{
    "type": "bundle",
    "id": "bundle--58996c01-5948-4776-bc9f-4216950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-24T09:16:37.000Z",
            "modified": "2017-02-24T09:16:37.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--58996c01-5948-4776-bc9f-4216950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-24T09:16:37.000Z",
            "modified": "2017-02-24T09:16:37.000Z",
            "name": "OSINT -  When A Pony Walks Out Of A Pub",
            "published": "2017-02-24T16:00:38Z",
            "object_refs": [
                "observed-data--58996c22-8218-4d72-8cbd-43a3950d210f",
                "url--58996c22-8218-4d72-8cbd-43a3950d210f",
                "x-misp-attribute--58996c33-13ac-492f-a3b9-46dc950d210f",
                "indicator--58996c61-82f0-4dfb-b824-4d81950d210f",
                "indicator--58996c62-0b14-4823-a56c-4514950d210f",
                "indicator--58996c63-ed10-4933-944c-4faf950d210f",
                "indicator--58996c64-04fc-4b79-8555-4eb9950d210f",
                "indicator--58996c65-6cec-47fc-b053-48f3950d210f",
                "indicator--58996c66-5c50-4199-9592-4da3950d210f",
                "indicator--58996c67-5324-4a23-a81f-4fc3950d210f",
                "indicator--58996c68-d6d8-4822-9a30-4e32950d210f",
                "indicator--58996c69-80d0-4ecb-9a50-4d4f950d210f",
                "indicator--58996c6a-0478-4c6a-9227-403a950d210f",
                "indicator--58996c6a-3940-4317-bd3e-4e5c950d210f",
                "indicator--58996c6b-d2f4-4906-ae76-4e1f950d210f",
                "indicator--58996c6c-257c-47ee-a443-4984950d210f",
                "indicator--58996ca9-42a4-4d3d-bed6-4fe0950d210f",
                "indicator--58996caa-2898-4e2a-b3f3-4aa3950d210f",
                "indicator--58996cab-69d4-42c5-8483-42e5950d210f",
                "indicator--58996cab-b9d4-48e3-84c5-4870950d210f",
                "indicator--58996cac-0e60-42b7-a43f-4814950d210f",
                "indicator--58996cf8-bc7c-4413-bff0-4a1d02de0b81",
                "indicator--58996cf9-51d4-4ad8-bc37-45d102de0b81",
                "observed-data--58996cf9-9a7c-40df-b751-444202de0b81",
                "url--58996cf9-9a7c-40df-b751-444202de0b81",
                "indicator--58996cfa-64d4-402e-9ce3-4b7c02de0b81",
                "indicator--58996cfb-6388-411b-a740-41a302de0b81",
                "observed-data--58996cfc-d058-4024-a0de-47cb02de0b81",
                "url--58996cfc-d058-4024-a0de-47cb02de0b81",
                "indicator--58996cfc-e528-414d-b766-44ec02de0b81",
                "indicator--58996cfd-1d94-41fd-9cca-41e102de0b81",
                "observed-data--58996cfe-2598-4470-b1cf-4c8702de0b81",
                "url--58996cfe-2598-4470-b1cf-4c8702de0b81",
                "indicator--58996cff-b21c-4734-8788-41d702de0b81",
                "indicator--58996d00-f794-49a3-98ac-481c02de0b81",
                "observed-data--58996d00-630c-4917-a08e-4b8e02de0b81",
                "url--58996d00-630c-4917-a08e-4b8e02de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58996c22-8218-4d72-8cbd-43a3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:36.000Z",
            "modified": "2017-02-07T06:45:36.000Z",
            "first_observed": "2017-02-07T06:45:36Z",
            "last_observed": "2017-02-07T06:45:36Z",
            "number_observed": 1,
            "object_refs": [
                "url--58996c22-8218-4d72-8cbd-43a3950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\"",
                "admiralty-scale:source-reliability=\"b\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58996c22-8218-4d72-8cbd-43a3950d210f",
            "value": "http://blog.talosintel.com/2017/02/pony-pub-files.html"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--58996c33-13ac-492f-a3b9-46dc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:41:55.000Z",
            "modified": "2017-02-07T06:41:55.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "Talos has observed a small email campaign leveraging the use of Microsoft Publisher files. These .pub files are normally used for the publishing of documents such as newsletters, allowing users to create such documents using familiar office functions such as mail merging. Unlike other applications within the Microsoft Office suite, Microsoft Publisher does not support a 'Protected View' mode. This is a read only mode which can help end users remain protected from malicious document files. Microsoft Publisher is included and installed by default in Office 365.\r\n\r\nThe file used in this campaign was aimed at infecting the victim with the, well known, Pony malware. Whilst Pony is well documented in technical capability it has not been known to use the .pub file format until now. Pony is a credential harvesting piece of malware with other trojan capabilities. In addition to credential harvesting, it is also commonly deployed as a malware loader and used to infect systems with additional malware in multi-stage infection chains. Pony is still used heavily as the sources of multiple Pony versions leaked thus making it much easier for other malicious actors to implement Pony into their infection chain."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c61-82f0-4dfb-b824-4d81950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:41.000Z",
            "modified": "2017-02-07T06:42:41.000Z",
            "description": "payload",
            "pattern": "[url:value = 'http://5.200.52.198/flex/3435dde3r.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:41Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c62-0b14-4823-a56c-4514950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:42.000Z",
            "modified": "2017-02-07T06:42:42.000Z",
            "description": "Pony CC",
            "pattern": "[url:value = 'http://195.22.127.233/rec/fre.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c63-ed10-4933-944c-4faf950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:43.000Z",
            "modified": "2017-02-07T06:42:43.000Z",
            "description": "Pony CC",
            "pattern": "[url:value = 'http://kbfvzoboss.bid/alien/fre.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:43Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c64-04fc-4b79-8555-4eb9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:44.000Z",
            "modified": "2017-02-07T06:42:44.000Z",
            "description": "Pony CC",
            "pattern": "[url:value = 'http://alphastand.win/alien/fre.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c65-6cec-47fc-b053-48f3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:45.000Z",
            "modified": "2017-02-07T06:42:45.000Z",
            "description": "Pony CC",
            "pattern": "[url:value = 'http://alphastand.top/alien/fre.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c66-5c50-4199-9592-4da3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:46.000Z",
            "modified": "2017-02-07T06:42:46.000Z",
            "description": "Pony CC",
            "pattern": "[url:value = 'http://alphastand.trade/alien/fre.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c67-5324-4a23-a81f-4fc3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:47.000Z",
            "modified": "2017-02-07T06:42:47.000Z",
            "description": "Pony CC",
            "pattern": "[url:value = 'http://195.22.127.233:80/rec/fre.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c68-d6d8-4822-9a30-4e32950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:48.000Z",
            "modified": "2017-02-07T06:42:48.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.200.52.198']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c69-80d0-4ecb-9a50-4d4f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:49.000Z",
            "modified": "2017-02-07T06:42:49.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.22.127.233']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c6a-0478-4c6a-9227-403a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:50.000Z",
            "modified": "2017-02-07T06:42:50.000Z",
            "pattern": "[domain-name:value = 'kbfvzoboss.bid']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c6a-3940-4317-bd3e-4e5c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:50.000Z",
            "modified": "2017-02-07T06:42:50.000Z",
            "pattern": "[domain-name:value = 'alphastand.win']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c6b-d2f4-4906-ae76-4e1f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:51.000Z",
            "modified": "2017-02-07T06:42:51.000Z",
            "pattern": "[domain-name:value = 'alphastand.top']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996c6c-257c-47ee-a443-4984950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:42:52.000Z",
            "modified": "2017-02-07T06:42:52.000Z",
            "pattern": "[domain-name:value = 'alphastand.trade']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:42:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996ca9-42a4-4d3d-bed6-4fe0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:43:53.000Z",
            "modified": "2017-02-07T06:43:53.000Z",
            "description": "skbmt_fax45.pub",
            "pattern": "[file:hashes.SHA256 = '3cfd8919f095e048e0f24a41c2f132328f0d0efe19581b308d9d2d3ffad40c29']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:43:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996caa-2898-4e2a-b3f3-4aa3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:43:54.000Z",
            "modified": "2017-02-07T06:43:54.000Z",
            "description": "skbmt_faxreport34.pub",
            "pattern": "[file:hashes.SHA256 = '36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:43:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cab-69d4-42c5-8483-42e5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:43:55.000Z",
            "modified": "2017-02-07T06:43:55.000Z",
            "description": "letten.js",
            "pattern": "[file:hashes.SHA256 = '42d0990daba69fa5068a6910d0eac487f3d308ce7e28799a959dace8d84125d7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:43:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cab-b9d4-48e3-84c5-4870950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:43:55.000Z",
            "modified": "2017-02-07T06:43:55.000Z",
            "description": "payload",
            "pattern": "[file:hashes.SHA256 = 'd214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:43:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cac-0e60-42b7-a43f-4814950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:43:56.000Z",
            "modified": "2017-02-07T06:43:56.000Z",
            "description": "payload",
            "pattern": "[file:hashes.SHA256 = 'c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:43:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cf8-bc7c-4413-bff0-4a1d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:12.000Z",
            "modified": "2017-02-07T06:45:12.000Z",
            "description": "payload - Xchecked via VT: c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991",
            "pattern": "[file:hashes.SHA1 = 'b7e499be525b14b6801db2795ed631fbea7ca0bd']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:45:12Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cf9-51d4-4ad8-bc37-45d102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:13.000Z",
            "modified": "2017-02-07T06:45:13.000Z",
            "description": "payload - Xchecked via VT: c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991",
            "pattern": "[file:hashes.MD5 = '05c6208f08108266ab20eedd464fb05f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:45:13Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58996cf9-9a7c-40df-b751-444202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-24T09:16:37.000Z",
            "modified": "2017-02-24T09:16:37.000Z",
            "first_observed": "2017-02-24T09:16:37Z",
            "last_observed": "2017-02-24T09:16:37Z",
            "number_observed": 1,
            "object_refs": [
                "url--58996cf9-9a7c-40df-b751-444202de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58996cf9-9a7c-40df-b751-444202de0b81",
            "value": "https://www.virustotal.com/file/c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991/analysis/1486387683/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cfa-64d4-402e-9ce3-4b7c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:14.000Z",
            "modified": "2017-02-07T06:45:14.000Z",
            "description": "payload - Xchecked via VT: d214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122",
            "pattern": "[file:hashes.SHA1 = 'a76b850aa336dfb5c83c50e83f24a9c844641684']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:45:14Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cfb-6388-411b-a740-41a302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:15.000Z",
            "modified": "2017-02-07T06:45:15.000Z",
            "description": "payload - Xchecked via VT: d214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122",
            "pattern": "[file:hashes.MD5 = '9da66a7cf195036cb90606ef106e2234']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:45:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58996cfc-d058-4024-a0de-47cb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:16.000Z",
            "modified": "2017-02-07T06:45:16.000Z",
            "first_observed": "2017-02-07T06:45:16Z",
            "last_observed": "2017-02-07T06:45:16Z",
            "number_observed": 1,
            "object_refs": [
                "url--58996cfc-d058-4024-a0de-47cb02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58996cfc-d058-4024-a0de-47cb02de0b81",
            "value": "https://www.virustotal.com/file/d214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122/analysis/1486116167/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cfc-e528-414d-b766-44ec02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:16.000Z",
            "modified": "2017-02-07T06:45:16.000Z",
            "description": "skbmt_faxreport34.pub - Xchecked via VT: 36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed",
            "pattern": "[file:hashes.SHA1 = '9eb47a9bd943afe83c8bbc29669702dfa6db8e18']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:45:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cfd-1d94-41fd-9cca-41e102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:17.000Z",
            "modified": "2017-02-07T06:45:17.000Z",
            "description": "skbmt_faxreport34.pub - Xchecked via VT: 36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed",
            "pattern": "[file:hashes.MD5 = '05b8b570dcc6c78f26ede9f6f650097e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:45:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58996cfe-2598-4470-b1cf-4c8702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:18.000Z",
            "modified": "2017-02-07T06:45:18.000Z",
            "first_observed": "2017-02-07T06:45:18Z",
            "last_observed": "2017-02-07T06:45:18Z",
            "number_observed": 1,
            "object_refs": [
                "url--58996cfe-2598-4470-b1cf-4c8702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58996cfe-2598-4470-b1cf-4c8702de0b81",
            "value": "https://www.virustotal.com/file/36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed/analysis/1486424559/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996cff-b21c-4734-8788-41d702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:19.000Z",
            "modified": "2017-02-07T06:45:19.000Z",
            "description": "skbmt_fax45.pub - Xchecked via VT: 3cfd8919f095e048e0f24a41c2f132328f0d0efe19581b308d9d2d3ffad40c29",
            "pattern": "[file:hashes.SHA1 = '73a9c0054b193703960828808249a77840311bdf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:45:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58996d00-f794-49a3-98ac-481c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:20.000Z",
            "modified": "2017-02-07T06:45:20.000Z",
            "description": "skbmt_fax45.pub - Xchecked via VT: 3cfd8919f095e048e0f24a41c2f132328f0d0efe19581b308d9d2d3ffad40c29",
            "pattern": "[file:hashes.MD5 = '6208d08cfb09bae085f2eaeb53c17707']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-07T06:45:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58996d00-630c-4917-a08e-4b8e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-07T06:45:20.000Z",
            "modified": "2017-02-07T06:45:20.000Z",
            "first_observed": "2017-02-07T06:45:20Z",
            "last_observed": "2017-02-07T06:45:20Z",
            "number_observed": 1,
            "object_refs": [
                "url--58996d00-630c-4917-a08e-4b8e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58996d00-630c-4917-a08e-4b8e02de0b81",
            "value": "https://www.virustotal.com/file/3cfd8919f095e048e0f24a41c2f132328f0d0efe19581b308d9d2d3ffad40c29/analysis/1486365572/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}