{
  "Event": {
    "analysis": "0",
    "date": "2016-09-01",
    "extends_uuid": "",
    "info": "Malspam 2016-09-01 (.wsf in .zip) - campaign: \"Please find attached invoice no:\"",
    "publish_timestamp": "1472734172",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1472734150",
    "uuid": "57c821ca-f2ac-43e7-a2e4-4470950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#3a7300",
        "local": false,
        "name": "circl:incident-classification=\"malware\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733779",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82253-68a8-47c1-8701-4549950d210f",
        "value": "chal4.co.uk"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733779",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82253-6c64-475c-94de-4f52950d210f",
        "value": "82.165.38.131"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733779",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82253-4d3c-4803-ac3a-4c91950d210f",
        "value": "abcbureautique.abc.perso.neuf.fr"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733780",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82254-b2a4-4c04-9b48-40dd950d210f",
        "value": "86.65.123.70"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733780",
        "to_ids": true,
        "type": "url",
        "uuid": "57c82254-580c-40dc-84ad-4742950d210f",
        "value": "http://www.valerypro.com/87hcrn33g"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733780",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82254-0e1c-450b-91b2-4118950d210f",
        "value": "www.valerypro.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733780",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82254-fa88-479d-a216-411b950d210f",
        "value": "213.205.40.169"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733780",
        "to_ids": true,
        "type": "url",
        "uuid": "57c82255-4f4c-494a-9bb8-4e24950d210f",
        "value": "http://pp4_09_10_2s.republika.pl/87hcrn33g"
      },
      {
        "category": "Payload delivery",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733781",
        "to_ids": true,
        "type": "filename",
        "uuid": "57c82255-4c98-4521-b5e5-423b950d210f",
        "value": "pp4_09_10_2s.republika.pl"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733781",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82255-9990-46c3-8869-411e950d210f",
        "value": "213.180.150.17"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733781",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82255-6e44-47d6-9cc8-4004950d210f",
        "value": "school3.50webs.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733781",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82255-4aa8-4635-92cb-4358950d210f",
        "value": "192.151.153.26"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733782",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82256-c578-4239-be73-496f950d210f",
        "value": "158.195.68.10"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733782",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82256-d614-44be-aaa5-48af950d210f",
        "value": "szkolagrojec.republika.pl"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733782",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82256-163c-4973-bb93-4a8d950d210f",
        "value": "imperium.nazory.cz"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733782",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82256-9564-4207-ac52-4984950d210f",
        "value": "185.64.219.7"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733783",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82257-1f60-4cc5-9164-4f6e950d210f",
        "value": "www.galaturs.com.ua"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733783",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82257-9488-4661-aaad-418f950d210f",
        "value": "91.207.44.3"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733783",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82257-3c44-4753-9623-41c1950d210f",
        "value": "www.idiomestarradellas.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733783",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82257-2070-43cd-9fe8-4aed950d210f",
        "value": "62.42.230.17"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733783",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82257-ef10-46d1-bb6d-41fa950d210f",
        "value": "www.infoteria.cba.pl"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733784",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82258-c98c-4f75-a4a5-4337950d210f",
        "value": "95.211.144.65"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733784",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82258-4bbc-4b38-b53f-4ba4950d210f",
        "value": "srxrun.nobody.jp"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733784",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82258-c9ec-415c-9e3a-4e81950d210f",
        "value": "112.140.42.29"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733784",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82258-5198-45ec-9f0f-473f950d210f",
        "value": "kissfm.rdsor.ro"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733785",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82259-4f38-4b93-bd59-41b6950d210f",
        "value": "193.231.238.4"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733785",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82259-c1e8-4a69-b12c-4f5c950d210f",
        "value": "www.gebrvanorsouw.nl"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733785",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82259-10cc-4310-8341-4e98950d210f",
        "value": "62.250.4.180"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733785",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82259-0a50-479b-828f-4ad8950d210f",
        "value": "www.gunaldy.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733785",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82259-fc84-4326-9804-4513950d210f",
        "value": "31.22.4.108"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733786",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225a-1c80-453e-93d2-4c98950d210f",
        "value": "www.termoalbiate.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733786",
        "to_ids": true,
        "type": "url",
        "uuid": "57c8225a-37b8-48fa-8fd7-4c01950d210f",
        "value": "http://www.agridiving.net/87hcrn33g"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733786",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225a-b8f0-43f5-acbb-46bb950d210f",
        "value": "www.agridiving.net"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733786",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225a-01d4-4358-90ca-4d40950d210f",
        "value": "195.238.0.64"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733787",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225b-fde8-4552-8fef-447e950d210f",
        "value": "olivier.coroenne.perso.sfr.fr"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733787",
        "to_ids": true,
        "type": "domain",
        "uuid": "57c8225b-bdb0-4afe-952e-47ec950d210f",
        "value": "dcqoutlet.es"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733787",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225b-8868-429d-b583-4800950d210f",
        "value": "134.0.11.123"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733787",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225b-7c50-4057-b606-4879950d210f",
        "value": "kawasima0506.web.fc2.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733787",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225b-4328-4690-940d-47e7950d210f",
        "value": "208.71.106.62"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733788",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225c-ee18-4738-91b5-4036950d210f",
        "value": "sac360.web.fc2.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733788",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225c-2f40-4cbe-9091-4d10950d210f",
        "value": "208.71.106.42"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733788",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225c-4220-4ace-906c-43ce950d210f",
        "value": "www.carloabati.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733788",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225c-dbbc-4b2d-95d7-48d1950d210f",
        "value": "www.archiviestoria.it"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733789",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225d-2778-42bc-95e4-4bb7950d210f",
        "value": "branchjp.web.fc2.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733789",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225d-1bcc-4362-9ea5-47c8950d210f",
        "value": "208.71.106.41"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733789",
        "to_ids": true,
        "type": "domain",
        "uuid": "57c8225d-bed0-4e86-9455-47f8950d210f",
        "value": "rodewelshcobs.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733789",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225d-483c-4a9e-ac43-4b3d950d210f",
        "value": "213.186.33.24"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733789",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225d-c0c0-44c7-8adf-4d95950d210f",
        "value": "reklamnibannery.wz.cz"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733790",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225e-0c88-4a11-800d-443e950d210f",
        "value": "185.64.219.5"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733790",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225e-0888-4a67-a4f5-4a29950d210f",
        "value": "nevrincea.50webs.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733790",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225e-2244-4921-9411-4ac6950d210f",
        "value": "162.210.101.91"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733790",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225e-6818-4541-b16d-4b3c950d210f",
        "value": "www.cmg-ingegneria.it"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733791",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225f-2fe8-4bc1-883e-47e9950d210f",
        "value": "forum.sandalcraft.cba.pl"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733791",
        "to_ids": true,
        "type": "url",
        "uuid": "57c8225f-f6b8-4fa6-83af-430a950d210f",
        "value": "http://postaldigitalrs.com.br/87hcrn33g"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733791",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c8225f-2bbc-48ca-926b-4ed4950d210f",
        "value": "postaldigitalrs.com.br"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733791",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c8225f-a6b0-4663-9f84-4ff5950d210f",
        "value": "187.45.193.139"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733792",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82260-3dd8-46fd-9f9a-49ae950d210f",
        "value": "dashman.web.fc2.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733792",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82260-6060-4f5a-b726-4249950d210f",
        "value": "208.71.106.45"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733792",
        "to_ids": true,
        "type": "domain",
        "uuid": "57c82260-dd84-4e8d-a4f2-4748950d210f",
        "value": "rhanwid.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733792",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82260-8ae8-4089-bd3d-498f950d210f",
        "value": "wccf.huuryuu.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733792",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82260-85a4-4f4c-88bb-4de9950d210f",
        "value": "www.courtesyweb.it"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733793",
        "to_ids": true,
        "type": "domain",
        "uuid": "57c82261-093c-449e-bab8-4077950d210f",
        "value": "hotcarshhhs6632.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733793",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57c82261-c61c-4c36-aa6f-408e950d210f",
        "value": "23.95.106.193"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472733972",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57c82314-bbf0-4c73-aca3-4d4b950d210f",
        "value": "www.coseincredibili.it"
      }
    ]
  }
}