDJkXs7Fp1B/yk/KwBrs+Cvk5rK9iigw+T/krxJhXJfjZi/aDpL01pG+zLMjYQ73+KLCcMuUkcdNVoPKHrz3as2mj8askKM2r4a3X1SI3eKP31f1lU7cu/y7l9QPYqvM9CFsep3mWMLZFSpVfbcjNvuvW9qdQdEh1Sw928OduTOoqAYc/3/CNBrh0sQkuggJccS9me6b+OWouMCtmBhDXT7Qr2BpimyxK+LOU2Wuh5GI3as5cYrKBLEX0WxmgprWGNQN5KhVj5OeTZHqfxB9jMZSnlaINtYRiiJyorSabvLYhu/61NhN7bUp5oeFmKeKZPR9oZnMIbqMpm6hh6bVGZnchJGfCytwKHwwYeT3fHYqh2DRAbxH/171Zo0R9N/JFhCBFF7yJusrOiU9VFb/IfMZ+17160CAZE/Y1pPKCUn1gTguMf5AG/bdcxLVpKRNBCFiero0kZjuS/YeYAnPOHwn9vo+qQrx/iKuW1693/wQXEyY3UKycxwEqK6V/HzpOYkAiORxkOMlPSAcY62E3U9+B9GwTwF1Dg5jQfXvZCLkw2VbG01mMi6IxlrYPlM00B9bU1b9l8nWNHTaEC9xOWDzrPNI8LWAS9Ocu/T2XM5e4tynQDwMbgoPz3XheNm7UyZo64F+ERtV+IKLyAqygGGhC6LpfyvL20/W2DAbZcOzZ7sMIusIbpWWxSWw71PPOvkuGnP4NIcl527h56dspn+1/96f73JEaX77dTHWVDBD4fpbwt36yNp4hxD2ilKNU9Qatmz3X2He341f32+Qnqljn2Durx9K4kvewvXcSvQcnNXQqXtKi/llPB8AJy8bhmdPNDY97nwv4Ckys3yBoDK4YE2yt6mko4/6E8gboaNZrBpA5m3UU+FhyOGUfipTVzgYJfbWUy1lxR2DqyWloCRv2PSvrDdKwzOSX5C5CWCzC94pwxqXEK/gJzKE4Vb30TbUpL+EGIv6i21uCUPPKndIdyZCXmI7YL7dfiVT98JSkIdYaRIo8/1eSf8NnI9Nq5jxClq7fLxh2faYBrmnIvQjX2DZlOjms9H84NzGRP9+/Du8uC2W2mST4/P1IRTFUqixTzwbz3kMbYEGTpXtsEzsMaZf/QLC1uBxKWbD/WYooa8mh30XR1Buz3KI/sJiSOvDrCSr/MWKLOVVxd9+AhKZyTxKJ54BjQ9MBT0VaK55ZnF2JKC+/njKJ/KM7BCyjQdtb38DRxP0JP0nld3mYjzBBr8cVtWFwCjpE/hHoHnrdWOOvtp2LpVs143tRuutOucbNiTBkkmjcBztigP/8QD1XuoKvxpwbprdoTC4Iz8yYijM/fjLrSpCcj9X731Af64G/oNGctBecsOjXliE8avfnDIM3FxjDl9SU48Kz3SSdsEyD10UlGYA/Wykvi2iuSGVooDPpKR0VRLpxtJAZ4PSKKayBdlsbw5HeGFyzoS1tzEApiFQLwzOQkhVfAlPaRTLw86UrTs0s6YrOg6yqnRqdBqMaMbMOws9EY+Dj/OHTCrMtO4d0znAq9PLYlMOe1N0MlwWtVVEPR8TdXak3ffrdv/m0hpW1JmMGcrToMheD/JeAhqR3GUuTI08HnKqKrX8ePhqtP/uLl1aiuAOWGlpRmBSKTrDj/Qw1KcdKSIp5FToSEFjM7U8F+lP4GdjJZ2ncvlT3PJ1G49Egh8iw73kdiB8dA3oz2I1e8ZRepCS/rmAdhevVqDdWOZy3U5Qi3gRbIHBW/SYdCy+ucmcPTpyeb2RYEjNpQ5j48CtKHP/0NPUIAmTLfdwPeywPwCeoKODmNM
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086965",
"to_ids": true,
"type": "malware-sample",
"uuid": "faa8bf74-6e7e-4e19-8cb4-6815c6fe57f9",
"value": "4a229ab274e364df92cc46ecbc9faab32f7b0955dab982658313f2faf9410863|fd969b03b439284ff7a31c39cd336f25"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086965",
"to_ids": false,
"type": "mime-type",
"uuid": "8bd8c5c5-3939-4ed8-8a23-3f09b338e17b",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086965",
"to_ids": true,
"type": "ssdeep",
"uuid": "fa1450fa-eb7e-4fac-a371-fc200cbeac3c",
"value": "96:wlnXD23Cm0IShlUrCWHVwsMMej2TQu20p05ZPUcNVG7lEqhZRi2wot6xMvazls:wlj3IOUBVIuQue567lvhZTHtdcls"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086966",
"uuid": "ac495c0b-7c85-42b5-af1c-5448b40f5987",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086966",
"to_ids": false,
"type": "text",
"uuid": "3bccc07c-d37e-40b9-ad88-dbdbeb205f66",
"value": ".text"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086966",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "804ca645-4510-4127-b7e0-7e34e4adfe74",
"value": "6144"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086966",
"to_ids": false,
"type": "float",
"uuid": "0b9b4cd0-a80c-438c-bae7-bf6e5653e557",
"value": "5.0346994054755"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086966",
"to_ids": true,
"type": "md5",
"uuid": "9d0385b2-9233-4179-aee1-520aac07b53c",
"value": "72a513a5d0b5ad70b8090fbc35439458"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha1",
"uuid": "d38528ae-c086-4f13-a8f0-6ecb5f603eac",
"value": "b18105716636ecd4d852101654fb5c50cf5fb735"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha256",
"uuid": "f7a69422-d7e0-42bd-a58e-e26fecb525dd",
"value": "7f0a3160ecafe114e4ceaf85c001f46297c7dc055541e59f67581b33ef22d726"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha512",
"uuid": "49e38680-fa2d-419a-94d5-b919b77b1616",
"value": "2ca362483345160413a5ec08bf5a94855c392609c97736f954c1b244583a6fb68d59dbe88314afc6c19828d7409e1862dc5648c5fe152d783eb23f06d5d5a715"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086966",
"to_ids": true,
"type": "ssdeep",
"uuid": "adc48678-70db-4b98-9961-ff108afd3559",
"value": "96:IzBcvteJ3ca9M34/L6/sGfQmVpt8AC3L3a/39jQUoLD+rHeUzDBI:IKteJ3caG3GO/pfQmHO3Ti3pHeUzDBI"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a section of a Portable Executable",
"meta-category": "file",
"name": "pe-section",
"template_uuid": "198a17d2-a135-4b25-9a32-5aa4e632014a",
"template_version": "3",
"timestamp": "1624086966",
"uuid": "df11c33f-30d2-4c05-b727-bd223e59296e",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "name",
"timestamp": "1624086966",
"to_ids": false,
"type": "text",
"uuid": "ae73765c-490b-48f8-95e3-63baaa3c8ad3",
"value": ".data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086966",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "9643e6e8-2963-481c-8676-92eea01c5704",
"value": "2048"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086966",
"to_ids": false,
"type": "float",
"uuid": "a8068e29-dde3-4c44-875a-00869748f4e2",
"value": "4.9702676948355"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086966",
"to_ids": true,
"type": "md5",
"uuid": "838b75ed-6959-4109-b49b-716dacbe6e18",
"value": "220bb86509378eb738d76536fd661248"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha1",
"uuid": "6ea699d0-9014-4dd4-90ca-bb0da4349c48",
"value": "0c8558886dc869749a141417d6af55ce6543a712"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha256",
"uuid": "3cca435a-ff8b-45bd-bfd0-67f65bdefc3c",
"value": "8ae6d4330775fb1ca101f8520871f54a0ceded00e6440c08aea069a62b7f4efc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha512",
"uuid": "b8611e3f-10c6-4f72-8547-6112cf367993",
"value": "7a8c0a3b8f3bd12501033d844f1c14d65ffc1a9434bfa32562784f9717f50a27206b56a1fc77c31b1c98bbac341dc992eb171e3e8e9ef790608627bb84e83078"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086966",
"to_ids": true,
"type": "ssdeep",
"uuid": "901ce007-1537-447f-888a-96c18e3755e5",
"value": "48:ChoqgOKvPO4TCO121qgugj9dIAM/47RKW:6o9FvPf/4v9K4RV"
}
]
},
{
"comment": "",
"deleted": false,
"description": "Object describing a Portable Executable",
"meta-category": "file",
"name": "pe",
"template_uuid": "cf7adecc-d4f0-4e88-9d90-f978ee151a07",
"template_version": "5",
"timestamp": "1624086966",
"uuid": "eeb9a762-1710-454d-8d57-178ab5e76839",
"ObjectReference": [
{
"comment": "Section 0 of PE",
"object_uuid": "eeb9a762-1710-454d-8d57-178ab5e76839",
"referenced_uuid": "ac495c0b-7c85-42b5-af1c-5448b40f5987",
"relationship_type": "includes",
"timestamp": "1624086966",
"uuid": "62c535a9-bd85-4fab-bfcb-63ac5262b787"
},
{
"comment": "Section 1 of PE",
"object_uuid": "eeb9a762-1710-454d-8d57-178ab5e76839",
"referenced_uuid": "df11c33f-30d2-4c05-b727-bd223e59296e",
"relationship_type": "includes",
"timestamp": "1624086966",
"uuid": "b18607e6-6e8f-43e1-8f24-cdcc2b682110"
}
],
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1624086966",
"to_ids": false,
"type": "text",
"uuid": "5b4f63ee-a771-4254-8491-c3a20bd9ee56",
"value": "exe"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entrypoint-address",
"timestamp": "1624086966",
"to_ids": false,
"type": "text",
"uuid": "067765bd-a831-4510-bf19-52c68c0c3e5d",
"value": "4204192"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "compilation-timestamp",
"timestamp": "1624086966",
"to_ids": false,
"type": "datetime",
"uuid": "9db9a8af-7815-4f42-a5f5-b63497b5a17f",
"value": "1970-01-01T00:00:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "number-sections",
"timestamp": "1624086966",
"to_ids": false,
"type": "counter",
"uuid": "0de6813a-faa0-4316-abbc-aa1e9640b25e",
"value": "2"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "20",
"timestamp": "1624086966",
"uuid": "a770c83e-0eb5-4442-aa3a-19a38f0f94ad",
"ObjectReference": [
{
"comment": "PE indicators",
"object_uuid": "a770c83e-0eb5-4442-aa3a-19a38f0f94ad",
"referenced_uuid": "eeb9a762-1710-454d-8d57-178ab5e76839",
"relationship_type": "includes",
"timestamp": "1624086966",
"uuid": "751aaf5a-0d5e-4a38-9e3a-4d35675580a9"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1624086966",
"to_ids": true,
"type": "filename",
"uuid": "243ca0da-b008-44a7-bde5-ae2bef9c5095",
"value": "04e88b7717aadc6b56dfa006b9414fc2c899c398d7e003627770e07fed52edfd"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "size-in-bytes",
"timestamp": "1624086966",
"to_ids": false,
"type": "size-in-bytes",
"uuid": "da05bded-c419-4079-8a2d-e4d392d76291",
"value": "8704"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "entropy",
"timestamp": "1624086966",
"to_ids": false,
"type": "float",
"uuid": "4208669d-1511-4181-85ce-21b332a0bb19",
"value": "5.1293773986632"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1624086966",
"to_ids": true,
"type": "md5",
"uuid": "30d894a6-080e-4e2f-a42d-09592427de37",
"value": "8a66ccf9261a0cc08a6ad085d6dd4055"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha1",
"uuid": "ceade737-5bb6-43cd-9664-1a7787ab2a7c",
"value": "8b860c5d34254290769d40d703625f774c213e00"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha256",
"uuid": "6c175551-366a-4f54-9e2d-4d8dc1b9fa0a",
"value": "04e88b7717aadc6b56dfa006b9414fc2c899c398d7e003627770e07fed52edfd"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha512",
"timestamp": "1624086966",
"to_ids": true,
"type": "sha512",
"uuid": "51956901-ccd8-4f55-9a18-415057bcce6c",
"value": "079f55f2633f86640351a658067cb8b08b308a1997a2e6698d18d61b16b715ac55f721ea0bd8dce61ac0ebc4513eb32b0a989aab258abcb818897b6c0e78c464"
},
{
"category": "Payload delivery",
"comment": "",
"data": "UEsDBBQACQAIAAM601J1Nsa0dg4AAAAiAAAgABwAOGE2NmNjZjkyNjFhMGNjMDhhNmFkMDg1ZDZkZDQwNTVVVAkAA7aZzWC2mc1gdXgLAAEEIQAAAAQhAAAA+1nYmKMC/XoEJQvEbKRwp31y5byv+In3FIG+WduswJkd+nmLKcilvzcIsmJpH4B5gg4B0cV5kp6KRn4R+ERAp5XIhPKtGP+8tRLOGJUg6q3Td+OB78SFPFjhXFRvN1hW2qHG0eLidLZdcGXcKRDuSahZ/TVwX0HJSKvtQiSEUTuoZ3nrv2fT/rCPajJsPymR4aVfbp/hLqIGcIH3stKZr/G64BMAHLxHedhQYNlPM5zJuY/adAaWVGhK7a0VbVDvIaWSQETyNIlYIqzt8fCVrUscnrqyHtT8UboaG7HRSy+zVgzsFb5M65mZ/lBqU2ROPxAffjQ/ThAlplG8Qy+J2EQB3BgRAb4PljAdxYO1NySltLXPtcxKZaq0joaDE65mq3rppMx6MmgeYyjidWxPr+apeXiNSs7Ie6dbeaxnHLi7BMUSDMpggP1sqqAQsLgrtqzRGmGRfY8c4e8TqKWo+HmCeOlbKXrhMfuiEDlDnHFEtGCT15lzRbDg3p4mcekWGsb3Hb5RbeH/viEMGURM+saFw6KDQJj0UHKkBVwnBkNz74WpilZB5c5d6B+R5voIKvdHAIc4unFabgw5DoOwvv7mtSOoEMyT7WsbxBhXgWfNuIPr6rFiJck0KDzprbPg9qHCT5Cotm5cVrwcPMZHz2KSGb+QLHg55WeO/VZCyg0I+NV/KwNjT42tgvWheU08pQE41ImOaZRSZI96m40Ujymg5veudahJi9M/C7Jq3+nXwscOQUcktSkm6X/yBFAjmlYxKNFzc0r8HByH6g6dMestzbhkSzgYAPQrAWlg1QKK7Vkyn9JKVQkeEvUyXwy00WOaiBBmkDeTFkRP9XQZQmiiFwTR5NZqZRk81wMdXQ7k4zBABRysLRCwXm9ddnoYFbievXejVCfSo1PGfiFLEWWrNN1nQaHRWI9QYgQ8PLWwIo5RQy61rLIDsJYo7of+HCvrBttsvpLLL2v2OtT5uPC0kYk7xDkfU5anbrZw7vhAMhnzOxwRLLEj8/0p52mhQEWi3+LcRN3kX0dXSpIzHjHJzdc3WdMkqsfbCaWOV4o3yJKDi4q9ADajxci/53H+fbqQr0uKcOSNdluYVFglDA+mi5MmfzmHeLOOV9K0gNA74+uL0RnASDh+cMTRA18jpth/XbfNFjQCcwJyL21PCs14rKXafvm2BfYylF5LSf97RD31Jm/HKbajs+sHORvHhz1NWCYgD/F2eK0PmlpUFKvLO4HJmU5GxSTnDUVM5cNUeUHcz28aVflZ9cr1jNCbmgzwBEqQXt9yTCpImAH9w+UbOP7wmv5I35QMhn5rW6Aki5rM+oPYsr/mwSemmytVS07M5iY3skthUumNG8ZVoDbpaurRzx7lX8vFuGbpUaLLa3HGwW75/2oj9SRfeZimXbvBmYqBJqJCI7V1I+sDFgSbTpNNVEUgewAoquXWbJxoj2KFton/c5Vny8+ys9aMGuQpzu+iz/26omtBOKqKWPKt1VYzPAgjEB8ns0wU4db6ei7atIM7IdC/56lXHdqmD5pdKMRagztCe+HZ4FzY7W/S2i37XhEs7GjX1W7X55nchhinE2xoE0NJmIX0yy1G8eOLbTUUwBMiIfH77EsJex1N9sOdn6kZ3AY8M3uFAl+vX25JDGTQa8cka3qNi+nAOALEi4Bal7bW4n6k6KV7uhvePgXsMI3Bp1OPd9mx394PBa/3lIUvo5eQqJt+WW4Avv9Ncax+3SOMMpVV4aLbM86cpDMT1NPP43377gpXa/iGVA8JugiiGYQ6Lup1SJRnorBtQKhdwttq/Pj+PJJ4RhSqgG12Ok60jGgFiineWBgj0hcTD+GGbnIye6msBsYcy+JJrp8UrEw6AEYN2CHhFMsfyIGcEsaobtnBPD6vuRJKQwUtf0n0T6YL5V3tGdx77TBLcOsBaBeESfWPktvihCt5wwiimb4aQu1m4i3N3iZXFRlLaTlQz+fE5MomCEiH1kVRH74ehVML9PGd/bjiTbLPvno223BC39G+Aks7giPBWsvf0EyAlUPVLv9n6Gwws59qlISf27PpKhZSG2qOgg3kwSuZUxTrClVkMwUG3D254/kuI9FAMfaAjWLRnf8cO3M9oihi4MojBfWIM/kJZFWM98PH1/PQww5+OyeUVpvIZvTZMcgDHraV1aPPfACfHvDmnzbWAz6hvidXptXefzgfiPe4smx6F1IT4f7GW8q71NENo2v73uU+2FtWJJk6TczWRUR8aR2VQYQT1r5HKopd5Qp+H01cv95Yztt4hl/ML3iHtzcBY7gouR75L0q12YAGLsanxaLaGLEaUYFcrbOSSg2ELek7x5/AOJ+cbuCF5gB0etRLoMSkvJLTuYMhCFpMX60m9CuvUZMBCLLChPKVvdpAi5aeFo/5fADq+gia4PO/UB71EwOVVDdNw2xJ5bNoaTGKizFUTLJsGesmyRBvmVg6qHN9GPVjmzFuPJ478svfSbV4KgASkJozwbcY2CotQqEqo8IqEOtTSwLfowVW8x6T1d7OeRO/24kFIrEXMX3N/0W6rTGT96bQvp5c5Y7xVIy7ssuLQbLL9vyDjBb5Nfjjdeib3Mz2FSbOvhKVzwqxQgDJa719iyRlYWxHZxd9nF3Kyx95w6OqsA0XAaeiC6WDFCVhnzIRdEGBOcqmSh6vx1RJgYZT6Dh/vkkF0IewJwUhnPYKEUuan4WnGj9EYStUzXiYEr82yU0HJnVpFI0XBc/RKFG4lItlwW2WyDsDogJRNfl/ycbEEuUc7+hwxQXxNn9ofmHxCWc6a5k1DPq16U8eTdbXErH0okVARoLCLPRVimcR26tSXy/2G2JtXMV0ZRHgzlPYvxdE5BbS20UO8q/x+J3422mCgAGxDGuVdxYRfC05Mjr6AQHMKYs1P6mRPMUUrioAucneKTx69KTtSyXx4Wa1UAYcKvMQQlC73S6pyWK4gP9gYZz535kfGyISWiL2rc/OYnjKlqGSx2v7WJu2F5E6fihWv/CzVNb1CUcRjoe0V6NC19qXotkS5h6EMFS+Z7SIiFgM515WwCIHNIYeSFCCYZsBnGmb4RfGFYXYG6uJeDsOq8aA9IfGrqCyQRU0F53Ibg4i2JhRs0+J28Rp5OOGUixnaen0hnm1rbhapfYX+zuQEjt0h6FcbVT1550RRyQvES53O/A4+zfLCz/lJrqsgQ2m2FxmrZgDTNhnBUJ/MEknwdmop38M64Sr3u+74zzZJwjk510A9e9YhpKC7nagpE0bT28hOZP/g175ewD4Q51cpvs3lfEU7RPZOGax/YilNWH4/SvEgjNc/ZArQSYXFa2OB0RNSc4lCiXbr/H+0IOILQdkVUB2+aZpUB1qbdwGKmR7cf23JkDWvPj+7RGQEHwK/SgdzJJ+IEw3PQWS/2jvxmM2HLGvO7QlATw3h7JA1e8/VVgH3PdWCQ+UVjF5WOufqUeiw4mCM6ZGoW3aBUBDmpX/s4uBhOGrqPiMAJ20BsyvuIiNbVfbUHrosMr5+nrSrzSfqtp+qLf+r/AQm215chOtkrNuTbtwe0CIFPDDfAVBsjC7gbfVcnNEcUC0ZC9aNTWeKCoN6Jd6XBRnn74M/f3pGrs4zuD+lA3dz6D9/ciB5jQBksj1S7f/GdXiBlA04dokBdJZlbmYHvXhqxY4zwhwzAnKgPrnBwfFybbw+8zMPmhgjnzPhtXwFQG2XT7DU19KDC/kBtf87X6RlBA9+kv7Mhmdq5QTeud/0a/sC5gop19afWB9K7XoU5/DI4VFdc6J+pDPS9JAAzI9bDnkQRpZsuUm9okPDKrWf4GPeXft53UQPonM0CzgCxAEu43T9MtbNxeItbaftwoWpb9itqKxY75rA3LJJuA2ET06/kHST1/73OrDVBTimAjupSDVrcIQqLIoAtIivQ/PIKHmJYvGAtBIo8UOyGeUnuAZjD8A8Uze0IU6Kw
"deleted": false,
"disable_correlation": false,
"object_relation": "malware-sample",
"timestamp": "1624086966",
"to_ids": true,
"type": "malware-sample",
"uuid": "1c9ebf03-6e0a-41bc-ab16-8462bbbcdee3",
"value": "04e88b7717aadc6b56dfa006b9414fc2c899c398d7e003627770e07fed52edfd|8a66ccf9261a0cc08a6ad085d6dd4055"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "mimetype",
"timestamp": "1624086966",
"to_ids": false,
"type": "mime-type",
"uuid": "cb989d79-5a9f-4d04-a8bd-fdaf95a66c68",
"value": "PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1624086966",
"to_ids": true,
"type": "ssdeep",
"uuid": "97e7450a-012d-4fc9-8882-39be7b60a658",
"value": "192:9KteJ3caG3GO/pfQmHO3Ti3pHeUzDB+vWK4:9vcNt/RQWO3Ti3p+UzDQr4"
}
]
},
{
"comment": "",
"deleted": false,
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
"meta-category": "network",
"name": "url",
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
"template_version": "9",
"timestamp": "1624087316",
"uuid": "468c9831-66c2-465b-8e97-aa2cfae5ca25",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "url",
"timestamp": "1624087316",
"to_ids": true,
"type": "url",
"uuid": "17d09016-55fa-45b2-866e-aea2fa3bf2f4",
"value": "http://110.42.4.180:2081/u"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "host",
"timestamp": "1624087316",
"to_ids": true,
"type": "hostname",
"uuid": "48e009f4-4441-441c-b143-1af5e3c90dee",
"value": "110.42.4.180"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "port",
"timestamp": "1624087316",
"to_ids": false,
"type": "port",
"uuid": "83ef0624-99e0-47dd-b94f-9e421477b38c",
"value": "2081"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "scheme",
"timestamp": "1624087316",
"to_ids": false,
"type": "text",
"uuid": "9ed4dae2-0aea-4c29-8df5-663c2e2637dd",
"value": "http"
}
]
}
]
}
}
Reference in a new issue Copy permalink