{
    "type": "bundle",
    "id": "bundle--5cd499b7-5584-4d95-864b-d56f950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-22T08:38:39.000Z",
            "modified": "2019-05-22T08:38:39.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "grouping",
            "spec_version": "2.1",
            "id": "grouping--5cd499b7-5584-4d95-864b-d56f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-22T08:38:39.000Z",
            "modified": "2019-05-22T08:38:39.000Z",
            "name": "OSINT - Attacks Exploiting Sharepoint CVE-2019-0604",
            "context": "suspicious-activity",
            "object_refs": [
                "indicator--5cd499ee-7528-4e01-aa5e-d56e950d210f",
                "indicator--5cd499ef-1030-43e0-a68d-d56e950d210f",
                "vulnerability--5cd499ef-010c-4a5d-9651-d56e950d210f",
                "indicator--5cd499ef-2f3c-4b66-b04c-d56e950d210f",
                "indicator--5cd499ef-8628-440e-ad75-d56e950d210f",
                "indicator--5cd499ef-9890-4768-b187-d56e950d210f",
                "indicator--5cd499ef-c598-4e87-ad5e-d56e950d210f",
                "indicator--5cd499ef-9654-4a61-9d18-d56e950d210f",
                "indicator--5cd499ef-3d64-4c66-bd11-d56e950d210f",
                "indicator--5cd499ef-6a48-4090-b7b9-d56e950d210f",
                "indicator--5cd499ef-650c-43da-88db-d56e950d210f",
                "indicator--5cd499ef-169c-42b5-9cd5-d56e950d210f",
                "indicator--5cd499ef-8230-4cfc-af74-d56e950d210f",
                "indicator--5cd499ef-f948-41d2-ba99-d56e950d210f",
                "indicator--5cd499ef-9004-4e76-8feb-d56e950d210f",
                "indicator--5cd499ef-766c-45ad-8c52-d56e950d210f",
                "indicator--5cd499ef-4510-4da0-b0db-d56e950d210f",
                "indicator--5cd499ef-f65c-4426-97c8-d56e950d210f",
                "indicator--5cd499ef-b020-4f85-98a7-d56e950d210f",
                "observed-data--5cd49a89-1424-4418-93a9-47cf950d210f",
                "url--5cd49a89-1424-4418-93a9-47cf950d210f",
                "observed-data--5cd49a89-f5c0-4980-bfa0-4068950d210f",
                "url--5cd49a89-f5c0-4980-bfa0-4068950d210f",
                "observed-data--5cd49a89-adf4-4ea8-a16a-4713950d210f",
                "url--5cd49a89-adf4-4ea8-a16a-4713950d210f",
                "observed-data--5cd49a9a-6b20-4905-99ed-f9fa950d210f",
                "url--5cd49a9a-6b20-4905-99ed-f9fa950d210f",
                "indicator--5cd91b97-f1e4-431f-8ba7-56a6950d210f",
                "indicator--5cd917a1-4898-4142-a317-b753950d210f",
                "indicator--2e08e347-2a12-4a0f-b4f0-5fd161d71eb0",
                "x-misp-object--2ee4ba30-9841-4fbf-acd0-286bac9c6b35",
                "indicator--23a2b779-9b25-4053-8780-5dc66bead631",
                "x-misp-object--f804ed11-1310-477c-ba77-83745ec66f57",
                "relationship--1a3a8428-b3fb-44fd-af69-9007da1f18c3",
                "relationship--b0c22ae5-0841-4d7b-b40f-02aa3b5685ec"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\"",
                "osint:certainty=\"50\"",
                "misp-galaxy:mitre-malware=\"China Chopper\"",
                "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ee-7528-4e01-aa5e-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:50.000Z",
            "modified": "2019-05-09T21:21:50.000Z",
            "pattern": "[domain-name:value = 'vision2030.tk']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-1030-43e0-a68d-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[url:value = 'https://vision2030.tk/static/googleupdate.xn--txt-9o0a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "vulnerability",
            "spec_version": "2.1",
            "id": "vulnerability--5cd499ef-010c-4a5d-9651-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "name": "CVE-2019-0604",
            "labels": [
                "misp:type=\"vulnerability\"",
                "misp:category=\"External analysis\""
            ],
            "external_references": [
                {
                    "source_name": "cve",
                    "external_id": "CVE-2019-0604"
                }
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-2f3c-4b66-b04c-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA256 = 'c63f425d96365d906604b1529611eefe5524432545a7977ebe2ac8c79f90ad7e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-8628-440e-ad75-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.MD5 = '198ee041e8f3eb12a19bc321f86ccb88']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-9890-4768-b187-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA1 = 'ee583451c832b07d8f2b4d6b8dd36ccb280ff421']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-c598-4e87-ad5e-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[domain-name:value = 'vision2030.cf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-9654-4a61-9d18-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA256 = '05108ac3c3d708977f2d679bfa6d2eaf63b371e66428018a68efce4b6a45b4b4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-3d64-4c66-bd11-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA256 = 'b560c3b9b672f42a005bdeae79eb91dfb0dec8dc04bea51f38731692bc995688']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-6a48-4090-b7b9-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA256 = '7d6812947e7eafa8a4cce84b531f8077f7434dbed4ccdaca64225d1b6a0e8604']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-650c-43da-88db-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.MD5 = '0eebeef32a8f676a1717f134f114c8bd']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-169c-42b5-9cd5-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.MD5 = 'b814532d73c7e5ffd1a2533adc6cfcf8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-8230-4cfc-af74-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.MD5 = '708544104809ef2776ddc56e04d27ab1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-f948-41d2-ba99-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA1 = 'f0fb0f7553390f203669e53abc16b15e729e5c6f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-9004-4e76-8feb-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA1 = 'dc8e7b7de41cac9ded920c41b272c885e1aec279']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-766c-45ad-8c52-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA1 = '4c3b262b4134366ad0a67b1a2d6378da428d712b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-4510-4da0-b0db-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA1 = 'fafe395967d2ec8022c2c91815b231ee08143031']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-f65c-4426-97c8-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA1 = 'ce1ef0f88530bb51de8d20c83252fa0f0ff55bc7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd499ef-b020-4f85-98a7-d56e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:21:51.000Z",
            "modified": "2019-05-09T21:21:51.000Z",
            "pattern": "[file:hashes.SHA256 = '2e4b7c022329e5c21e47d55e8916f6af852aabbbd1798f9e16985f22a8056646']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:21:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5cd49a89-1424-4418-93a9-47cf950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:24:25.000Z",
            "modified": "2019-05-09T21:24:25.000Z",
            "first_observed": "2019-05-09T21:24:25Z",
            "last_observed": "2019-05-09T21:24:25Z",
            "number_observed": 1,
            "object_refs": [
                "url--5cd49a89-1424-4418-93a9-47cf950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5cd49a89-1424-4418-93a9-47cf950d210f",
            "value": "https://cyber.gc.ca/fr/avis/maliciel-china-chopper-affectant-les-serveurs-sharepoint"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5cd49a89-f5c0-4980-bfa0-4068950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:24:25.000Z",
            "modified": "2019-05-09T21:24:25.000Z",
            "first_observed": "2019-05-09T21:24:25Z",
            "last_observed": "2019-05-09T21:24:25Z",
            "number_observed": 1,
            "object_refs": [
                "url--5cd49a89-f5c0-4980-bfa0-4068950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5cd49a89-f5c0-4980-bfa0-4068950d210f",
            "value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5cd49a89-adf4-4ea8-a16a-4713950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:24:25.000Z",
            "modified": "2019-05-09T21:24:25.000Z",
            "first_observed": "2019-05-09T21:24:25Z",
            "last_observed": "2019-05-09T21:24:25Z",
            "number_observed": 1,
            "object_refs": [
                "url--5cd49a89-adf4-4ea8-a16a-4713950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5cd49a89-adf4-4ea8-a16a-4713950d210f",
            "value": "https://pastebin.com/bUFPhucz"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5cd49a9a-6b20-4905-99ed-f9fa950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:24:42.000Z",
            "modified": "2019-05-09T21:24:42.000Z",
            "first_observed": "2019-05-09T21:24:42Z",
            "last_observed": "2019-05-09T21:24:42Z",
            "number_observed": 1,
            "object_refs": [
                "url--5cd49a9a-6b20-4905-99ed-f9fa950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5cd49a9a-6b20-4905-99ed-f9fa950d210f",
            "value": "https://otx.alienvault.com/pulse/5cd3f89df12b501c477a6fba"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd91b97-f1e4-431f-8ba7-56a6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-13T07:24:07.000Z",
            "modified": "2019-05-13T07:24:07.000Z",
            "pattern": "[rule alienvault_webshells_asp : Webshells   {   \r\n       meta:   \r\n           author = \"AlienVault Labs\"   \r\n           info = \"Generic detections for possible PHP Web-Shells\"   \r\n       strings:   \r\n           $sa = \"<%eval request(\" nocase wide ascii   \r\n           $sb = \"Server.CreateObject(\\\"WSCRIPT.SHELL\\\")\" nocase wide ascii   \r\n           $sc = \"Eval(Request(\" nocase wide ascii   \r\n           $sd = \"ExecuteGlobal(StrReverse\" nocase wide ascii   \r\n           $se = \"<%eval(Request.Item[\" nocase wide ascii         \r\n       condition:   \r\n           any of them\r\n}]",
            "pattern_type": "yara",
            "pattern_version": "2.1",
            "valid_from": "2019-05-13T07:24:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"yara\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5cd917a1-4898-4142-a317-b753950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-13T07:07:13.000Z",
            "modified": "2019-05-13T07:07:13.000Z",
            "pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '114.25.219.100']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-13T07:07:13Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-src\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2e08e347-2a12-4a0f-b4f0-5fd161d71eb0",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:22:35.000Z",
            "modified": "2019-05-09T21:22:35.000Z",
            "pattern": "[file:hashes.MD5 = 'b814532d73c7e5ffd1a2533adc6cfcf8' AND file:hashes.SHA1 = 'dc8e7b7de41cac9ded920c41b272c885e1aec279' AND file:hashes.SHA256 = '05108ac3c3d708977f2d679bfa6d2eaf63b371e66428018a68efce4b6a45b4b4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:22:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--2ee4ba30-9841-4fbf-acd0-286bac9c6b35",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:22:35.000Z",
            "modified": "2019-05-09T21:22:35.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-05-09 20:57:27",
                    "category": "Other",
                    "uuid": "c2763120-8f7b-49cb-b159-6787c01b99bb"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/05108ac3c3d708977f2d679bfa6d2eaf63b371e66428018a68efce4b6a45b4b4/analysis/1557435447/",
                    "category": "Payload delivery",
                    "uuid": "939cef4e-14e2-4e83-8544-63aa27e6deef"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "5/59",
                    "category": "Payload delivery",
                    "uuid": "c84c63bd-e491-45e8-aa8c-7340da2e7cde"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--23a2b779-9b25-4053-8780-5dc66bead631",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:22:36.000Z",
            "modified": "2019-05-09T21:22:36.000Z",
            "pattern": "[file:hashes.MD5 = '198ee041e8f3eb12a19bc321f86ccb88' AND file:hashes.SHA1 = 'ee583451c832b07d8f2b4d6b8dd36ccb280ff421' AND file:hashes.SHA256 = 'c63f425d96365d906604b1529611eefe5524432545a7977ebe2ac8c79f90ad7e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-05-09T21:22:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--f804ed11-1310-477c-ba77-83745ec66f57",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-09T21:22:37.000Z",
            "modified": "2019-05-09T21:22:37.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-04-09 09:15:29",
                    "category": "Other",
                    "uuid": "2fa0e40a-0a4d-4b3c-a36b-64e661e70c2d"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/c63f425d96365d906604b1529611eefe5524432545a7977ebe2ac8c79f90ad7e/analysis/1554801329/",
                    "category": "Payload delivery",
                    "uuid": "12c3d385-2e80-4a3f-905e-0e581e972522"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "13/72",
                    "category": "Payload delivery",
                    "uuid": "d8ba684b-7f6f-4c9c-8b11-b7511de95177"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1a3a8428-b3fb-44fd-af69-9007da1f18c3",
            "created": "2019-05-09T21:22:37.000Z",
            "modified": "2019-05-09T21:22:37.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--2e08e347-2a12-4a0f-b4f0-5fd161d71eb0",
            "target_ref": "x-misp-object--2ee4ba30-9841-4fbf-acd0-286bac9c6b35"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b0c22ae5-0841-4d7b-b40f-02aa3b5685ec",
            "created": "2019-05-09T21:22:37.000Z",
            "modified": "2019-05-09T21:22:37.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--23a2b779-9b25-4053-8780-5dc66bead631",
            "target_ref": "x-misp-object--f804ed11-1310-477c-ba77-83745ec66f57"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}