{
  "Event": {
    "analysis": "0",
    "date": "2016-09-09",
    "extends_uuid": "",
    "info": "Malspam 2016-09-08 (.wsf in .zip) - campaign: icloud.com",
    "publish_timestamp": "1473400945",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1473400683",
    "uuid": "57d24ef7-1258-4e36-a571-43c9950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#3a7300",
        "local": false,
        "name": "circl:incident-classification=\"malware\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400667",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5b-3e2c-48a5-8c81-e6b6950d210f",
        "value": "112.140.42.29"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400667",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5b-afb4-4db3-b145-e6b6950d210f",
        "value": "158.195.68.10"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400667",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5b-823c-45f2-a6a0-e6b6950d210f",
        "value": "188.120.235.214"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400668",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5c-3930-4568-acac-e6b6950d210f",
        "value": "200.83.4.62"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400668",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5c-5dc8-42cd-a6d0-e6b6950d210f",
        "value": "202.224.63.6"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400668",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5c-b91c-456e-81ea-e6b6950d210f",
        "value": "208.71.106.37"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400668",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5c-7da0-4500-bad7-e6b6950d210f",
        "value": "208.71.106.45"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400669",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5d-7b48-4703-b1d4-e6b6950d210f",
        "value": "208.71.106.61"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400669",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5d-dddc-4e96-b999-e6b6950d210f",
        "value": "209.41.183.242"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400669",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5d-0ab4-4e17-9d2a-e6b6950d210f",
        "value": "211.134.181.38"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400669",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5d-3168-4d21-aaf4-e6b6950d210f",
        "value": "211.78.38.199"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400670",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5e-f168-480e-8f60-e6b6950d210f",
        "value": "213.185.87.30"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400670",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5e-afd8-40d7-b8df-e6b6950d210f",
        "value": "213.205.40.169"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400670",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5e-ba94-4acc-8cfd-e6b6950d210f",
        "value": "213.208.133.41"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400670",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5e-6a88-4f0d-b088-e6b6950d210f",
        "value": "216.110.144.242"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400671",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5f-edf4-4029-9887-e6b6950d210f",
        "value": "62.24.202.31"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400671",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5f-5d00-4c4b-a257-e6b6950d210f",
        "value": "62.250.4.180"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400671",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5f-246c-4447-b77a-e6b6950d210f",
        "value": "62.42.230.17"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400671",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f5f-f808-45bd-8afc-e6b6950d210f",
        "value": "80.150.6.138"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400672",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f60-40d4-4c4d-9237-e6b6950d210f",
        "value": "81.196.20.133"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400672",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f60-57e8-437e-ac18-e6b6950d210f",
        "value": "85.18.11.68"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400672",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f60-caac-4600-b61f-e6b6950d210f",
        "value": "85.248.42.103"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400672",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f60-ea7c-43d4-a67c-e6b6950d210f",
        "value": "86.65.123.70"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400673",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f61-da6c-4e10-89a3-e6b6950d210f",
        "value": "87.242.73.75"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400673",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57d24f61-7ac0-41c2-b0b5-e6b6950d210f",
        "value": "93.184.47.165"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400673",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f61-a494-40da-ac38-e6b6950d210f",
        "value": "dashman.web.fc2.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400673",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f61-f7fc-4b54-9e07-e6b6950d210f",
        "value": "fidelitas.heimat.eu"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400673",
        "to_ids": true,
        "type": "domain",
        "uuid": "57d24f61-7298-4ea4-aa7c-e6b6950d210f",
        "value": "gam-e20.it"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400674",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f62-f92c-4878-a28f-e6b6950d210f",
        "value": "http://158.195.68.10/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400674",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f62-4f80-4133-aa87-e6b6950d210f",
        "value": "http://209.41.183.242/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400674",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f62-f2e4-414e-9bca-e6b6950d210f",
        "value": "http://fidelitas.heimat.eu/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400674",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f62-7320-443c-9fce-e6b6950d210f",
        "value": "http://josemedina.com/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400675",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f63-1474-4090-b659-e6b6950d210f",
        "value": "http://sitio655.vtrbandaancha.net/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400675",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f63-514c-4f65-a6b9-e6b6950d210f",
        "value": "http://sp-moto.ru/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400675",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f63-6148-4457-ad48-e6b6950d210f",
        "value": "http://srxrun.nobody.jp/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400675",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f63-ef70-4168-aea0-e6b6950d210f",
        "value": "http://toukontoutaukaiazalea.web.fc2.com/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400676",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f64-ed58-459d-afea-e6b6950d210f",
        "value": "http://www.aldesco.it/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400676",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f64-8fbc-4568-947c-e6b6950d210f",
        "value": "http://www.association-julescatoire.fr/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400676",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f64-e1c4-4cca-b73d-e6b6950d210f",
        "value": "http://www.bytove.jadro.szm.com/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400676",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f64-4878-44c0-a556-e6b6950d210f",
        "value": "http://www.ccnprodusenaturiste.home.ro/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400677",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f65-efa0-45ec-9df7-e6b6950d210f",
        "value": "http://www.idiomestarradellas.com/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400677",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f65-e22c-436e-ab14-e6b6950d210f",
        "value": "http://www.oltransservice.org/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400677",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f65-2a04-4624-964e-e6b6950d210f",
        "value": "http://www.one-clap.jp/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400677",
        "to_ids": true,
        "type": "url",
        "uuid": "57d24f65-9c38-46a9-845d-e6b6950d210f",
        "value": "http://www.xolod-teplo.ru/g76gyui"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400678",
        "to_ids": true,
        "type": "domain",
        "uuid": "57d24f66-01c0-4567-9bb5-e6b6950d210f",
        "value": "josemedina.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400678",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f66-dff8-4608-9d35-e6b6950d210f",
        "value": "ngenge.web.fc2.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400678",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f66-1848-460e-8b9f-e6b6950d210f",
        "value": "olivier.coroenne.perso.sfr.fr"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400678",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f66-0268-4fe3-add0-e6b6950d210f",
        "value": "sitio655.vtrbandaancha.net"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400679",
        "to_ids": true,
        "type": "domain",
        "uuid": "57d24f67-2390-4219-9ee8-e6b6950d210f",
        "value": "sp-moto.ru"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400679",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f67-f87c-46a7-b56f-e6b6950d210f",
        "value": "srxrun.nobody.jp"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400679",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f67-92d8-4e62-affe-e6b6950d210f",
        "value": "thb-berlin.homepage.t-online.de"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400679",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f67-a668-48af-9853-e6b6950d210f",
        "value": "toukontoutaukaiazalea.web.fc2.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400680",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f68-6838-4cc7-bf7e-e6b6950d210f",
        "value": "unimet.tmhandel.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400680",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f68-fbe8-4b13-a031-e6b6950d210f",
        "value": "www.aldesco.it"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400680",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f68-10c0-4372-b096-e6b6950d210f",
        "value": "www.alpstaxi.co.jp"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400680",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f68-a928-4175-88b1-e6b6950d210f",
        "value": "www.association-julescatoire.fr"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400681",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f69-fc88-4dbf-bf90-e6b6950d210f",
        "value": "www.bytove.jadro.szm.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400681",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f69-1b6c-4f46-b64e-e6b6950d210f",
        "value": "www.ccnprodusenaturiste.home.ro"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400681",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f69-adf0-4929-bf8d-e6b6950d210f",
        "value": "www.gebrvanorsouw.nl"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400681",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f69-90e4-466b-87bd-e6b6950d210f",
        "value": "www.hung-guan.com.tw"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400682",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f6a-42cc-45d0-8d39-e6b6950d210f",
        "value": "www.idiomestarradellas.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400682",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f6a-0e3c-4284-b8c4-e6b6950d210f",
        "value": "www.laribalta.org"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400682",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f6a-2348-459f-b049-e6b6950d210f",
        "value": "www.oltransservice.org"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400682",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f6a-33dc-4282-9607-e6b6950d210f",
        "value": "www.one-clap.jp"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400683",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f6b-7ae0-447d-86c7-e6b6950d210f",
        "value": "www.plumbntile.talktalk.net"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400683",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f6b-3ca0-427c-84b9-e6b6950d210f",
        "value": "www.radicegioielli.com"
      },
      {
        "category": "Network activity",
        "comment": "download location",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1473400683",
        "to_ids": true,
        "type": "hostname",
        "uuid": "57d24f6b-92b4-455f-81ec-e6b6950d210f",
        "value": "www.xolod-teplo.ru"
      }
    ]
  }
}