{
    "type": "bundle",
    "id": "bundle--571a87f2-13e0-4396-83e5-4780950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:49.000Z",
            "modified": "2016-04-22T20:25:49.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--571a87f2-13e0-4396-83e5-4780950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:49.000Z",
            "modified": "2016-04-22T20:25:49.000Z",
            "name": "OSINT - New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists",
            "published": "2016-04-22T20:26:23Z",
            "object_refs": [
                "observed-data--571a8816-0ed8-4575-a709-4c0a950d210f",
                "url--571a8816-0ed8-4575-a709-4c0a950d210f",
                "x-misp-attribute--571a8824-8a5c-44b9-9f31-4530950d210f",
                "vulnerability--571a883e-bcdc-4fee-9ea8-4c53950d210f",
                "indicator--571a8856-6624-497d-a423-4aa2950d210f",
                "indicator--571a8857-814c-4806-973b-4cad950d210f",
                "indicator--571a8857-2c0c-4800-b4db-4a24950d210f",
                "indicator--571a886d-05c8-4a7a-aa10-4157950d210f",
                "indicator--571a886e-0314-4f2b-aca3-4845950d210f",
                "indicator--571a887c-6cb8-4016-9961-48e2950d210f",
                "indicator--571a887d-f61c-48c1-becf-47f8950d210f",
                "observed-data--571a88af-94b4-434b-b71a-4d46950d210f",
                "file--571a88af-94b4-434b-b71a-4d46950d210f",
                "observed-data--571a88af-3544-4294-928e-40c3950d210f",
                "file--571a88af-3544-4294-928e-40c3950d210f",
                "observed-data--571a88b0-719c-412f-9467-4cb0950d210f",
                "file--571a88b0-719c-412f-9467-4cb0950d210f",
                "observed-data--571a88b0-fc5c-4f6c-a9a9-490a950d210f",
                "file--571a88b0-fc5c-4f6c-a9a9-490a950d210f",
                "observed-data--571a88cd-6d50-45e8-8ce0-4af802de0b81",
                "file--571a88cd-6d50-45e8-8ce0-4af802de0b81",
                "observed-data--571a88cd-d5e8-47cd-babc-464402de0b81",
                "file--571a88cd-d5e8-47cd-babc-464402de0b81",
                "observed-data--571a88ce-cec0-41e5-8deb-458d02de0b81",
                "url--571a88ce-cec0-41e5-8deb-458d02de0b81",
                "observed-data--571a88ce-d5fc-4cb3-84d2-446b02de0b81",
                "file--571a88ce-d5fc-4cb3-84d2-446b02de0b81",
                "observed-data--571a88ce-3634-407f-b0f9-432302de0b81",
                "file--571a88ce-3634-407f-b0f9-432302de0b81",
                "observed-data--571a88ce-274c-4e90-a2e7-490602de0b81",
                "url--571a88ce-274c-4e90-a2e7-490602de0b81",
                "indicator--571a88cf-6db4-4145-9579-47ba02de0b81",
                "indicator--571a88cf-9f4c-4a9b-bb6d-4c1202de0b81",
                "observed-data--571a88cf-2694-462c-a1fd-497802de0b81",
                "url--571a88cf-2694-462c-a1fd-497802de0b81",
                "indicator--571a88d0-28b4-486e-a523-421502de0b81",
                "indicator--571a88d0-71cc-4ed6-90e6-4dc802de0b81",
                "observed-data--571a88d1-5970-43ee-a4fd-4a2e02de0b81",
                "url--571a88d1-5970-43ee-a4fd-4a2e02de0b81",
                "indicator--571a88d1-0264-4cec-a6ae-465a02de0b81",
                "indicator--571a88d1-9650-43b7-976c-4cd502de0b81",
                "observed-data--571a88d2-28a0-4dda-93fb-449802de0b81",
                "url--571a88d2-28a0-4dda-93fb-449802de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a8816-0ed8-4575-a709-4c0a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:22:46.000Z",
            "modified": "2016-04-22T20:22:46.000Z",
            "first_observed": "2016-04-22T20:22:46Z",
            "last_observed": "2016-04-22T20:22:46Z",
            "number_observed": 1,
            "object_refs": [
                "url--571a8816-0ed8-4575-a709-4c0a950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--571a8816-0ed8-4575-a709-4c0a950d210f",
            "value": "http://researchcenter.paloaltonetworks.com/2016/04/unit42-new-poison-ivy-rat-variant-targets-hong-kong-pro-democracy-activists/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--571a8824-8a5c-44b9-9f31-4530950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:23:00.000Z",
            "modified": "2016-04-22T20:23:00.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "Malware writers have always sought to develop feature-rich, easy to use tools that are also somewhat hard to detect via both host- and network-based detection systems.  For many years, one of the go-to families of malware used by both less-skilled and advanced actors has been the Poison Ivy (aka PIVY) RAT. Poison Ivy has a convenient graphical user interface (GUI) for managing compromised hosts and provides easy access to a rich suite of post-compromise tools. It is no surprise it\u00e2\u20ac\u2122s now being used against pro-democracy organizations and supporters in Hong Kong that have long been a target of advanced attack campaigns."
        },
        {
            "type": "vulnerability",
            "spec_version": "2.1",
            "id": "vulnerability--571a883e-bcdc-4fee-9ea8-4c53950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:23:26.000Z",
            "modified": "2016-04-22T20:23:26.000Z",
            "name": "CVE-2015-2545",
            "labels": [
                "misp:type=\"vulnerability\"",
                "misp:category=\"Payload delivery\""
            ],
            "external_references": [
                {
                    "source_name": "cve",
                    "external_id": "CVE-2015-2545"
                }
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a8856-6624-497d-a423-4aa2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:23:50.000Z",
            "modified": "2016-04-22T20:23:50.000Z",
            "description": "Weaponized EPS Docs",
            "pattern": "[file:hashes.SHA256 = '13bdc52c2066e4b02bae5cc42bc9ec7dfcc1f19fbf35007aea93e9d62e3e3fd0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:23:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a8857-814c-4806-973b-4cad950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:23:51.000Z",
            "modified": "2016-04-22T20:23:51.000Z",
            "description": "Weaponized EPS Docs",
            "pattern": "[file:hashes.SHA256 = '4d38d4ee5b625e09b61a253a52eb29fcf9c506ee9329b3a90a0b3911e59174f2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:23:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a8857-2c0c-4800-b4db-4a24950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:23:51.000Z",
            "modified": "2016-04-22T20:23:51.000Z",
            "description": "Weaponized EPS Docs",
            "pattern": "[file:hashes.SHA256 = '9c6dc1c2ea5b2370b58b0ac11fde8287cd49aee3e089dbdf589cc8d51c1f7a9e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:23:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a886d-05c8-4a7a-aa10-4157950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:24:13.000Z",
            "modified": "2016-04-22T20:24:13.000Z",
            "description": "Poison Ivy shellcode files",
            "pattern": "[file:hashes.SHA256 = 'c707716afde80a41ce6eb7d6d93da2ea5ce00aa9e36944c20657d062330e13d8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:24:13Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a886e-0314-4f2b-aca3-4845950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:24:14.000Z",
            "modified": "2016-04-22T20:24:14.000Z",
            "description": "Poison Ivy shellcode files",
            "pattern": "[file:hashes.SHA256 = '0414bd2186d9748d129f66ff16e2c15df41bf173dc8e3c9cbd450571c99b3403']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:24:14Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a887c-6cb8-4016-9961-48e2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:24:28.000Z",
            "modified": "2016-04-22T20:24:28.000Z",
            "description": "C2 Domains",
            "pattern": "[domain-name:value = 'sent.leeh0m.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:24:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a887d-f61c-48c1-becf-47f8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:24:29.000Z",
            "modified": "2016-04-22T20:24:29.000Z",
            "description": "C2 Domains",
            "pattern": "[domain-name:value = 'found.leeh0m.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:24:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88af-94b4-434b-b71a-4d46950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:19.000Z",
            "modified": "2016-04-22T20:25:19.000Z",
            "first_observed": "2016-04-22T20:25:19Z",
            "last_observed": "2016-04-22T20:25:19Z",
            "number_observed": 1,
            "object_refs": [
                "file--571a88af-94b4-434b-b71a-4d46950d210f"
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--571a88af-94b4-434b-b71a-4d46950d210f",
            "name": "RasTls.exe"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88af-3544-4294-928e-40c3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:19.000Z",
            "modified": "2016-04-22T20:25:19.000Z",
            "first_observed": "2016-04-22T20:25:19Z",
            "last_observed": "2016-04-22T20:25:19Z",
            "number_observed": 1,
            "object_refs": [
                "file--571a88af-3544-4294-928e-40c3950d210f"
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--571a88af-3544-4294-928e-40c3950d210f",
            "hashes": {
                "SHA-256": "0191cb2a2624b532b2dffef6690824f7f32ea00730e5aef5d86c4bad6edf9ead"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88b0-719c-412f-9467-4cb0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:20.000Z",
            "modified": "2016-04-22T20:25:20.000Z",
            "first_observed": "2016-04-22T20:25:20Z",
            "last_observed": "2016-04-22T20:25:20Z",
            "number_observed": 1,
            "object_refs": [
                "file--571a88b0-719c-412f-9467-4cb0950d210f"
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--571a88b0-719c-412f-9467-4cb0950d210f",
            "name": "ssMUIDLL.dll"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88b0-fc5c-4f6c-a9a9-490a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:20.000Z",
            "modified": "2016-04-22T20:25:20.000Z",
            "first_observed": "2016-04-22T20:25:20Z",
            "last_observed": "2016-04-22T20:25:20Z",
            "number_observed": 1,
            "object_refs": [
                "file--571a88b0-fc5c-4f6c-a9a9-490a950d210f"
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--571a88b0-fc5c-4f6c-a9a9-490a950d210f",
            "hashes": {
                "SHA-256": "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88cd-6d50-45e8-8ce0-4af802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:49.000Z",
            "modified": "2016-04-22T20:25:49.000Z",
            "first_observed": "2016-04-22T20:25:49Z",
            "last_observed": "2016-04-22T20:25:49Z",
            "number_observed": 1,
            "object_refs": [
                "file--571a88cd-6d50-45e8-8ce0-4af802de0b81"
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--571a88cd-6d50-45e8-8ce0-4af802de0b81",
            "hashes": {
                "SHA-1": "e9ccf4e139bbbd114b67cc3cee260d1cb638c9d0"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88cd-d5e8-47cd-babc-464402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:49.000Z",
            "modified": "2016-04-22T20:25:49.000Z",
            "first_observed": "2016-04-22T20:25:49Z",
            "last_observed": "2016-04-22T20:25:49Z",
            "number_observed": 1,
            "object_refs": [
                "file--571a88cd-d5e8-47cd-babc-464402de0b81"
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--571a88cd-d5e8-47cd-babc-464402de0b81",
            "hashes": {
                "MD5": "2fecb7d30ac753db36973a72048b4173"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88ce-cec0-41e5-8deb-458d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:49.000Z",
            "modified": "2016-04-22T20:25:49.000Z",
            "first_observed": "2016-04-22T20:25:49Z",
            "last_observed": "2016-04-22T20:25:49Z",
            "number_observed": 1,
            "object_refs": [
                "url--571a88ce-cec0-41e5-8deb-458d02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--571a88ce-cec0-41e5-8deb-458d02de0b81",
            "value": "https://www.virustotal.com/file/7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4/analysis/1459770131/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88ce-d5fc-4cb3-84d2-446b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:50.000Z",
            "modified": "2016-04-22T20:25:50.000Z",
            "first_observed": "2016-04-22T20:25:50Z",
            "last_observed": "2016-04-22T20:25:50Z",
            "number_observed": 1,
            "object_refs": [
                "file--571a88ce-d5fc-4cb3-84d2-446b02de0b81"
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--571a88ce-d5fc-4cb3-84d2-446b02de0b81",
            "hashes": {
                "SHA-1": "11d8bbd1a76e2e9ad43539480fed29bb07ef0a4d"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88ce-3634-407f-b0f9-432302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:50.000Z",
            "modified": "2016-04-22T20:25:50.000Z",
            "first_observed": "2016-04-22T20:25:50Z",
            "last_observed": "2016-04-22T20:25:50Z",
            "number_observed": 1,
            "object_refs": [
                "file--571a88ce-3634-407f-b0f9-432302de0b81"
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--571a88ce-3634-407f-b0f9-432302de0b81",
            "hashes": {
                "MD5": "8ddc664747b4c424c4ed576362134f3c"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88ce-274c-4e90-a2e7-490602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:50.000Z",
            "modified": "2016-04-22T20:25:50.000Z",
            "first_observed": "2016-04-22T20:25:50Z",
            "last_observed": "2016-04-22T20:25:50Z",
            "number_observed": 1,
            "object_refs": [
                "url--571a88ce-274c-4e90-a2e7-490602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--571a88ce-274c-4e90-a2e7-490602de0b81",
            "value": "https://www.virustotal.com/file/0191cb2a2624b532b2dffef6690824f7f32ea00730e5aef5d86c4bad6edf9ead/analysis/1461310950/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a88cf-6db4-4145-9579-47ba02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:51.000Z",
            "modified": "2016-04-22T20:25:51.000Z",
            "description": "Weaponized EPS Docs - Xchecked via VT: 9c6dc1c2ea5b2370b58b0ac11fde8287cd49aee3e089dbdf589cc8d51c1f7a9e",
            "pattern": "[file:hashes.SHA1 = '0e06e99c8f1c8882fd1f35793c50213f1905494f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:25:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a88cf-9f4c-4a9b-bb6d-4c1202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:51.000Z",
            "modified": "2016-04-22T20:25:51.000Z",
            "description": "Weaponized EPS Docs - Xchecked via VT: 9c6dc1c2ea5b2370b58b0ac11fde8287cd49aee3e089dbdf589cc8d51c1f7a9e",
            "pattern": "[file:hashes.MD5 = '50064d33625970a8145add7e3e242fe3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:25:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88cf-2694-462c-a1fd-497802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:51.000Z",
            "modified": "2016-04-22T20:25:51.000Z",
            "first_observed": "2016-04-22T20:25:51Z",
            "last_observed": "2016-04-22T20:25:51Z",
            "number_observed": 1,
            "object_refs": [
                "url--571a88cf-2694-462c-a1fd-497802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--571a88cf-2694-462c-a1fd-497802de0b81",
            "value": "https://www.virustotal.com/file/9c6dc1c2ea5b2370b58b0ac11fde8287cd49aee3e089dbdf589cc8d51c1f7a9e/analysis/1461331258/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a88d0-28b4-486e-a523-421502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:52.000Z",
            "modified": "2016-04-22T20:25:52.000Z",
            "description": "Weaponized EPS Docs - Xchecked via VT: 4d38d4ee5b625e09b61a253a52eb29fcf9c506ee9329b3a90a0b3911e59174f2",
            "pattern": "[file:hashes.SHA1 = 'c3ed7bd750192bd43e7fb30d515a109850fb6342']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:25:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a88d0-71cc-4ed6-90e6-4dc802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:52.000Z",
            "modified": "2016-04-22T20:25:52.000Z",
            "description": "Weaponized EPS Docs - Xchecked via VT: 4d38d4ee5b625e09b61a253a52eb29fcf9c506ee9329b3a90a0b3911e59174f2",
            "pattern": "[file:hashes.MD5 = 'e1b4a5a565fdfcec52346d3b6063c587']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:25:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88d1-5970-43ee-a4fd-4a2e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:53.000Z",
            "modified": "2016-04-22T20:25:53.000Z",
            "first_observed": "2016-04-22T20:25:53Z",
            "last_observed": "2016-04-22T20:25:53Z",
            "number_observed": 1,
            "object_refs": [
                "url--571a88d1-5970-43ee-a4fd-4a2e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--571a88d1-5970-43ee-a4fd-4a2e02de0b81",
            "value": "https://www.virustotal.com/file/4d38d4ee5b625e09b61a253a52eb29fcf9c506ee9329b3a90a0b3911e59174f2/analysis/1461331255/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a88d1-0264-4cec-a6ae-465a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:53.000Z",
            "modified": "2016-04-22T20:25:53.000Z",
            "description": "Weaponized EPS Docs - Xchecked via VT: 13bdc52c2066e4b02bae5cc42bc9ec7dfcc1f19fbf35007aea93e9d62e3e3fd0",
            "pattern": "[file:hashes.SHA1 = '12627ba5fea1f00d6ac0704d053c519db93f9122']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:25:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--571a88d1-9650-43b7-976c-4cd502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:53.000Z",
            "modified": "2016-04-22T20:25:53.000Z",
            "description": "Weaponized EPS Docs - Xchecked via VT: 13bdc52c2066e4b02bae5cc42bc9ec7dfcc1f19fbf35007aea93e9d62e3e3fd0",
            "pattern": "[file:hashes.MD5 = '3fe0cbedec6969803a72b8c76a4a0a03']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-22T20:25:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--571a88d2-28a0-4dda-93fb-449802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-22T20:25:54.000Z",
            "modified": "2016-04-22T20:25:54.000Z",
            "first_observed": "2016-04-22T20:25:54Z",
            "last_observed": "2016-04-22T20:25:54Z",
            "number_observed": 1,
            "object_refs": [
                "url--571a88d2-28a0-4dda-93fb-449802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--571a88d2-28a0-4dda-93fb-449802de0b81",
            "value": "https://www.virustotal.com/file/13bdc52c2066e4b02bae5cc42bc9ec7dfcc1f19fbf35007aea93e9d62e3e3fd0/analysis/1461331255/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}