{
    "type": "bundle",
    "id": "bundle--58ad3fed-cc40-4087-a6f8-3ca5950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:45:05.000Z",
            "modified": "2017-02-22T07:45:05.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--58ad3fed-cc40-4087-a6f8-3ca5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:45:05.000Z",
            "modified": "2017-02-22T07:45:05.000Z",
            "name": "OSINT - Additional Insights on Shamoon2",
            "published": "2017-02-22T07:45:31Z",
            "object_refs": [
                "x-misp-attribute--58ad4004-b954-44b5-8d14-335c950d210f",
                "observed-data--58ad403a-c970-49f4-b47b-5539950d210f",
                "url--58ad403a-c970-49f4-b47b-5539950d210f",
                "indicator--58ad406c-cf78-4ace-ba79-335b950d210f",
                "indicator--58ad406d-d99c-4c2a-bc72-335b950d210f",
                "indicator--58ad406e-0cc0-4da1-af39-335b950d210f",
                "indicator--58ad4086-91f0-4dad-aae5-5536950d210f",
                "indicator--58ad4087-3b64-4bc7-8fd7-5536950d210f",
                "indicator--58ad4088-fb40-4c7f-97ff-5536950d210f",
                "indicator--58ad4098-8b48-4903-886b-5538950d210f",
                "indicator--58ad4099-8c5c-4e46-9cc8-5538950d210f",
                "indicator--58ad409a-49c8-4a8b-b273-5538950d210f",
                "indicator--58ad40bc-d398-4ad9-82e5-3c9f950d210f",
                "indicator--58ad40d4-f374-434d-97ac-366a950d210f",
                "indicator--58ad40e7-b870-456b-9a2b-2cf1950d210f",
                "indicator--58ad40e8-1c08-4c70-98f0-2cf1950d210f",
                "indicator--58ad40e9-db2c-4e10-8743-2cf1950d210f",
                "indicator--58ad4106-950c-4683-8c00-2cf0950d210f",
                "indicator--58ad4117-5f84-4988-b400-2ceb950d210f",
                "indicator--58ad4129-f6a8-4a80-bf76-2ceb950d210f",
                "indicator--58ad4151-8700-49a5-9069-553302de0b81",
                "indicator--58ad4152-e214-4ca0-812b-553302de0b81",
                "observed-data--58ad4153-d088-415d-acd9-553302de0b81",
                "url--58ad4153-d088-415d-acd9-553302de0b81",
                "indicator--58ad4154-50f4-4730-921d-553302de0b81",
                "indicator--58ad4154-3ef4-442d-a894-553302de0b81",
                "observed-data--58ad4155-a0f0-4a87-87e5-553302de0b81",
                "url--58ad4155-a0f0-4a87-87e5-553302de0b81",
                "indicator--58ad4156-babc-4f9b-a085-553302de0b81",
                "indicator--58ad4157-4d74-4ca2-8b01-553302de0b81",
                "observed-data--58ad4158-bdb4-4a6b-884f-553302de0b81",
                "url--58ad4158-bdb4-4a6b-884f-553302de0b81",
                "indicator--58ad4159-6d60-4a11-9d8b-553302de0b81",
                "indicator--58ad415a-0b28-431d-bee6-553302de0b81",
                "observed-data--58ad415b-aadc-4052-a47c-553302de0b81",
                "url--58ad415b-aadc-4052-a47c-553302de0b81",
                "indicator--58ad415c-d784-4b33-b933-553302de0b81",
                "indicator--58ad415c-ae28-4000-9834-553302de0b81",
                "observed-data--58ad415d-8964-4516-8197-553302de0b81",
                "url--58ad415d-8964-4516-8197-553302de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:tool=\"Shamoon\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--58ad4004-b954-44b5-8d14-335c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:45:05.000Z",
            "modified": "2017-02-22T07:45:05.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "IBM analysts recently unveiled a first look at how threat actors may have placed Shamoon2 malware on systems in Saudi Arabia. Researchers showcased a potential malware lifecycle which started with spear phishing and eventually led to the deployment of the disk-wiping malware known as Shamoon. Their research showcased a set of downloaders and domains that could potentially lead to a more extensive malware distribution campaign.\r\n\r\nWhile researching elements in the IBM report, ASERT discovered additional malicious domains, IP addresses, and artifacts. The basic functionality of the new documents and their PowerShell components matched what was previously disclosed. For more information on the overall capabilities of the malware, please review IBM\u00e2\u20ac\u2122s ongoing research.  It is our hope that by providing additional indicators, end-point investigators and network defenders will be able to discover and mitigate more Shamoon2 related compromises."
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58ad403a-c970-49f4-b47b-5539950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:57.000Z",
            "modified": "2017-02-22T07:44:57.000Z",
            "first_observed": "2017-02-22T07:44:57Z",
            "last_observed": "2017-02-22T07:44:57Z",
            "number_observed": 1,
            "object_refs": [
                "url--58ad403a-c970-49f4-b47b-5539950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\"",
                "admiralty-scale:source-reliability=\"b\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58ad403a-c970-49f4-b47b-5539950d210f",
            "value": "https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad406c-cf78-4ace-ba79-335b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5",
            "pattern": "[file:hashes.MD5 = '2a0df97277ddb361cecf8726df6d78ac']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad406d-d99c-4c2a-bc72-335b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5",
            "pattern": "[file:hashes.MD5 = '5e5ea1a67c2538dbc01df28e4ea87472']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad406e-0cc0-4da1-af39-335b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5",
            "pattern": "[file:hashes.MD5 = 'd30b8468d16b631cafe458fd94cc3196']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4086-91f0-4dad-aae5-5536950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.218.120.128']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4087-3b64-4bc7-8fd7-5536950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '69.87.223.26']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4088-fb40-4c7f-97ff-5536950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.254.100.200']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4098-8b48-4903-886b-5538950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[url:value = 'analytics-google.org:69/checkFile.aspx']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4099-8c5c-4e46-9cc8-5538950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[domain-name:value = 'analytics-google.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad409a-49c8-4a8b-b273-5538950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[url:value = '69.87.223.26:8080/p']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad40bc-d398-4ad9-82e5-3c9f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "description": "Pivoting on Passive DNS",
            "pattern": "[file:hashes.MD5 = '83be35956e5d409306a81e88a1dc89fd']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad40d4-f374-434d-97ac-366a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "description": "Pivoting on Passive DNS",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.63.10.99']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad40e7-b870-456b-9a2b-2cf1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "description": "Pivoting on Passive DNS",
            "pattern": "[domain-name:value = 'go-microstf.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad40e8-1c08-4c70-98f0-2cf1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "description": "Pivoting on Passive DNS",
            "pattern": "[url:value = '69.87.223.26:8080/eiloShaegae1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad40e9-db2c-4e10-8743-2cf1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "description": "Pivoting on Passive DNS",
            "pattern": "[url:value = 'go-microstf.com/checkfile.aspx']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4106-950c-4683-8c00-2cf0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[domain-name:value = 'get.adobe.go-microstf.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4117-5f84-4988-b400-2ceb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.238.184.252']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4129-f6a8-4a80-bf76-2ceb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:01.000Z",
            "modified": "2017-02-22T07:44:01.000Z",
            "pattern": "[file:hashes.MD5 = '07d6406036d6e06dc8019e3ade6ee7de']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4151-8700-49a5-9069-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:17.000Z",
            "modified": "2017-02-22T07:44:17.000Z",
            "description": "- Xchecked via VT: 07d6406036d6e06dc8019e3ade6ee7de",
            "pattern": "[file:hashes.SHA256 = 'c21074f340665935e6afe2a972c8d1ab517954e2dd05cc73e5ff0e8df587b99d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4152-e214-4ca0-812b-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:18.000Z",
            "modified": "2017-02-22T07:44:18.000Z",
            "description": "- Xchecked via VT: 07d6406036d6e06dc8019e3ade6ee7de",
            "pattern": "[file:hashes.SHA1 = '25b09cdd135197ccd8981488f38b045000297439']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58ad4153-d088-415d-acd9-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:19.000Z",
            "modified": "2017-02-22T07:44:19.000Z",
            "first_observed": "2017-02-22T07:44:19Z",
            "last_observed": "2017-02-22T07:44:19Z",
            "number_observed": 1,
            "object_refs": [
                "url--58ad4153-d088-415d-acd9-553302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58ad4153-d088-415d-acd9-553302de0b81",
            "value": "https://www.virustotal.com/file/c21074f340665935e6afe2a972c8d1ab517954e2dd05cc73e5ff0e8df587b99d/analysis/1487258163/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4154-50f4-4730-921d-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:20.000Z",
            "modified": "2017-02-22T07:44:20.000Z",
            "description": "Pivoting on Passive DNS - Xchecked via VT: 83be35956e5d409306a81e88a1dc89fd",
            "pattern": "[file:hashes.SHA256 = '924b4615ba6e6ed87fad81ad4c2ae876d10a9b34fb347210a2ec7621b92005cb']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4154-3ef4-442d-a894-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:20.000Z",
            "modified": "2017-02-22T07:44:20.000Z",
            "description": "Pivoting on Passive DNS - Xchecked via VT: 83be35956e5d409306a81e88a1dc89fd",
            "pattern": "[file:hashes.SHA1 = '6b3453b85d4cf7cc9a795ed710440da54ce6788c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58ad4155-a0f0-4a87-87e5-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:21.000Z",
            "modified": "2017-02-22T07:44:21.000Z",
            "first_observed": "2017-02-22T07:44:21Z",
            "last_observed": "2017-02-22T07:44:21Z",
            "number_observed": 1,
            "object_refs": [
                "url--58ad4155-a0f0-4a87-87e5-553302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58ad4155-a0f0-4a87-87e5-553302de0b81",
            "value": "https://www.virustotal.com/file/924b4615ba6e6ed87fad81ad4c2ae876d10a9b34fb347210a2ec7621b92005cb/analysis/1480935772/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4156-babc-4f9b-a085-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:22.000Z",
            "modified": "2017-02-22T07:44:22.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5 - Xchecked via VT: d30b8468d16b631cafe458fd94cc3196",
            "pattern": "[file:hashes.SHA256 = '33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:22Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4157-4d74-4ca2-8b01-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:23.000Z",
            "modified": "2017-02-22T07:44:23.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5 - Xchecked via VT: d30b8468d16b631cafe458fd94cc3196",
            "pattern": "[file:hashes.SHA1 = '2079aa6e288bda7af96a2aa03702a38c29b91479']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58ad4158-bdb4-4a6b-884f-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:24.000Z",
            "modified": "2017-02-22T07:44:24.000Z",
            "first_observed": "2017-02-22T07:44:24Z",
            "last_observed": "2017-02-22T07:44:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--58ad4158-bdb4-4a6b-884f-553302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58ad4158-bdb4-4a6b-884f-553302de0b81",
            "value": "https://www.virustotal.com/file/33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e/analysis/1487293998/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad4159-6d60-4a11-9d8b-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:25.000Z",
            "modified": "2017-02-22T07:44:25.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5 - Xchecked via VT: 5e5ea1a67c2538dbc01df28e4ea87472",
            "pattern": "[file:hashes.SHA256 = '388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad415a-0b28-431d-bee6-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:26.000Z",
            "modified": "2017-02-22T07:44:26.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5 - Xchecked via VT: 5e5ea1a67c2538dbc01df28e4ea87472",
            "pattern": "[file:hashes.SHA1 = '175784206471985ed09f2c7f9d46b79ed6a9a6c6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58ad415b-aadc-4052-a47c-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:27.000Z",
            "modified": "2017-02-22T07:44:27.000Z",
            "first_observed": "2017-02-22T07:44:27Z",
            "last_observed": "2017-02-22T07:44:27Z",
            "number_observed": 1,
            "object_refs": [
                "url--58ad415b-aadc-4052-a47c-553302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58ad415b-aadc-4052-a47c-553302de0b81",
            "value": "https://www.virustotal.com/file/388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d/analysis/1487273714/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad415c-d784-4b33-b933-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:28.000Z",
            "modified": "2017-02-22T07:44:28.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5 - Xchecked via VT: 2a0df97277ddb361cecf8726df6d78ac",
            "pattern": "[file:hashes.SHA256 = '71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58ad415c-ae28-4000-9834-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:28.000Z",
            "modified": "2017-02-22T07:44:28.000Z",
            "description": "In this case, a sample from the IBM report indicated the document author \u00e2\u20ac\u02dcgerry.knight\u00e2\u20ac\u2122 which led us to the following three additional samples. MD5 - Xchecked via VT: 2a0df97277ddb361cecf8726df6d78ac",
            "pattern": "[file:hashes.SHA1 = 'd69fad4a24aade835197d060947719f65528fe84']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-02-22T07:44:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--58ad415d-8964-4516-8197-553302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-02-22T07:44:29.000Z",
            "modified": "2017-02-22T07:44:29.000Z",
            "first_observed": "2017-02-22T07:44:29Z",
            "last_observed": "2017-02-22T07:44:29Z",
            "number_observed": 1,
            "object_refs": [
                "url--58ad415d-8964-4516-8197-553302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--58ad415d-8964-4516-8197-553302de0b81",
            "value": "https://www.virustotal.com/file/71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087/analysis/1487589486/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}