95 lines
175 KiB
JSON
95 lines
175 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--592595c4-5680-4487-b4ce-b459950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-24T14:16:37.000Z",
|
||
|
|
"modified": "2017-05-24T14:16:37.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "grouping",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "grouping--592595c4-5680-4487-b4ce-b459950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-24T14:16:37.000Z",
|
||
|
|
"modified": "2017-05-24T14:16:37.000Z",
|
||
|
|
"name": "M2M - Malspam",
|
||
|
|
"context": "suspicious-activity",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--592595c5-b670-4415-9829-7bd8950d210f",
|
||
|
|
"indicator--592595c5-3368-4b2b-8cc7-48f4950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592595c5-b670-4415-9829-7bd8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-24T14:16:37.000Z",
|
||
|
|
"modified": "2017-05-24T14:16:37.000Z",
|
||
|
|
"description": "98-3470.pdf",
|
||
|
|
"pattern": "[file:name = 'tmpm07zpvi0' AND file:content_ref.payload_bin = 'JVBERi0xLjQKJeLjz9MKMSAwIG9iago8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCA0MDIvSGVpZ2h0IDI0L0xlbmd0aCAxNzc5L0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0cmVhbQp4nO1c0VEkOwycZMjikiAGUiAFMiADIiACEiABEiABApjrqq7t0pNs2WNmD3ioP652Z7yyJEttWza374VCoVAoFAqFQqFQKHi8vr5uLfz58+fx8dG2vL29xXO0/ypVfwPe39+dh/EVD8+SjzHFILqRPQUMj95bhhnazP8WVt/f39/c3DAg8QFfnStoToKmJkOxexrttMX6sNk1JDw9PX18fLif9xSTOUdTLHHsFwKG393d0diHhwdrdR4MM+ixFoF+1bJY69p4eXlx6bAWxgl+Cmu9vb31YhKv1OwQa9k8inh+fo4qfYa1CMz+jriiYs6c/wdrWVdrmPjqLNaKEsRm8mGx1rURKeV0n/8U1uJaCHO0VkH4wCkbr9TskDnKIyyBJBYciLUWn9sV1wJr2TZgKsxBoKxo9S9hLTrQTjHC9VgLwOxjR6dY69oo1iK40ELK91oqF+bNoQJgvLhlA8BjeAv6ch0tsxaBvki/Vs4vYa3EzKuylhudOI4IHs1fGB0MfZRgF4qIQ7cOtw3i25kuIhAqtnDhqhYyCpI5FaJlDHsKkeaY5W20y2maT9lRMyOsTHSk9k43uleIO/cZIdEDzjqlOTRvNph0u/UPNIcCp7PWTFTPsxbNSQgB5tjwO4W19svUj/iZaTzDWnZoGJbRVxhchVMzrYYRAh0UIZDAaQIPk5RxElzoWqtjMOTpFrG81mpWHuxsxSpNhHyIUI9vrTeGXUTAWJvRgvKa9loXRbFNIbZA0SsG5onWVEz7nUnWyoXsZn5vWseIikIOuT36Bz3ySc/2tR0itMpPIuZZy3lpiLNYK7JK0njIWnFoyGBWPtPWwdLmTIRE5okBiQRPrLDYU9YapltEM5zQXrZrNe7GkYbrlERLFzXgV8tR5ApV+F3IURO7Lxh2EcEuNDugUzescj7aMCNiBY9CtIaR5k5V2uKE9LKMHM5liX2ypfsd5/MZIfKAU4wNFFH4QK/yic3oodtFfepCUdcbl/zQJ/7WpieP+RBI0bd5Nd6NVz7fObhJJBG+p0QU3w79kIQ3tdKqXkmq8NZKQMOnNi68hxFCCYBcwX61LrJHdZNW87PjnGG6ReTh1Nvp81eWwPfLtJLEhtNWSdok1bUuqLYVqJnFjZFtw9yX2K1VVMETpXZTyHAPEuFIaa2u5dpExeyamV0k9eEZt5OjLIcoWXpKHmUtdorEcewBJ1vTDrFWzIJEh2/IWhwFt2Lk4GpAWaBzlrqqHXvJIyRummxGcLjznUXTan52PLCN0i0i2ewkZ8FJtDhbQOCwGu0Rb2SPuOyh2vZk51AXQ2fy7Cnh292UNPP8arrdKpwzDEIFDWApFFBeHGWtRMgwnJpbKrtBm3H71gmz7bwdYvw5FFOZRRk3uUPsrbV647uft0OMb5PGeQglE4pbt8SAUZuFCGn2mwuJZvbSZybdeq6YqXweZS3wVXPCcntwt8WWcxZYq2eLDYZk2r02a/UsOsRauZDhaJ7FWrGL02+ZNsEFrebTQ3Wt5qFkT4dvWNcahm6itgvvBdZy/eZC9m/MWvFswoKTL+/YAzyVaPaF5yAr1UZY5ZvpwuHEtVZeA1lgLRWgIBktYZdYfZ61hkKGp2+TrJW7vckAJ661hld9pP88aw0roldirRPPEE9Zay1EyD9grUMlx32VtYa/al654f46+ZXdlc8rZkHnDOtazeJAsvF3WGAtLhLssUu8zDNkrRkhTQ9I2yFrzbh9ua41yVqxtCK4c+151lJxpjmsOsZyKn2StTQ6loGXWet6da08Qq7KWk19hlhjrf1y0mQr/zbYGMZow/HiLSOqp76Ygzrs0HmfJvq8iybmzxAlVguYeMgi5Rkbrhp/iLV0LEJj7bmbfhInU8oUTc0IcSdE+JdteOdqyFozbmcWQKwWeJNniJOsJQ7E2MkuqWEJc5615JntcluPD/HBboqdSsusZe/Gu7O2ZdbaLymjk2uF7mfOEIcRcm3WGqZbxDJr9TakvWuTFokEuzwbdhHRu6+lKNVayzVwF1qa/Yo9Flgr2b/rDqdt446hOYIzQnq3X6ySOWvNuN11ga/n1rWal44Iu3vNzxC3MBz6M94Ie59kX2KtJj75d4iucbziSItcrTiqMXMd0erwL1lrmG4Ry6y1//ea7hYuh7v7rvistYG985lIGHbRROw33o2HLfigM6ne5WEJgQ52kb9Wjddl4+1yZup2prtJK807Iv95IclN4xnW2ifc7hbP0rNn+0I1nvd23F8BuGLXUdaiJvH/fIjNPs9a8RTeNm76Ychau7nOtF2m2uhY+ycbM+GdR8i1WSvq49KtsFYuKxQKha9CsVahUPhZKNYqFAo/C8VahUKhUCgUCoVCoWDxF9wiZGUKZW5kc3RyZWFtCmVuZG9iago0IDAgb2JqCjw8L0xlbmd0aCAzIDAgUi9UeXBlL0VtYmVkZGVkRmlsZS9QYXJhbXMgMiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0KeF4L8GZmEWEAgaNp27zADCjgBNKpuQUllXolFSUB3oxMIgy4FUL0KEC1ImljZQOJMQKhOZBWBysAAKw9DoUKZW5kc3RyZWFtCmVuZG9iagozIDAgb2JqCjYyCmVuZG9iagoyIDAgb2JqCjw8L01vZERhdGUoRDoyMDE3MDUyMzEzMDg1MCswMycwMCcpL1NpemUgMTE2Pj4KZW5kb2JqCjUgMCBvYmoKPDwvVHlwZS9GaWxlc3BlYy9GKEhTRUdIREguemlwKS9VRihIU0VHSERILnppcCkvRUY8PC9GIDQgMCBSL1VGIDQgMCBSPj4vRGVzYygpPj4KZW5kb2JqCjggMCBvYmoKPDwvTGVuZ3RoIDcgMCBSL1R5cGUvRW1iZWRkZWRGaWxlL1BhcmFtcyA2IDAgUi9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0cmVhbQp4Xu1ZhVtU/bYeQBlCYEgByaE7REC6GbpbGGmGGBqGxiEkBAlFUES6QUJAuktAQmFoSUFCUkLqjt859+rn8f4F59v7efbsefas9ez5/d4V77u01bCukQGwATgAAIARkKvXPayJAQDgXAMASAE4mGbyrnAvW7gXVN/PzdbTnBfh4syQfQ2TPROAif79P8d/8QqUJg9odvKDFI8h5/IrPDFzVTI4d7aRvSQN7PT3l1Ssxvn8ZscuJUmPK2WyyB1FKq2GZz0lb2cMCk+QOUUVNpdMpj42xig/Um2stXoVW7efSJ6aqzeGAJLPYFZNHR7ZVU1ityGraA1L1TgkcB94Aw3Bxxg0L4WkTNPWRWrBff4cZqDjnNGwwma1Bd00fwLhl00yTEas5K9vTc/fjb6fQD7c2JZhIECFHK1RX9EvffldkeP4mmbaXWxx2t14Z34ByLrWJfbWgVShkA4X+2fBfF9Yf+Qk5d728v7AGYs0j+DCmEhcueypv20RJo38taIKLMjEbpMHV434iVT7cDv7vmBLVeJlsMnJo8cKF9iJrc/M+gTtQ1NrsXenbYezC/o+vvY7xIB5MJ2/CqYckmq8wXxNACZKuKad/Fjh+ffY1/gXjbqZ2JPg1uUvRGgEXV1hAbT/FoY1BvxMh+gn6ugow0eHIdTD1tmTj/fH9Z/w+y+OuV/+emmShlYn/43IHcj5w77j8bkEkJyaryykkVE/OFRllqgmLof51lwrGw1InzoMSzmkOfj83cycRNxGH+PRklBpLAmZOFOtb1nks+/u3kBOVo8UJffSxS5in/Fv40dpyqp+7D7NjzlL3hZmqfV/YlL6sKdQCRrmNaLGJc2j
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-24T14:16:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"attachment\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592595c5-3368-4b2b-8cc7-48f4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-24T14:16:37.000Z",
|
||
|
|
"modified": "2017-05-24T14:16:37.000Z",
|
||
|
|
"description": "IMG_3428.pdf",
|
||
|
|
"pattern": "[file:name = 'tmpcsfxtk7r' AND file:content_ref.payload_bin = 'JVBERi0xLjQKJeLjz9MKMSAwIG9iago8PC9UeXBlL1hPYmplY3QvU3VidHlwZS9JbWFnZS9XaWR0aCAzNjgvSGVpZ2h0IDI0L0xlbmd0aCAxODUxL0NvbG9yU3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0cmVhbQp4nO1b0VHlMAxMM3RBE9RAC7RAB3RABVRAAzRAAzRAAbkddt6OTpJlx7wMN5z3i5c4sixLa1k2+76wsLCwsLCwsLCwsPD78fb2tmW4vb19enqyLe/u7vAc7X9K1f8BHx8fzsL4iYfXko85xSS6mb0K6B7dZhjLw8PDzc2N3Ozl5aVo//j4iGb4JL76/PykkNQnqc/r66t7jsZWAfyBn87CfNtSDDpbyWn4UCw0LIaWAt9C86NfHQLGpeEz/NXj992jxSfE/f29Wi4+ORtwUTebnN8r2vxn+QSenLpZEUHy/DQ2aTG0cW85TOu9+xf/4EnL1S17KChip8/Pz05yET5RsS7O5pP393er4Ul8Eocgk8qZF5+cjTibV7f5D/IJY5+9Kx8QwyAPaX1Cya1sgRRhP2fIxFgWmYATpAAaI5Hgc5ulpHmRMiIrmU+cVhDFNOaoqc/mE8a1Y1rhPD7ZL3Mt4YtPzsbv5hPGHeLXPdeKGZdyRjpic/vaGaVi3a4HP5nSxG1jkTAw67DskW6mqA8ax3FFmVT7KDmczSe1A5zKJ3xV8Ak8QZyPmXJ2pgSbYcbNsm2QbqW7XUTAE+wG2e2ONShI5gqCltGAFCLNsVpZP5TRsIBSCDuqk1u8RUdq73SjeYW4Dx0REi3gRieHgeZpg0GzW/tAcyhQ8wnXprQMsn+FczoK0Qj7ilxE2F0P84qY7XA4BTOjC+d+EsufrUhp8ck+QA7WzvSx+ImdbjSOQ7BC0DKWjJyqAiR39ztHA3A6P3EbMfm2Pld+66BZI4HHMdqx1F1EYEZsrAnyVY7XckUUmwrBE9FFq+hUO0+qmNx1kE9qIbtZoNPR0WGikENmj/ZBj3zSGjvDvHD1CLofHZi+VEw9fZ42TDMZZ6VBUCyNwwHG2ridHYtufhLtrFGoTXRUZ8bUFVt7wzjpNZ9MBGDKJ3AYbWy1KDg+odNiuhllWu7VgD8te9A42rs55amJdYZuFxHsAs2oNjp1cyT7ow19I1aKKEQrpjR3qnIsTkjrLEalADUQ38rC3f3OiBBZwCnGBuyCvdCqfGJjrWt2kZK6EL205oUDOXRQ5eKXWrUyQG1PtiyN0SIy3juhJY8bonQjkA5ciWuxoNMmSmsVcfJVPSGBMDXlE9mBZpEQ6llMRBp0LT6ZCMD6fMdOgfVtfuWySs5pMWst5VMnmevCWXs367WLL9vGLX9btsbhiUt9nZBuRh3h6GKufuLaRMVsnsku3PJhPXDE7HGlVtzVShajcKBAWzZkhlMcLrOLtELidu5CdPgoVhHaKuAU4WNzWgea1KVMnCnNTupRfEg7MH9ws8kFpeUz43zynRiPQBdu7qzfiifTD+1XGDKiFe1hB8Z1TBVoeVt1P9SF0Mow6YoFE+5mq1sTbDoLVuE69jEdaICRQgFtcI7ySSGkm2OnBTcb7CNm3xp8u10vP4nswdhpBbWifssOL1r5SWt+HdyFk66Q7XJ9q6inFdEqOzNe3If2UoGrSIxgnE8mAjAKLHCUT+AAriYQlbFXawhZeGI4rbHYSC+WqrP5pDWiQ3xSC+nO5rX4JHZRZyAU2wpJ8Axe2eiLJSChOCFSmhQ72tpc1NW/zhKtY4yj64ctyfbDieOYf5lP6puNZHUSNSs/2v67lngOGtEenM4w0oXDFfOTiaJTzScqdEAyWmJc4ttxPukKSRPgqGSXT2qzp7FZ5yd1QZXZhSalVcnX2O23Kg7TbfStyw26G/8f4ZNv5idFVaeFo3xyKACjwAKxftKtXTuv4/CLr6x9xhWziL6U1k/Sfautn0SHtJjgE2577boZb0p0+WRESGoBadvlkxGzT9RP9kt0RPuolOpKyjHHSK+TxYtntJLb9TAMWwUNkVKq+Rl8cl79JN6ytjhaPzkagHN8spvCsg5BqAxnlg6GNnQSW5p25lL1WGcxosS6ixTj5zsSqxXNne9IiE676qsINZ/ohIiDtWci+iSuWW6bMCLEne/ooiYPGrp8MmJ20j7EKinqnu/s2f1YGpbdKfxFGoUZ5SHpfXtJcIyks9enr9tHfIg/bGKfdnoGn+yG95wffud8xx3nRUyc7xwKwGk+adUZWhe0LAoJNqXpdhHRun8i8yo/cQ1sFNvDRwv55wSfFGUZHSnaNu54l1Q2IqR1ecYqWfPJiNldF/g5coLDXCLCpg31zTelGXaaos1bu56WAtvfp/AO1+IT1zLev6J63fsnsUwd5bR0OMQnEwE4zSf733fntnBB1F0xxd9aT+3tskJCt4sUsd94PxZjwR9klfRerhMCHSzhz9VjdSV1u5xnxdiRwys1Ei2PCyku947wyT5gdpdwSs/W2K3p6ivT9JDW8rqbe/v2sllEuuvZG/9ffOhEPtWn+LxoqatN24UEUr+Stt37sd0rrIf4ZJ8KwP8Kc7vChYWFhYjFJwsLC9fC4pOFhYVrYfHJwsLCwsLCwsLCwu/GH/eNS6YKZW5kc3RyZWFtCmVuZG9iago0IDAgb2JqCjw8L0xlbmd0aCAzIDAgUi9UeXBlL0VtYmVkZGVkRmlsZS9QYXJhbXMgMiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0KeF4L8GZmEWEAgaNp27zADCjgBNKpuQUllXolFSUB3oxMIgy4FUL0KEC1ImljZQOJMQKhOZBWBysAAKw9DoUKZW5kc3RyZWFtCmVuZG9iagozIDAgb2JqCjYyCmVuZG9iagoyIDAgb2JqCjw8L01vZERhdGUoRDoyMDE3MDUyNDEyMjEwMiswMycwMCcpL1NpemUgMTE2Pj4KZW5kb2JqCjUgMCBvYmoKPDwvVHlwZS9GaWxlc3BlYy9GKENBWEdZUC56aXApL1VGKENBWEdZUC56aXApL0VGPDwvRiA0IDAgUi9VRiA0IDAgUj4+L0Rlc2MoKT4+CmVuZG9iago4IDAgb2JqCjw8L0xlbmd0aCA3IDAgUi9UeXBlL0VtYmVkZGVkRmlsZS9QYXJhbXMgNiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0KeF7teoVXXMn2dSPB3YK7uwYPQYO7uzVuwSVIkAR3DRDc3d2DE9wbDRDc3b+eeW/eZDLz+/6B9+5afVd3Ve1z61bvU1Vn11GUgYLGAsAA4AAAABnAi6zNwAICAIB5AQBgAuAgdUTt7ZyBds4Gqh4OQCc9ZndbG9JsaEjaTAAkuP3/rv/iEaiNH7brZkUTv064Q41pUDPeyS6mhwxLZNbJnURlHYUuvaOK8nj07odWDPJTzbMh5+W4/mLNH7diCHSu9/MbWoh1CUMZ7pTWoONnWti+4fI1xZMwYshKD4otg1jI9PWaIqgQNJSwCqNK7d3J4HnLC0VR6UDMqGb1Mjy4FknlKOgBQ2XtOn0UKmlUopItajDg0otFMawpcsFBvCKVEoKz+qDJUrY0Fv64LpZcOZ3FxuXNYEOgf3wqcRpdlNt0542SSHEajI3LsTOnsFp0hFiwfbfiS4NmxdOhwSYy4LsV6i3OZBqpqiRcsgACbbaJN2pZB8xbUvh9dTAPL/bXZHX1GOC9HM7OuqTe5N5zNVu8B52iUcCXoxvuL+EbwcdFleTdGK3g51If8egtP/fP6zR8DOY0Hxdoebk9P58mqrxNyxPF2bCOClpBNlPerjVCJSs+N1j+Ijn78hh1ckRDkcjo/JtB6TMyAPD8DAVQ/IuDEsfgNxyDWScP9j9EsIMaOAJtnFiYf7v/zzH/i73xp1cvje2y6mFFenMc8Bgw0aa02IWbI89iMg7CXYCF05GSxQTNW809
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-24T14:16:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"attachment\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|