{
    "type": "bundle",
    "id": "bundle--595ffeba-0eac-4c22-953c-c6c402de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-23T06:23:48.000Z",
            "modified": "2017-11-23T06:23:48.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "grouping",
            "spec_version": "2.1",
            "id": "grouping--595ffeba-0eac-4c22-953c-c6c402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-11-23T06:23:48.000Z",
            "modified": "2017-11-23T06:23:48.000Z",
            "name": "OSINT -  Attack on Critical Infrastructure Leverages Template Injection",
            "context": "suspicious-activity",
            "object_refs": [
                "observed-data--595ffec5-ab90-496e-8edf-41bc02de0b81",
                "url--595ffec5-ab90-496e-8edf-41bc02de0b81",
                "x-misp-attribute--595ffed7-8f20-4ae7-839f-419c02de0b81",
                "indicator--595fff2d-3c18-4ae2-98c6-46f902de0b81",
                "indicator--595fff2d-b108-4f78-bd75-437a02de0b81",
                "indicator--595fff2d-e9fc-439a-b74a-417c02de0b81",
                "indicator--595fff43-ea00-4f5c-b80d-478f02de0b81",
                "indicator--595fff43-ef64-46c8-a17f-42e302de0b81",
                "indicator--595fff43-90e4-4bab-896b-41df02de0b81",
                "indicator--595fff5c-5e24-4630-851a-4a4b02de0b81",
                "indicator--595fff5c-89b0-40fc-83ce-498702de0b81",
                "indicator--595fff83-90dc-49bb-adfb-474102de0b81",
                "indicator--595fff83-4b40-4ca6-b436-4b7b02de0b81",
                "observed-data--595fff83-6fa4-4702-8563-40cf02de0b81",
                "url--595fff83-6fa4-4702-8563-40cf02de0b81",
                "indicator--595fff83-099c-4d69-8fd3-4ff202de0b81",
                "indicator--595fff83-6c80-4097-a592-449902de0b81",
                "observed-data--595fff83-28d8-4599-ab7e-411a02de0b81",
                "url--595fff83-28d8-4599-ab7e-411a02de0b81",
                "indicator--595fff83-f46c-47e4-9a96-45d202de0b81",
                "indicator--595fff83-bab4-47da-ae9a-492602de0b81",
                "observed-data--595fff83-9aa8-4361-bf50-42a502de0b81",
                "url--595fff83-9aa8-4361-bf50-42a502de0b81",
                "indicator--595fff83-72e0-4302-9540-494302de0b81",
                "indicator--595fff83-5cac-4e37-8a69-447502de0b81",
                "observed-data--595fff83-fbdc-41f5-b908-47cf02de0b81",
                "url--595fff83-fbdc-41f5-b908-47cf02de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "certsi:critical-sector=\"energy\"",
                "osint:source-type=\"blog-post\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595ffec5-ab90-496e-8edf-41bc02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:48.000Z",
            "modified": "2017-07-07T21:39:48.000Z",
            "first_observed": "2017-07-07T21:39:48Z",
            "last_observed": "2017-07-07T21:39:48Z",
            "number_observed": 1,
            "object_refs": [
                "url--595ffec5-ab90-496e-8edf-41bc02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595ffec5-ab90-496e-8edf-41bc02de0b81",
            "value": "http://blog.talosintelligence.com/2017/07/template-injection.html"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--595ffed7-8f20-4ae7-839f-419c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:48.000Z",
            "modified": "2017-07-07T21:39:48.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "Attackers are continually trying to find new ways to target users with malware sent via email. Talos has identified an email-based attack targeting the energy sector, including nuclear power, that puts a new spin on the classic word document attachment phish. Typically, malicious Word documents that are sent as attachments to phishing emails will themselves contain a script or macro that executes malicious code. In this case, there is no malicious code in the attachment itself. The attachment instead tries to download a template file over an SMB connection so that the user's credentials can be silently harvested. In addition, this template file could also potentially be used to download other malicious payloads to the victim's computer."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff2d-3c18-4ae2-98c6-46f902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Related IP Address",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '184.154.150.66']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff2d-b108-4f78-bd75-437a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Related IP Address",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.153.58.45']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff2d-e9fc-439a-b74a-417c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Related IP Address",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.8.193.206']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff43-ea00-4f5c-b80d-478f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx",
            "pattern": "[file:hashes.SHA256 = 'b02508baf8567e62f3c0fd14833c82fb24e8ba4f0dc84aeb7690d9ea83385baa']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff43-ef64-46c8-a17f-42e302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx",
            "pattern": "[file:hashes.SHA256 = '3d6eadf0f0b3fb7f996e6eb3d540945c2d736822df1a37dcd0e25371fa2d75a0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff43-90e4-4bab-896b-41df02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx",
            "pattern": "[file:hashes.SHA256 = 'ac6c1df3895af63b864bb33bf30cb31059e247443ddb8f23517849362ec94f08']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff5c-5e24-4630-851a-4a4b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "pattern": "[file:name = 'Report03-23-2017.docx']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff5c-89b0-40fc-83ce-498702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Report03-23-2017.docx",
            "pattern": "[file:hashes.SHA256 = '93cd6696e150caf6106e6066b58107372dcf43377bf4420c848007c10ff80bc9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff83-90dc-49bb-adfb-474102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Report03-23-2017.docx - Xchecked via VT: 93cd6696e150caf6106e6066b58107372dcf43377bf4420c848007c10ff80bc9",
            "pattern": "[file:hashes.SHA1 = '67175f1de3a911958e4c075336160462df3ea7b1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff83-4b40-4ca6-b436-4b7b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Report03-23-2017.docx - Xchecked via VT: 93cd6696e150caf6106e6066b58107372dcf43377bf4420c848007c10ff80bc9",
            "pattern": "[file:hashes.MD5 = '3c432a21cfd05f976af8c47a007928f7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595fff83-6fa4-4702-8563-40cf02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "first_observed": "2017-07-07T21:39:15Z",
            "last_observed": "2017-07-07T21:39:15Z",
            "number_observed": 1,
            "object_refs": [
                "url--595fff83-6fa4-4702-8563-40cf02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595fff83-6fa4-4702-8563-40cf02de0b81",
            "value": "https://www.virustotal.com/file/93cd6696e150caf6106e6066b58107372dcf43377bf4420c848007c10ff80bc9/analysis/1499449645/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff83-099c-4d69-8fd3-4ff202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx - Xchecked via VT: ac6c1df3895af63b864bb33bf30cb31059e247443ddb8f23517849362ec94f08",
            "pattern": "[file:hashes.SHA1 = '2872dcdf108563d16b6cf2ed383626861fc541d2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff83-6c80-4097-a592-449902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx - Xchecked via VT: ac6c1df3895af63b864bb33bf30cb31059e247443ddb8f23517849362ec94f08",
            "pattern": "[file:hashes.MD5 = '722154a36f32ba10e98020a8ad758a7a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595fff83-28d8-4599-ab7e-411a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "first_observed": "2017-07-07T21:39:15Z",
            "last_observed": "2017-07-07T21:39:15Z",
            "number_observed": 1,
            "object_refs": [
                "url--595fff83-28d8-4599-ab7e-411a02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595fff83-28d8-4599-ab7e-411a02de0b81",
            "value": "https://www.virustotal.com/file/ac6c1df3895af63b864bb33bf30cb31059e247443ddb8f23517849362ec94f08/analysis/1499451984/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff83-f46c-47e4-9a96-45d202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx - Xchecked via VT: 3d6eadf0f0b3fb7f996e6eb3d540945c2d736822df1a37dcd0e25371fa2d75a0",
            "pattern": "[file:hashes.SHA1 = '421eecdfe4f6987bb9ff7a6d65827563e53eafbb']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff83-bab4-47da-ae9a-492602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx - Xchecked via VT: 3d6eadf0f0b3fb7f996e6eb3d540945c2d736822df1a37dcd0e25371fa2d75a0",
            "pattern": "[file:hashes.MD5 = '4e4e9aac289f1c55e50227e2de66463b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595fff83-9aa8-4361-bf50-42a502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "first_observed": "2017-07-07T21:39:15Z",
            "last_observed": "2017-07-07T21:39:15Z",
            "number_observed": 1,
            "object_refs": [
                "url--595fff83-9aa8-4361-bf50-42a502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595fff83-9aa8-4361-bf50-42a502de0b81",
            "value": "https://www.virustotal.com/file/3d6eadf0f0b3fb7f996e6eb3d540945c2d736822df1a37dcd0e25371fa2d75a0/analysis/1499463315/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff83-72e0-4302-9540-494302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx - Xchecked via VT: b02508baf8567e62f3c0fd14833c82fb24e8ba4f0dc84aeb7690d9ea83385baa",
            "pattern": "[file:hashes.SHA1 = '5df2cb4b3a29adad4ba0a8f0b7eab5b6ae633977']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595fff83-5cac-4e37-8a69-447502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "description": "Controls Engineer.docx - Xchecked via VT: b02508baf8567e62f3c0fd14833c82fb24e8ba4f0dc84aeb7690d9ea83385baa",
            "pattern": "[file:hashes.MD5 = '4909db36f71106379832c8ca57ba5be8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-07T21:39:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595fff83-fbdc-41f5-b908-47cf02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-07T21:39:15.000Z",
            "modified": "2017-07-07T21:39:15.000Z",
            "first_observed": "2017-07-07T21:39:15Z",
            "last_observed": "2017-07-07T21:39:15Z",
            "number_observed": 1,
            "object_refs": [
                "url--595fff83-fbdc-41f5-b908-47cf02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595fff83-fbdc-41f5-b908-47cf02de0b81",
            "value": "https://www.virustotal.com/file/b02508baf8567e62f3c0fd14833c82fb24e8ba4f0dc84aeb7690d9ea83385baa/analysis/1499445440/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}