{
  "Event": {
    "analysis": "2",
    "date": "2017-10-25",
    "extends_uuid": "",
    "info": "OSINT - Return of Not Petya as Bad Rabbit Diskcoder, yes those two are the same!",
    "publish_timestamp": "1514467209",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1511385575",
    "uuid": "59f04995-3b8c-4cf0-b555-4b26950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#2c4f00",
        "local": false,
        "name": "malware_classification:malware-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#00223b",
        "local": false,
        "name": "osint:source-type=\"blog-post\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Bad Rabbit\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:preventive-measure=\"Backup and Restore Process\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:preventive-measure=\"Restrict Workstation Communication\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": false,
        "type": "link",
        "uuid": "59f0499f-b1d4-4da8-898e-4056950d210f",
        "value": "https://mjolnirsecurity.com/return-of-not-petya-as-bad-rabbit-diskcoder-yes-those-two-are-the-same/",
        "Tag": [
          {
            "colour": "#00223b",
            "local": false,
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": false,
        "type": "comment",
        "uuid": "59f05077-adb0-40d3-a7f1-406b950d210f",
        "value": "After Wannacry and Petya/Not Petya/GoldenEye, its clear that Ukraine is a testing ground for everyone to try out their malware, program different variants and perfect before launching to target their final destination.\r\n\r\nToday, we have BadRabbit and DiskCoder. When we first read about them this morning, we thought they are two separate malwares. On deeper analysis, they are both the same.",
        "Tag": [
          {
            "colour": "#00223b",
            "local": false,
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "59f0509f-97d4-477e-9349-4cd1950d210f",
        "value": "185.149.120.3"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508922539",
        "to_ids": true,
        "type": "filename",
        "uuid": "59f054ab-fda4-41b0-98bb-457a950d210f",
        "value": "dispci.exe"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-0130-4778-a935-4593950d210f",
        "value": "1dnscontrol.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-ad74-4138-b75d-4100950d210f",
        "value": "an-crimea.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-9f1c-4216-ad97-4547950d210f",
        "value": "ankerch-crimea.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-dc48-4b00-964c-425e950d210f",
        "value": "argumenti.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-c98c-4630-8693-4131950d210f",
        "value": "argumentiru.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-ba70-439d-832f-49f9950d210f",
        "value": "caforssztxqzf2nm.onion"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-0534-45e3-8533-4f37950d210f",
        "value": "da.id"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b0-86a8-4522-b0b7-4f39950d210f",
        "value": "i24.com.ua"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-1820-4e76-bf84-4b93950d210f",
        "value": "most-dnepr.info"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b0-dc18-40b2-b1d1-4f5a950d210f",
        "value": "osvitaportal.com.ua"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "domain",
        "uuid": "59f056b0-bb20-4ef8-ac04-4d30950d210f",
        "value": "spbvoditel.ru"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "filename",
        "uuid": "59f056b0-e7a4-4620-8d32-4243950d210f",
        "value": "xhr.open"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-b8c8-4c02-8cf2-4f33950d210f",
        "value": "http://185.149.120.3/scholargoogle/"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-4198-4cc7-ba10-4044950d210f",
        "value": "http://1dnscontrol.com/flash_install.php"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-0de0-4ffa-b43c-42dd950d210f",
        "value": "http://an-crimea.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-50e0-4b30-bb61-444b950d210f",
        "value": "http://ankerch-crimea.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-5458-4721-a46f-4f16950d210f",
        "value": "http://argumenti.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-f094-46b2-b59c-4237950d210f",
        "value": "http://argumentiru.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-1ba4-48c5-8c9e-4fe2950d210f",
        "value": "http://bg.pensionhotel.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-4440-41f6-a67b-432d950d210f",
        "value": "http://blog.fontanka.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-1600-4266-b5d4-4c48950d210f",
        "value": "http://caforssztxqzf2nm.onion"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-c92c-49ef-b325-40d5950d210f",
        "value": "http://calendar.fontanka.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-facc-4b47-af46-4472950d210f",
        "value": "http://grupovo.bg"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-8c60-4747-94a1-4c6e950d210f",
        "value": "http://i24.com.ua"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-cea8-4272-81e4-4a85950d210f",
        "value": "http://most-dnepr.info"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-c418-4b72-9235-4e3e950d210f",
        "value": "http://novayagazeta.spb.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-e228-43b5-8a7a-4492950d210f",
        "value": "http://osvitaportal.com.ua"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-66d8-46f9-8775-48f4950d210f",
        "value": "http://spbvoditel.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-7a40-4389-a3bc-4767950d210f",
        "value": "http://www.aica.co.jp"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-b188-43f1-8a3f-42b3950d210f",
        "value": "http://www.fontanka.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-0b30-4f0d-919a-41ad950d210f",
        "value": "http://www.grupovo.bg"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-ce74-4b3c-83bf-4dc5950d210f",
        "value": "http://www.imer.ro"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-3978-4bc4-9fe3-42eb950d210f",
        "value": "http://www.mediaport.ua"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-cea4-4fd4-b3df-4759950d210f",
        "value": "http://www.online812.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b0-a4cc-4f30-9fe0-4b3b950d210f",
        "value": "http://www.otbrana.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b1-8760-49d0-b8be-41ad950d210f",
        "value": "http://www.pensionhotel.cz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925665",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b1-749c-4cd8-a045-426b950d210f",
        "value": "http://www.sinematurk.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "url",
        "uuid": "59f056b1-1ea8-475c-8c5c-479c950d210f",
        "value": "http://www.t.ks.ua"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-e470-463c-ac02-4e06950d210f",
        "value": "bg.pensionhotel.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-07b0-479c-9468-4d27950d210f",
        "value": "blog.fontanka.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-df04-4182-bb91-45be950d210f",
        "value": "calendar.fontanka.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-4f9c-4f1e-8673-4e58950d210f",
        "value": "novayagazeta.spb.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-70c0-4fd3-abd4-4154950d210f",
        "value": "www.aica.co.jp"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-5370-4e58-9476-415f950d210f",
        "value": "www.fontanka.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-a280-4719-97c4-4d98950d210f",
        "value": "www.grupovo.bg"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-8304-4c87-8bf6-4823950d210f",
        "value": "www.imer.ro"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-1030-43b1-9ce4-42a5950d210f",
        "value": "www.mediaport.ua"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-97e4-461a-a4da-4e97950d210f",
        "value": "www.online812.ru"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-3640-4eea-add8-4308950d210f",
        "value": "www.otbrana.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-3c20-4cfd-8def-4845950d210f",
        "value": "www.pensionhotel.cz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-865c-440e-a567-4377950d210f",
        "value": "www.sinematurk.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "hostname",
        "uuid": "59f056b1-c288-4de0-9948-44f2950d210f",
        "value": "www.t.ks.ua"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59f056b1-a968-4587-9891-44fc950d210f",
        "value": "16605a4a29a101208457c47ebfde788487be788d"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59f056b1-9920-4d2d-aaa2-4481950d210f",
        "value": "413eba3973a15c1a6429d9f170f3e8287f98c21c"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59f056b1-1a4c-429b-ac8b-4787950d210f",
        "value": "4f61e154230a64902ae035434690bf2b96b4e018"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59f056b1-3f08-4989-9daa-43cb950d210f",
        "value": "79116fe99f2b421c52ef64097f0f39b815b20907"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59f056b1-ef38-427f-aa41-4f05950d210f",
        "value": "afeee8b4acff87bc469a6f0364a81ae5d60a2add"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha1",
        "uuid": "59f056b1-2c08-428c-94c5-4c41950d210f",
        "value": "de5c8d858e6e41da715dca1c019df0bfb92d32c0"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59f060e2-cfec-4adb-8022-45e602de0b81",
        "value": "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "md5",
        "uuid": "59f060e2-0ac0-4413-8fff-4c1202de0b81",
        "value": "fbbdc39af1139aebba4da004475e8839"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: de5c8d858e6e41da715dca1c019df0bfb92d32c0",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": false,
        "type": "link",
        "uuid": "59f060e2-0138-472b-a46a-49a102de0b81",
        "value": "https://www.virustotal.com/file/630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da/analysis/1508925094/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: afeee8b4acff87bc469a6f0364a81ae5d60a2add",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "md5",
        "uuid": "59f060e2-83b8-4fda-b325-415502de0b81",
        "value": "b14d8faf7f0cbcfad051cefe5f39645f"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: afeee8b4acff87bc469a6f0364a81ae5d60a2add",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": false,
        "type": "link",
        "uuid": "59f060e2-4e28-44be-8e85-4da202de0b81",
        "value": "https://www.virustotal.com/file/8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93/analysis/1508925088/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59f060e2-1368-44be-932f-465602de0b81",
        "value": "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "md5",
        "uuid": "59f060e2-dc68-4bf7-951d-422d02de0b81",
        "value": "1d724f95c61f1055f0d02c2154bbccd3"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 79116fe99f2b421c52ef64097f0f39b815b20907",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": false,
        "type": "link",
        "uuid": "59f060e2-52b0-4714-824f-453202de0b81",
        "value": "https://www.virustotal.com/file/579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648/analysis/1508923756/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59f060e2-50b0-4fff-b4e7-4dbd02de0b81",
        "value": "301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "md5",
        "uuid": "59f060e2-5918-4e11-84aa-436a02de0b81",
        "value": "347ac3b6b791054de3e5720a7144a977"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 413eba3973a15c1a6429d9f170f3e8287f98c21c",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": false,
        "type": "link",
        "uuid": "59f060e2-2324-47b7-8233-4c2b02de0b81",
        "value": "https://www.virustotal.com/file/301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c/analysis/1508918790/"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "sha256",
        "uuid": "59f060e2-fadc-4b4a-9639-48e602de0b81",
        "value": "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": true,
        "type": "md5",
        "uuid": "59f060e2-5f18-4ceb-b975-499702de0b81",
        "value": "37945c44a897aa42a66adcab68f560e0"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 16605a4a29a101208457c47ebfde788487be788d",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1508925666",
        "to_ids": false,
        "type": "link",
        "uuid": "59f060e2-f748-4b93-a714-4b7002de0b81",
        "value": "https://www.virustotal.com/file/2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035/analysis/1508925098/"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "3",
        "timestamp": "1508922700",
        "uuid": "59f0554c-76c4-42bb-9dbc-4fe9950d210f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "filename",
            "timestamp": "1508922700",
            "to_ids": true,
            "type": "filename",
            "uuid": "59f0554c-c8c0-46ad-a129-4243950d210f",
            "value": "dispci.exe"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1508922700",
            "to_ids": true,
            "type": "sha256",
            "uuid": "59f0554c-e344-4c46-96d0-435c950d210f",
            "value": "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
          }
        ]
      }
    ]
  }
}