{ "type": "bundle", "id": "bundle--5b265497-b458-4c11-a57c-45db02de0b81", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:46:47.000Z", "modified": "2018-06-17T12:46:47.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5b265497-b458-4c11-a57c-45db02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:46:47.000Z", "modified": "2018-06-17T12:46:47.000Z", "name": "Malware Analysis Report (AR18-165A) MAR-10135536-12 \u00e2\u20ac\u201c North Korean Trojan: TYPEFRAME", "published": "2018-06-17T13:00:35Z", "object_refs": [ "indicator--eb2fc06f-a0a1-4f4a-bea3-adab040d70ff", "indicator--7c86a82b-ba54-4ff1-8705-e11f3f7141e7", "indicator--7ee15758-a1b1-430e-9c0d-99de31050d3f", "indicator--2735b91e-6dfa-4588-a0d6-28fb8d167d7e", "indicator--0987500d-f42e-44f8-95fc-d18c1b1093af", "indicator--7b0d562b-47d2-442d-b783-db5287da59ac", "indicator--e4484d7e-0ce1-4aaf-860d-dbbdb89e6aca", "observed-data--5b2655ca-0590-41e5-aeec-6a6d02de0b81", "url--5b2655ca-0590-41e5-aeec-6a6d02de0b81", "x-misp-attribute--5b26563a-5330-43de-aac3-6a6202de0b81", "x-misp-attribute--5b26569b-4d24-4f80-bfbc-170302de0b81", "observed-data--5b265834-3cb0-4d59-a792-6a6d02de0b81", "url--5b265834-3cb0-4d59-a792-6a6d02de0b81", "x-misp-object--967ce91b-c8b4-42df-9f74-9e1ac6affd08", "x-misp-object--0dbb16a9-0269-4682-a179-1d6891ff30b1", "x-misp-object--ff95cbea-219e-4242-9f7d-a2d16a013a7b", "x-misp-object--fd483ddd-cdc3-4296-8a89-c467247ede98", "x-misp-object--7f5198c2-fd93-4401-80fa-e24b6a99bb3c", "x-misp-object--345a90a3-5de7-44a1-8a57-a1a8999a1af5", "x-misp-object--b94caa3a-5603-431b-8822-cca2a4ffa678", "x-misp-object--bfc7f514-369a-40a2-9462-95c6228df9a4", "x-misp-object--d9231a73-1ae1-4e99-877c-e6080aef6fd5", "x-misp-object--e60aa2a5-bc11-4df9-9241-defe23af60a1", "x-misp-object--ba4427c1-fc81-40e9-a10b-d14a0a20711d", "x-misp-object--ac98153a-ec7f-4c54-b563-7917339cee04", "x-misp-object--4afa330b-5bde-4778-b833-ba0ccdf53b67", "x-misp-object--98db396b-fa79-441a-9ac6-f5c4b8ce4709", "x-misp-object--331a2fb4-3f10-45ca-89c9-60cf96c9205f", "x-misp-object--2c6f9016-4377-447f-84df-ddc4c2d59f35", "x-misp-object--bd2613b3-ef57-4c37-9e55-26e51493ba3a", "x-misp-object--16c183f2-2c3f-4304-ad99-9e19c2323ee0", "x-misp-object--8a65ff90-3aad-4da9-a4be-b8b4a08878d2", "indicator--1dd9ce3a-5709-4b5b-9dd2-12d9bf32e1d0", "indicator--c2593c36-69f5-4c43-9fcc-b335d606d569", "indicator--35046b12-4171-4598-ab66-f6c536f03862", "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f", "indicator--137d6815-4196-433f-a8be-1fe04add3a5f", "indicator--a84b8d9c-0175-411b-8b89-fc0ac709df56", "indicator--f94d3e39-27ea-4214-bb44-c25505dc2326", "indicator--d5b3a29b-484d-4619-b358-e8850a30e3a0", "indicator--a13cfa83-8fb9-47f5-8bda-430bce2e0f7a", "x-misp-object--8359531b-5e0a-4fdc-828d-d3901560fe58", "x-misp-object--46e93d08-06fb-49ee-a465-b8680a4b04ae", "x-misp-object--2543f106-3d8f-4855-a306-1f505ae9ee34", "x-misp-object--8d81a602-68f0-470f-8eb3-3422ad8929fb", "x-misp-object--1cc483ce-fc42-4c80-af86-6024c10f69f6", "x-misp-object--0eb4a04f-9699-4e92-88a0-4a4dec688885", "x-misp-object--5899141a-5be5-42de-90af-1e471b7b1d7c", "x-misp-object--450c3377-2c9b-4b69-8381-f51dfe41f149", "x-misp-object--3a9a5628-14e1-4f29-8722-93e142a93add", "x-misp-object--f11af508-fb9e-49a3-a5ef-ed176fa9057b", "x-misp-object--8b080900-6adf-4dd5-a3e3-470c719f6041", "x-misp-object--0d3fcd9f-6a98-4566-b99c-941cf97a58c0", "x-misp-object--15a888e0-c1b1-46cf-a341-32de4f623862", "indicator--fc5663b5-c080-45b4-a405-147ca8570626", "indicator--79461c6c-5900-4ecf-90f0-6157212636dd", "indicator--206825c8-1f31-4ae3-be07-5cb1b63e98a1", "indicator--0522e8ab-595b-46fd-b97c-bded45adfd05", "indicator--cffd2eaa-1a45-40de-b9d1-aa6999601750", "indicator--14dfc596-3c8f-4d1e-8194-56873bf809f0", "indicator--c56a8843-6462-4e48-9354-ff3cea9b393c", "x-misp-object--7dd632d5-39a8-491a-80cc-c163755c56db", "x-misp-object--c22f54ef-0428-4b7e-aab1-c0ba1b6259ea", "x-misp-object--be6d670d-923a-411a-97db-bf73901abf56", "x-misp-object--b8e7aa5e-5681-4393-8581-a207f6651129", "x-misp-object--2e3d47fa-ccc7-4549-8005-9d0b2481219a", "x-misp-object--81c54539-acd4-4f39-981f-2c07d8e783df", "x-misp-object--6a9e84ce-dc0b-48a5-a1b3-a70f871f6a08", "x-misp-object--510ac6ad-b6d5-4be7-9a51-0ad210190eff", "x-misp-object--f127c64b-bf6c-4448-a66f-b455d9f0a695", "x-misp-object--72f0a63e-d53f-423b-b762-096a7f70ba1c", "x-misp-object--33e578e5-10bc-4442-9737-ff332c9c2bbd", "x-misp-object--d54ec2e8-330d-496a-bd90-c388db285a90", "x-misp-object--cad943d1-b772-45d8-8cd1-7e3fde522cf7", "x-misp-object--c07156a8-22b8-4496-9173-632a17da707a", "x-misp-object--4d0aac8e-a228-4186-9626-37b23b6e06a3", "x-misp-object--d25a50ab-2499-4d07-9ea8-d8db37a2a9ec", "x-misp-object--43459484-03b7-4d3a-a023-d25e2950b7c6", "x-misp-object--612783c6-7d6a-4f3b-999b-804d7dc94585", "x-misp-object--017ac5c4-1f99-40ea-9b0e-845d1536894d", "x-misp-object--938b67a4-6ddb-4390-8ba5-11137948a333", "x-misp-object--2071bf37-4d11-4e1c-8a09-222cc01f3222", "x-misp-object--5cea7400-2394-4125-a49b-64c020a3b2bf", "x-misp-object--93c1fd93-dc41-40fa-8489-d2e820dcf54d", "x-misp-object--fc5536a3-c1a4-4d19-aa3c-537ae72c0e37", "x-misp-object--77a11458-9cba-4925-9e68-d34ffb6eb580", "x-misp-object--d2bf0fa0-fd39-439c-ad04-c4b74103d928", "x-misp-object--a68ac63a-c404-4f51-b5c3-a08c64b8c812", "x-misp-object--9ed27605-49ae-4ddf-99b5-323110f08166", "x-misp-object--c5188fa1-89e6-4034-b190-37d19d99693b", "x-misp-object--bc1321a7-4ee5-4a27-8740-e98e3790543e", "x-misp-object--6b9a35c8-f016-45f0-bc54-230462e36f3f", "x-misp-object--368a60f3-4114-4f9e-ac30-8a6c4c3a15ec", "x-misp-object--a615573c-e5d7-49d8-8f56-16b59a758b42", "x-misp-object--e9f573b5-0f08-42d6-a8d2-c1078df73115", "x-misp-object--3a947450-55ac-48b9-b46c-0b9e70a58cc0", "x-misp-object--05aff0ac-857c-43b1-af37-a038cca8201b", "x-misp-object--7a6e023e-973d-41da-ba8d-5817f5198428", "x-misp-object--ff32b7ff-42ae-4b3d-acff-dcd99fb25eaf", "x-misp-object--68f21999-9b07-41fc-9aac-8132f5dfb0c3", "x-misp-object--a4f99cb3-f450-4b2e-8455-07dfe9e41cb0", "x-misp-object--9acc8d38-4f15-4bf6-9c63-71613aaebbf7", "x-misp-object--b6cd05be-e718-4b54-a890-ed1dd88697cb", "x-misp-object--83c72de8-db0e-4c7d-8ea1-3236b485a86f", "x-misp-object--014c32e7-b639-4a57-a5fb-18309fec2133", "x-misp-object--b25804d1-5a0a-42f2-b5ad-0c01925ca1c7", "x-misp-object--b31db49a-0a64-46f6-bf92-7d6d35eb8dfb", "x-misp-object--2fbfd808-3ed1-4578-8a89-e0aa5d57a8b6", "x-misp-object--9a97fc45-451c-4aee-8940-4a554ebf286f", "x-misp-object--1d79df64-ad7a-4189-a107-1d2f27e8202c", "x-misp-object--b4d6cf82-abf9-40ea-8adf-884cac0b7dca", "x-misp-object--1b2178c0-7302-4bf6-a196-e7088086d1e7", "x-misp-object--f6bf304a-cd3f-4bf4-8731-e4ad2e85c5c6", "x-misp-object--245d12e0-fda7-41de-935c-5fc5208ea77a", "x-misp-object--a5bf7615-9482-49f6-9959-55010346971f", "x-misp-object--e20e89de-dedb-4493-9f39-d19bca906c68", "x-misp-object--a640c76e-6b15-4f46-bb4a-3c41a62700c5", "x-misp-object--940a978d-4e70-4357-a7c1-2e1a9e80b784", "x-misp-object--fe2d8b67-f422-4335-be73-542f40ee8559", "x-misp-object--c11a828a-e1d5-4299-9329-7908ca5aeea8", "x-misp-object--f5d96ec9-8867-4032-8088-5c539234665c", "x-misp-object--90eb0a08-a0d8-49c6-8ec7-dccc20d06199", "x-misp-object--073bfabc-0580-4fde-8659-c3854029937d", "x-misp-object--e5f2a5b2-f9b6-4536-8068-1e610b0a5b17", "x-misp-object--592953b3-0474-4ad1-8942-757124e30a99", "x-misp-object--d4bf7b4c-7f49-46cd-94a6-c12dc5a471eb", "x-misp-object--3a63168f-d604-46d2-80c0-d24afea4639b", "x-misp-object--c8df1989-af8f-49db-838c-ef2f8bb96eb5", "x-misp-object--81962a81-10c7-4f4d-ba8b-b9df3d5d741d", "x-misp-object--0f3b61d8-1fdd-408b-9710-61e6e3a05220", "x-misp-object--5690876b-7f5b-4032-bb10-3f690b1ce2cd", "x-misp-object--05809cc2-e217-49db-a128-b8b63d1b5171", "x-misp-object--58af18ac-7fad-4504-85de-90947ece0028", "x-misp-object--75cd1bef-0d6e-4c7f-bc48-293403212159", "x-misp-object--e1eb04f2-bccb-4dd0-9f93-a1f2ccb4e650", "x-misp-object--5ddcf5da-400b-4bad-b4f3-9dd0708a6644", "x-misp-object--52d6ebd2-4ad3-44c5-9029-ccbff450c8b7", "x-misp-object--59e02386-d00c-417d-b9c1-7a1dce691aad", "x-misp-object--dee24e7d-32ac-427d-a6be-952cf291e5f6", "relationship--7b622deb-1c41-4317-a123-2eaeb8b29793", "relationship--bb31a47e-429c-43c3-8c04-6103ed1cc6de", "relationship--c4dbacbd-e03e-4e67-a5f7-494b7ccce961", "relationship--1facf535-531f-462f-bd04-7945eb1dccab", "relationship--49ff7b04-791c-4e57-b676-be98222ae2b8", "relationship--2c1506d8-ed51-4502-b62c-6e9d9ceba718", "relationship--9e1da164-6a5a-4621-bbb7-ae0cf2afca17", "relationship--f3f7b81d-15a4-4d59-8dd8-8728c04bfa85", "relationship--883da042-b6d4-47a8-a490-c41de8a9c2dc", "relationship--843e7d19-3683-4fdf-954d-3ec5cdfb0634", "relationship--3a3cc2eb-a5bb-433b-a0ed-25f3f387da24" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:threat-actor=\"Lazarus Group\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eb2fc06f-a0a1-4f4a-bea3-adab040d70ff", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:48.000Z", "modified": "2018-06-17T12:33:48.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.56']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c86a82b-ba54-4ff1-8705-e11f3f7141e7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:48.000Z", "modified": "2018-06-17T12:33:48.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.101.211.162']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7ee15758-a1b1-430e-9c0d-99de31050d3f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:48.000Z", "modified": "2018-06-17T12:33:48.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '59.90.93.97']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2735b91e-6dfa-4588-a0d6-28fb8d167d7e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:48.000Z", "modified": "2018-06-17T12:33:48.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '111.207.78.204']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0987500d-f42e-44f8-95fc-d18c1b1093af", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:48.000Z", "modified": "2018-06-17T12:33:48.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '80.91.118.45']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7b0d562b-47d2-442d-b783-db5287da59ac", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:48.000Z", "modified": "2018-06-17T12:33:48.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '81.0.213.173']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e4484d7e-0ce1-4aaf-860d-dbbdb89e6aca", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:48.000Z", "modified": "2018-06-17T12:33:48.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '184.107.209.2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5b2655ca-0590-41e5-aeec-6a6d02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:36:26.000Z", "modified": "2018-06-17T12:36:26.000Z", "first_observed": "2018-06-17T12:36:26Z", "last_observed": "2018-06-17T12:36:26Z", "number_observed": 1, "object_refs": [ "url--5b2655ca-0590-41e5-aeec-6a6d02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5b2655ca-0590-41e5-aeec-6a6d02de0b81", "value": "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b26563a-5330-43de-aac3-6a6202de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:38:18.000Z", "modified": "2018-06-17T12:38:18.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_type": "text", "x_misp_value": "This Malware Analysis Report (MAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. Government partners, DHS and FBI identified Trojan malware variants used by the North Korean government. This malware variant is known as TYPEFRAME. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.gov/hiddencobra.\r\n\r\nDHS and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity.\r\n\r\nThis MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended mitigation techniques. Users and administrators should flag activity associated with the malware, report the activity to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and give the activity the highest priority for enhanced mitigation.\r\n\r\nThis malware report contains analysis of 11 malware samples consisting of 32-bit and 64-bit Windows executable files and a malicious Microsoft Word document that contains Visual Basic for Applications (VBA) macros. These files have the capability to download and install malware, install proxy and Remote Access Trojans (RATs), connect to command and control (C2) servers to receive additional instructions, and modify the victim's firewall to allow incoming connections." }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b26569b-4d24-4f80-bfbc-170302de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:39:55.000Z", "modified": "2018-06-17T12:39:55.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_type": "text", "x_misp_value": "(from CIRCL)\r\nSTIX import of https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-12_WHITE_stix.xml with additional expansions and information from the website (as the STIX original file is not including the meta-data)." }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5b265834-3cb0-4d59-a792-6a6d02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:46:44.000Z", "modified": "2018-06-17T12:46:44.000Z", "first_observed": "2018-06-17T12:46:44Z", "last_observed": "2018-06-17T12:46:44Z", "number_observed": 1, "object_refs": [ "url--5b265834-3cb0-4d59-a792-6a6d02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5b265834-3cb0-4d59-a792-6a6d02de0b81", "value": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-12_WHITE_stix.xml" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--967ce91b-c8b4-42df-9f74-9e1ac6affd08", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:22.000Z", "modified": "2018-06-17T12:31:22.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--0dbb16a9-0269-4682-a179-1d6891ff30b1", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:24.000Z", "modified": "2018-06-17T12:31:24.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--ff95cbea-219e-4242-9f7d-a2d16a013a7b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:25.000Z", "modified": "2018-06-17T12:31:25.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--fd483ddd-cdc3-4296-8a89-c467247ede98", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:26.000Z", "modified": "2018-06-17T12:31:26.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--7f5198c2-fd93-4401-80fa-e24b6a99bb3c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:28.000Z", "modified": "2018-06-17T12:31:28.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--345a90a3-5de7-44a1-8a57-a1a8999a1af5", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:29.000Z", "modified": "2018-06-17T12:31:29.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--b94caa3a-5603-431b-8822-cca2a4ffa678", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:30.000Z", "modified": "2018-06-17T12:31:30.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--bfc7f514-369a-40a2-9462-95c6228df9a4", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:32.000Z", "modified": "2018-06-17T12:31:32.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--d9231a73-1ae1-4e99-877c-e6080aef6fd5", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:33.000Z", "modified": "2018-06-17T12:31:33.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e60aa2a5-bc11-4df9-9241-defe23af60a1", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:35.000Z", "modified": "2018-06-17T12:31:35.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--ba4427c1-fc81-40e9-a10b-d14a0a20711d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:36.000Z", "modified": "2018-06-17T12:31:36.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--ac98153a-ec7f-4c54-b563-7917339cee04", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:37.000Z", "modified": "2018-06-17T12:31:37.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--4afa330b-5bde-4778-b833-ba0ccdf53b67", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:39.000Z", "modified": "2018-06-17T12:31:39.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--98db396b-fa79-441a-9ac6-f5c4b8ce4709", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:41.000Z", "modified": "2018-06-17T12:31:41.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--331a2fb4-3f10-45ca-89c9-60cf96c9205f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:47.000Z", "modified": "2018-06-17T12:31:47.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--2c6f9016-4377-447f-84df-ddc4c2d59f35", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:53.000Z", "modified": "2018-06-17T12:31:53.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--bd2613b3-ef57-4c37-9e55-26e51493ba3a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:58.000Z", "modified": "2018-06-17T12:31:58.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--16c183f2-2c3f-4304-ad99-9e19c2323ee0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:04.000Z", "modified": "2018-06-17T12:32:04.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--8a65ff90-3aad-4da9-a4be-b8b4a08878d2", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:40:48.000Z", "modified": "2018-06-17T12:40:48.000Z", "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "file" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1dd9ce3a-5709-4b5b-9dd2-12d9bf32e1d0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:17.000Z", "modified": "2018-06-17T12:32:17.000Z", "pattern": "[file:hashes.MD5 = 'bf474b8acd55380b1169bb949d60e9e4' AND file:hashes.SHA1 = 'c60c18fc0226a53be15637ee3ef0b73b0dabd854' AND file:hashes.SHA256 = 'd1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92' AND file:hashes.SHA512 = '46995cf3516c160d2f4fa5957c8c67df75f2768b24562b22de46a5d4ef7ba17fecaef2ad900bc6925e0c4284802864361423653154ad0622af18d049fb0419be' AND file:hashes.SSDEEP = '12288:G+3/oi/EpRsV97/8Olq3p8YNk5oYEeLxCStEowZVKmZag:Gmoi/EpRsV9S3prgomLE9oVmQg' AND file:name = 'BF474B8ACD55380B1169BB949D60E9E4' AND file:size = '466241' AND file:x_misp_mimetype = 'PE32 executable (GUI) Intel 80386, for MS Windows' AND file:x_misp_entropy = '7.760001']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:17Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c2593c36-69f5-4c43-9fcc-b335d606d569", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:23.000Z", "modified": "2018-06-17T12:32:23.000Z", "pattern": "[file:hashes.MD5 = 'ca67f84d5a4ac1459934128442c53b03' AND file:hashes.SHA1 = 'f4eb6a50c60320edafb3e48c612c6a55560d0684' AND file:hashes.SHA256 = '40ef57ca2a617f5d24ac624339ba2027b6cf301c28684bf8b2075fc7a2e95116' AND file:hashes.SHA512 = '4695cf69e2ae52fc94eab31cbc3bb846022a3e1516d9bc293118f674ea1eb86468cff0a4c0dee8dff8a2d545df153116e8d86669513426e1b32a205041339e45' AND file:hashes.SSDEEP = '12288:drrF4D0d2QKPIyWE8QPnWnGHiS2VcL2ZotSNfpV532/dlZ:x6IGnWntQ2ZvfpvmdlZ' AND file:name = 'CA67F84D5A4AC1459934128442C53B03' AND file:size = '778240' AND file:x_misp_mimetype = 'PE32 executable (DLL) (GUI) Intel 80386, for MS Windows' AND file:x_misp_entropy = '6.710797']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:23Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--35046b12-4171-4598-ab66-f6c536f03862", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:30.000Z", "modified": "2018-06-17T12:32:30.000Z", "pattern": "[file:hashes.MD5 = '6ab301fc3296e1ceb140bf5d294894c5' AND file:hashes.SHA1 = '8d62498656db928f987b47bdbcfab5d6032be48a' AND file:hashes.SHA256 = '546dbd370a40c8e46f9b599a414f25000eec5ae6b3e046a035fe6e6cd5d874e1' AND file:hashes.SHA512 = '3abd7a690d821ace78d8f5e2394f0922308963c7ba8ee63661e9cdb2e36fe8353904346b4b0457c6ace3071505533187d62a41d47473a6a9680cab7fca209ceb' AND file:hashes.SSDEEP = '3072:JdHh7xVwMPRTxXX0bqkmvA7XKmJLiSi3Ix1DKXrlTNEsuFFCeojbmUkGVcNP+:17xVrxxn0PrWiv8hLnS+' AND file:name = '6AB301FC3296E1CEB140BF5D294894C5' AND file:size = '259584' AND file:x_misp_mimetype = 'PE32+ executable (DLL) (GUI) x86-64, for MS Windows' AND file:x_misp_entropy = '5.918488']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:30Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:40:48.000Z", "modified": "2018-06-17T12:40:48.000Z", "pattern": "[file:hashes.MD5 = '77b50bb476a85a7aa30c962a389838aa' AND file:hashes.SHA1 = 'df466a1f473c7c5eba5f22d90822fd1430b6a244' AND file:hashes.SHA256 = '3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210' AND file:hashes.SHA512 = '33b78e0bc8832958b79292bfebffe32c03b59b92044bb95331ee384f7061f6724c7d10bcf17ee1395dbd437b225c0813ba4bc5de6ef44f4bdd9ee58e446ad143' AND file:hashes.SSDEEP = '3072:sPhrkoI8QYJRMs4y5pe+/a5sN5t4+PXP:Mi/lqpe+/0sa' AND file:name = 'java.exe' AND file:size = '118784' AND file:x_misp_mimetype = 'PE32 executable (GUI) Intel 80386, for MS Windows' AND file:x_misp_entropy = '5.880053']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:40:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--137d6815-4196-433f-a8be-1fe04add3a5f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:35.000Z", "modified": "2018-06-17T12:32:35.000Z", "pattern": "[file:hashes.MD5 = '3229a6cea658b1b3ca5ca9ad7b40d8d4' AND file:hashes.SHA1 = '70730e608e2fcc68ce468ed148e965c5bacfb51c' AND file:hashes.SHA256 = '4bd7d801d7ce3fe9c2928dbc834b296e934473f5bbcc9a1fd18af5ebd43192cd' AND file:hashes.SHA512 = 'ff385a9446415412950562cca832eab1d17de56932f3633a86202dea829e8bd25e56864306f2e6c8bb7ff7d2cfe2785acc4261410e38348946baf72d4a0696de' AND file:hashes.SSDEEP = '12288:sh+81FiNloAzjMXJ1NPeZ3eMNZtF7fHRRAug0EX7:W1FiNWEYxeV3NfHDe' AND file:name = '3229A6CEA658B1B3CA5CA9AD7B40D8D4' AND file:size = '712192' AND file:x_misp_mimetype = 'Composite Document File V2 Document, Little Endian, O\\\\%WINDIR\\\\%\\\\ Version 6.2, Code page: 949, Author: ISkyISea, Template: Normal, Last Saved By: ISkyISea, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 17:00, Create Time/Date: Mon Apr 3 18:36:00 2017, Last Saved Time/Date: Thu Apr 6 00:34:00 2017, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0' AND file:x_misp_entropy = '5.446016']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:35Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a84b8d9c-0175-411b-8b89-fc0ac709df56", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:44.000Z", "modified": "2018-06-17T12:32:44.000Z", "pattern": "[file:hashes.MD5 = 'bfb41bc0c3856aa0a81a5256b7b8da51' AND file:hashes.SHA1 = 'cb96e29332fe94d1a70309837f73daf7bec81284' AND file:hashes.SHA256 = 'c9e3b83d77ce93cc1d70b22e967f049b13515c88572aa78e0a838103e5478777' AND file:hashes.SHA512 = '37223163a329ffa7b77a9190aab1da5fbf38c6d76139591d592d695e5caa81b56f6d3769540e2781c87a29de3d39e5e9c8ee70bd9ed6a0bee040917f530bc11a' AND file:hashes.SSDEEP = '12288:jxn1kOPTkEjkHsnCrYHM46QyFgHj+u1XC1GbA/UXAfAGZI3PWM+:jxn1kOLkEQHsYYDdD+u1HbA/Uw47/L+' AND file:name = 'BFB41BC0C3856AA0A81A5256B7B8DA51' AND file:size = '578174' AND file:x_misp_mimetype = 'PE32+ executable (GUI) x86-64, for MS Windows' AND file:x_misp_entropy = '7.848313']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:44Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f94d3e39-27ea-4214-bb44-c25505dc2326", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:46.000Z", "modified": "2018-06-17T12:32:46.000Z", "pattern": "[file:hashes.MD5 = '9722bc9e0efb4214116066d1ff14094c' AND file:hashes.SHA1 = '41a938499048a6ad8034d09e2fbb893da8f13ca9' AND file:hashes.SHA256 = 'e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef' AND file:hashes.SHA512 = '8470c240868441093314ebe263028ceef61d900b41aaeed77fd934edf81b9a75f6c96d0fccc0ac87364c8e23e0b8eb19ec8bcd47daf1d50c1182be999475fc4c' AND file:hashes.SSDEEP = '12288:nqU713B5hV7rJIBBAVbyjRbjSbdSYJ3raxt7o6qRBpDwQmnQ2bqPjD+PmCNVGsPf:nRxJIB7hSZSG37jo/GsPepCdOwy' AND file:name = 'dwnhost.dll' AND file:size = '1030144' AND file:x_misp_mimetype = 'PE32+ executable (DLL) (GUI) x86-64, for MS Windows' AND file:x_misp_entropy = '6.424883']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d5b3a29b-484d-4619-b358-e8850a30e3a0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:52.000Z", "modified": "2018-06-17T12:32:52.000Z", "pattern": "[file:hashes.MD5 = 'ef9db20ab0eebf0b7c55af4ec0b7bced' AND file:hashes.SHA1 = '0202942d11c994cece943bb873f3af156d820f59' AND file:hashes.SHA256 = '20abb95114de946da7595438e9edf0bf39c85ba8512709db7d5532d37d73bd64' AND file:hashes.SHA512 = '85fa80079c59da83e3b2471eab0d2981c92b6c589cbe5052bf438831ae464e6499040ead68d6bc9929edd9f6c08ecc6abf2a0173e31bd361a24fad89ff1f7064' AND file:hashes.SSDEEP = '3072:qocqUTuIzXblpGxqSDBiiBmLEEjdTIf3TIb9Qw/uAZyerrPabYlQ:qJqUnXKxqSAiBJyTC3TIb9QRL0lQ' AND file:name = 'EF9DB20AB0EEBF0B7C55AF4EC0B7BCED' AND file:size = '152064' AND file:x_misp_mimetype = 'PE32+ executable (GUI) x86-64, for MS Windows' AND file:x_misp_entropy = '6.269643']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a13cfa83-8fb9-47f5-8bda-430bce2e0f7a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "pattern": "[file:hashes.MD5 = '1c53e7269fe9d84c6df0a25ba59b822c' AND file:hashes.SHA1 = 'b775d753671133cbc4919764d2fac0d298166b07' AND file:hashes.SHA256 = '201c7cd10a2bd50dde0948d14c3c7a0732955c908a3392aee3d08b94470c9d33' AND file:hashes.SHA512 = '3d3883b9b29e264d023b7034d980b7c206c9fc82010bf7f5f1dc454fdbd316830fe69e90579406a74afc1fca8e266d10c1b46784bd661dcb2815e370a68acd32' AND file:hashes.SSDEEP = '1536:EaMa/KVyD4hv6LLETuA1x+sh2iE1s44tz4qoWYUwnZ7hUOC2:G8YPZ6LLqQFX4tz4quxY' AND file:name = '1C53E7269FE9D84C6DF0A25BA59B822C' AND file:size = '126976' AND file:x_misp_mimetype = 'PE32 executable (DLL) (GUI) Intel 80386, for MS Windows' AND file:x_misp_entropy = '6.024087']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:01Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--8359531b-5e0a-4fdc-828d-d3901560fe58", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "labels": [ "misp:name=\"whois\"", "misp:meta-category=\"network\"" ], "x_misp_meta_category": "network", "x_misp_name": "whois" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--46e93d08-06fb-49ee-a465-b8680a4b04ae", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "labels": [ "misp:name=\"whois\"", "misp:meta-category=\"network\"" ], "x_misp_meta_category": "network", "x_misp_name": "whois" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--2543f106-3d8f-4855-a306-1f505ae9ee34", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "labels": [ "misp:name=\"whois\"", "misp:meta-category=\"network\"" ], "x_misp_meta_category": "network", "x_misp_name": "whois" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--8d81a602-68f0-470f-8eb3-3422ad8929fb", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "labels": [ "misp:name=\"whois\"", "misp:meta-category=\"network\"" ], "x_misp_meta_category": "network", "x_misp_name": "whois" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--1cc483ce-fc42-4c80-af86-6024c10f69f6", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "labels": [ "misp:name=\"whois\"", "misp:meta-category=\"network\"" ], "x_misp_meta_category": "network", "x_misp_name": "whois" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--0eb4a04f-9699-4e92-88a0-4a4dec688885", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "labels": [ "misp:name=\"whois\"", "misp:meta-category=\"network\"" ], "x_misp_meta_category": "network", "x_misp_name": "whois" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5899141a-5be5-42de-90af-1e471b7b1d7c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "labels": [ "misp:name=\"whois\"", "misp:meta-category=\"network\"" ], "x_misp_meta_category": "network", "x_misp_name": "whois" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--450c3377-2c9b-4b69-8381-f51dfe41f149", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:40:47.000Z", "modified": "2018-06-17T12:40:47.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--3a9a5628-14e1-4f29-8722-93e142a93add", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:47.000Z", "modified": "2018-06-17T12:31:47.000Z", "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f11af508-fb9e-49a3-a5ef-ed176fa9057b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:53.000Z", "modified": "2018-06-17T12:31:53.000Z", "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--8b080900-6adf-4dd5-a3e3-470c719f6041", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:57.000Z", "modified": "2018-06-17T12:31:57.000Z", "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--0d3fcd9f-6a98-4566-b99c-941cf97a58c0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:03.000Z", "modified": "2018-06-17T12:32:03.000Z", "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--15a888e0-c1b1-46cf-a341-32de4f623862", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:12.000Z", "modified": "2018-06-17T12:32:12.000Z", "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fc5663b5-c080-45b4-a405-147ca8570626", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:17.000Z", "modified": "2018-06-17T12:32:17.000Z", "pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '4' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'BF474B8ACD55380B1169BB949D60E9E4' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'BF474B8ACD55380B1169BB949D60E9E4']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:17Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--79461c6c-5900-4ecf-90f0-6157212636dd", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:23.000Z", "modified": "2018-06-17T12:32:23.000Z", "pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '6' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'CA67F84D5A4AC1459934128442C53B03' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'CA67F84D5A4AC1459934128442C53B03']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:23Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--206825c8-1f31-4ae3-be07-5cb1b63e98a1", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:30.000Z", "modified": "2018-06-17T12:32:30.000Z", "pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '7' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = '6AB301FC3296E1CEB140BF5D294894C5' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = '6AB301FC3296E1CEB140BF5D294894C5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:30Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0522e8ab-595b-46fd-b97c-bded45adfd05", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:35.000Z", "modified": "2018-06-17T12:32:35.000Z", "pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '5' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'java.exe' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'java.exe']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:35Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cffd2eaa-1a45-40de-b9d1-aa6999601750", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:43.000Z", "modified": "2018-06-17T12:32:43.000Z", "pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '7' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'BFB41BC0C3856AA0A81A5256B7B8DA51' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'BFB41BC0C3856AA0A81A5256B7B8DA51']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:43Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--14dfc596-3c8f-4d1e-8194-56873bf809f0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:52.000Z", "modified": "2018-06-17T12:32:52.000Z", "pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '7' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'EF9DB20AB0EEBF0B7C55AF4EC0B7BCED' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'EF9DB20AB0EEBF0B7C55AF4EC0B7BCED']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:32:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c56a8843-6462-4e48-9354-ff3cea9b393c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '12' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = '1C53E7269FE9D84C6DF0A25BA59B822C' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = '1C53E7269FE9D84C6DF0A25BA59B822C']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-06-17T12:33:01Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"pe\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--7dd632d5-39a8-491a-80cc-c163755c56db", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:42.000Z", "modified": "2018-06-17T12:31:42.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c22f54ef-0428-4b7e-aab1-c0ba1b6259ea", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:42.000Z", "modified": "2018-06-17T12:31:42.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--be6d670d-923a-411a-97db-bf73901abf56", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:43.000Z", "modified": "2018-06-17T12:31:43.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--b8e7aa5e-5681-4393-8581-a207f6651129", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:43.000Z", "modified": "2018-06-17T12:31:43.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--2e3d47fa-ccc7-4549-8005-9d0b2481219a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:46.000Z", "modified": "2018-06-17T12:31:46.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--81c54539-acd4-4f39-981f-2c07d8e783df", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:47.000Z", "modified": "2018-06-17T12:31:47.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--6a9e84ce-dc0b-48a5-a1b3-a70f871f6a08", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:47.000Z", "modified": "2018-06-17T12:31:47.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--510ac6ad-b6d5-4be7-9a51-0ad210190eff", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:48.000Z", "modified": "2018-06-17T12:31:48.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f127c64b-bf6c-4448-a66f-b455d9f0a695", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:49.000Z", "modified": "2018-06-17T12:31:49.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--72f0a63e-d53f-423b-b762-096a7f70ba1c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:49.000Z", "modified": "2018-06-17T12:31:49.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--33e578e5-10bc-4442-9737-ff332c9c2bbd", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:52.000Z", "modified": "2018-06-17T12:31:52.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--d54ec2e8-330d-496a-bd90-c388db285a90", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:53.000Z", "modified": "2018-06-17T12:31:53.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--cad943d1-b772-45d8-8cd1-7e3fde522cf7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:53.000Z", "modified": "2018-06-17T12:31:53.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c07156a8-22b8-4496-9173-632a17da707a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:54.000Z", "modified": "2018-06-17T12:31:54.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--4d0aac8e-a228-4186-9626-37b23b6e06a3", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:57.000Z", "modified": "2018-06-17T12:31:57.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--d25a50ab-2499-4d07-9ea8-d8db37a2a9ec", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:57.000Z", "modified": "2018-06-17T12:31:57.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--43459484-03b7-4d3a-a023-d25e2950b7c6", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:58.000Z", "modified": "2018-06-17T12:31:58.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--612783c6-7d6a-4f3b-999b-804d7dc94585", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:59.000Z", "modified": "2018-06-17T12:31:59.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--017ac5c4-1f99-40ea-9b0e-845d1536894d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:31:59.000Z", "modified": "2018-06-17T12:31:59.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--938b67a4-6ddb-4390-8ba5-11137948a333", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:00.000Z", "modified": "2018-06-17T12:32:00.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--2071bf37-4d11-4e1c-8a09-222cc01f3222", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:03.000Z", "modified": "2018-06-17T12:32:03.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5cea7400-2394-4125-a49b-64c020a3b2bf", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:04.000Z", "modified": "2018-06-17T12:32:04.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--93c1fd93-dc41-40fa-8489-d2e820dcf54d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:04.000Z", "modified": "2018-06-17T12:32:04.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--fc5536a3-c1a4-4d19-aa3c-537ae72c0e37", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:05.000Z", "modified": "2018-06-17T12:32:05.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--77a11458-9cba-4925-9e68-d34ffb6eb580", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:05.000Z", "modified": "2018-06-17T12:32:05.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--d2bf0fa0-fd39-439c-ad04-c4b74103d928", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:06.000Z", "modified": "2018-06-17T12:32:06.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--a68ac63a-c404-4f51-b5c3-a08c64b8c812", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:07.000Z", "modified": "2018-06-17T12:32:07.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--9ed27605-49ae-4ddf-99b5-323110f08166", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:07.000Z", "modified": "2018-06-17T12:32:07.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c5188fa1-89e6-4034-b190-37d19d99693b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:08.000Z", "modified": "2018-06-17T12:32:08.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--bc1321a7-4ee5-4a27-8740-e98e3790543e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:08.000Z", "modified": "2018-06-17T12:32:08.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--6b9a35c8-f016-45f0-bc54-230462e36f3f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:09.000Z", "modified": "2018-06-17T12:32:09.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--368a60f3-4114-4f9e-ac30-8a6c4c3a15ec", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:12.000Z", "modified": "2018-06-17T12:32:12.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--a615573c-e5d7-49d8-8f56-16b59a758b42", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:13.000Z", "modified": "2018-06-17T12:32:13.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e9f573b5-0f08-42d6-a8d2-c1078df73115", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:13.000Z", "modified": "2018-06-17T12:32:13.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--3a947450-55ac-48b9-b46c-0b9e70a58cc0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:14.000Z", "modified": "2018-06-17T12:32:14.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--05aff0ac-857c-43b1-af37-a038cca8201b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:17.000Z", "modified": "2018-06-17T12:32:17.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "float", "object_relation": "entropy", "value": "0.769911", "category": "Other", "uuid": "0c04251f-92e7-4fad-aba4-1f917b2c5a41" }, { "type": "md5", "object_relation": "md5", "value": "5b1f93f0412e9f1c7a7ad42d729b292b", "category": "Payload delivery", "to_ids": true, "uuid": "327c22ac-f353-45b7-ba68-f526a9114218" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "4096", "category": "Other", "uuid": "bba942be-afa9-4b4d-b77a-ad3ca5a40a6f" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--7a6e023e-973d-41da-ba8d-5817f5198428", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:17.000Z", "modified": "2018-06-17T12:32:17.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "e6ea312f762f4df521b229a77f186664", "category": "Payload delivery", "to_ids": true, "uuid": "af79506f-a8b6-4a12-8c44-795328d08ae5" }, { "type": "float", "object_relation": "entropy", "value": "6.629464", "category": "Other", "uuid": "507c7d3d-1c65-4d6f-bfa5-85713a2e3c37" }, { "type": "text", "object_relation": "name", "value": ".text", "category": "Other", "uuid": "336d1eba-29d1-49dd-adfd-110df231cc6a" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "475136", "category": "Other", "uuid": "b711961d-3eb4-497a-a287-bbe5840057fe" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--ff32b7ff-42ae-4b3d-acff-dcd99fb25eaf", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:18.000Z", "modified": "2018-06-17T12:32:18.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "b6fa7b267ea19010d44f056ec3cca39d", "category": "Payload delivery", "to_ids": true, "uuid": "ceeab57a-d8c4-4941-b004-7993466cf5d2" }, { "type": "float", "object_relation": "entropy", "value": "5.920344", "category": "Other", "uuid": "91cf4983-ad20-4646-ad1b-a3ea701dc677" }, { "type": "text", "object_relation": "name", "value": ".rdata", "category": "Other", "uuid": "eb4b62bb-4d86-4f6f-84f8-4059883a520f" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "147456", "category": "Other", "uuid": "3f816338-d8c0-4f7f-a75a-93597a01605f" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--68f21999-9b07-41fc-9aac-8132f5dfb0c3", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:19.000Z", "modified": "2018-06-17T12:32:19.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "1076ec3948d21da8d6c5036548880c63", "category": "Payload delivery", "to_ids": true, "uuid": "3adf678e-7dbc-417e-89ff-556dfd83242b" }, { "type": "float", "object_relation": "entropy", "value": "4.972282", "category": "Other", "uuid": "00295843-7193-4c2f-b0b4-7b289611ad5a" }, { "type": "text", "object_relation": "name", "value": ".data", "category": "Other", "uuid": "c27c2424-2ffa-4e04-9114-70e0a7b43583" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "77824", "category": "Other", "uuid": "8bad0807-50b0-4f57-90bb-7f9768e5a8fa" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--a4f99cb3-f450-4b2e-8455-07dfe9e41cb0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:19.000Z", "modified": "2018-06-17T12:32:19.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "77c814f5856057e7a7f6237bbba51a76", "category": "Payload delivery", "to_ids": true, "uuid": "accf6116-8373-4ebc-8661-807d85cbac79" }, { "type": "float", "object_relation": "entropy", "value": "7.100017", "category": "Other", "uuid": "2ac4db88-5b9b-4133-8908-d00335e8343d" }, { "type": "text", "object_relation": "name", "value": ".rsrc", "category": "Other", "uuid": "065e3253-badf-404e-b7b5-933b0bac6264" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "32768", "category": "Other", "uuid": "a12e28e9-69bb-4650-b533-3057a2e66004" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--9acc8d38-4f15-4bf6-9c63-71613aaebbf7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:20.000Z", "modified": "2018-06-17T12:32:20.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "3184d0afb653bf0723cadccc14d92071", "category": "Payload delivery", "to_ids": true, "uuid": "1df50229-64fc-4e6f-abe3-8d8e86233a23" }, { "type": "float", "object_relation": "entropy", "value": "5.752155", "category": "Other", "uuid": "fcca6bfe-3cf2-42ed-aca4-f339d10970b6" }, { "type": "text", "object_relation": "name", "value": ".reloc", "category": "Other", "uuid": "20bb5900-3e62-4064-bbab-304766550092" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "40960", "category": "Other", "uuid": "84062378-d0f4-4d54-8ddc-ceca715580cf" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--b6cd05be-e718-4b54-a890-ed1dd88697cb", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:23.000Z", "modified": "2018-06-17T12:32:23.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "float", "object_relation": "entropy", "value": "2.821047", "category": "Other", "uuid": "cab440f5-5b76-4fcd-99e1-a4a96ec614e1" }, { "type": "md5", "object_relation": "md5", "value": "24baa03194bc78f0184ea606128bc80f", "category": "Payload delivery", "to_ids": true, "uuid": "346cccc4-2114-4c16-8089-271a5e2e6e5a" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "1024", "category": "Other", "uuid": "3e562b0c-d7ce-4a70-9447-5f65a1fba640" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--83c72de8-db0e-4c7d-8ea1-3236b485a86f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:24.000Z", "modified": "2018-06-17T12:32:24.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "170ce86f9a7ffcd242f3903fafe1f302", "category": "Payload delivery", "to_ids": true, "uuid": "4d4455d3-fff7-4faa-a28f-3e1ac431e365" }, { "type": "float", "object_relation": "entropy", "value": "6.433615", "category": "Other", "uuid": "60bb821b-a3da-4be5-8c23-1c094f4a51e2" }, { "type": "text", "object_relation": "name", "value": ".text", "category": "Other", "uuid": "a8db3e4f-e864-4379-8286-8c775519f5eb" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "57856", "category": "Other", "uuid": "8cb59a2e-6282-4723-a82b-83abab0443b3" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--014c32e7-b639-4a57-a5fb-18309fec2133", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:24.000Z", "modified": "2018-06-17T12:32:24.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "33b066692952c4534ebf0a56ca293085", "category": "Payload delivery", "to_ids": true, "uuid": "991a8ecd-cbc5-4263-85e5-df75954ac8ea" }, { "type": "float", "object_relation": "entropy", "value": "5.09521", "category": "Other", "uuid": "5b93c1ad-3305-404c-a78e-9f8710982bb7" }, { "type": "text", "object_relation": "name", "value": ".rdata", "category": "Other", "uuid": "d3bc8e77-9d1c-46a3-9842-27e9f6a5e750" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "37888", "category": "Other", "uuid": "ddc25d67-c2e0-42ea-ad82-27bcba32aad5" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--b25804d1-5a0a-42f2-b5ad-0c01925ca1c7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:25.000Z", "modified": "2018-06-17T12:32:25.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "b4eed5366c4254a3c7f6c2f021c29efe", "category": "Payload delivery", "to_ids": true, "uuid": "30b303bd-0864-4f31-9ba4-00d3a3a5bf45" }, { "type": "float", "object_relation": "entropy", "value": "4.916035", "category": "Other", "uuid": "8efc483e-7488-4dd0-9ad5-f8ad4434e6e5" }, { "type": "text", "object_relation": "name", "value": ".data", "category": "Other", "uuid": "b1bd7dcf-9be7-4127-b059-558a181b6431" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "156160", "category": "Other", "uuid": "85b3c918-f450-456b-9df8-92a8133524c0" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--b31db49a-0a64-46f6-bf92-7d6d35eb8dfb", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:25.000Z", "modified": "2018-06-17T12:32:25.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "3ad7431aaa87a1e6b6400ca9b273d98a", "category": "Payload delivery", "to_ids": true, "uuid": "b87f4901-64e2-46ca-8cf1-6dc07af84bff" }, { "type": "float", "object_relation": "entropy", "value": "4.579212", "category": "Other", "uuid": "6b0528a6-dc12-4d23-9523-441232dd81e6" }, { "type": "text", "object_relation": "name", "value": ".pdata", "category": "Other", "uuid": "cfd48a77-00cf-4ac1-8c25-7cf9b151d62b" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "4096", "category": "Other", "uuid": "df3f5ac6-9f80-4dc4-802f-6b0c25ee2d3b" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--2fbfd808-3ed1-4578-8a89-e0aa5d57a8b6", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:26.000Z", "modified": "2018-06-17T12:32:26.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "c23d2715b42b072fcf86b2aa58807b56", "category": "Payload delivery", "to_ids": true, "uuid": "d43773fe-6170-4988-a5ab-e0089a29ef6e" }, { "type": "float", "object_relation": "entropy", "value": "4.714485", "category": "Other", "uuid": "80e3e91c-1b9d-4b82-88eb-881911fcb876" }, { "type": "text", "object_relation": "name", "value": ".rsrc", "category": "Other", "uuid": "9143f7c7-cd51-494a-9310-ec97904e65f0" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "512", "category": "Other", "uuid": "73b708ac-40ff-4625-bc96-0c88f1e79986" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--9a97fc45-451c-4aee-8940-4a554ebf286f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:26.000Z", "modified": "2018-06-17T12:32:26.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "ad711ec082866631d620286bb36fdb72", "category": "Payload delivery", "to_ids": true, "uuid": "385f884a-25f5-4950-88c4-f52210c34aba" }, { "type": "float", "object_relation": "entropy", "value": "4.752156", "category": "Other", "uuid": "4a70cc12-33d8-4cc4-98d4-28046dd05380" }, { "type": "text", "object_relation": "name", "value": ".reloc", "category": "Other", "uuid": "83aa42d4-17a8-452c-8a7f-300c6981c0da" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "2048", "category": "Other", "uuid": "05c7cb56-ea7e-4ec5-9aeb-d04245e98199" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--1d79df64-ad7a-4189-a107-1d2f27e8202c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:29.000Z", "modified": "2018-06-17T12:32:29.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "float", "object_relation": "entropy", "value": "0.68996", "category": "Other", "uuid": "cf335a8c-65a1-4861-87aa-0dc50c6b92e1" }, { "type": "md5", "object_relation": "md5", "value": "81c12eb5fc3cbdd06675cd1097363a40", "category": "Payload delivery", "to_ids": true, "uuid": "be0e5848-f63f-4a60-b44e-88e691a579e2" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "4096", "category": "Other", "uuid": "e44574c6-ce7c-4e80-a945-2d93826c6c43" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--b4d6cf82-abf9-40ea-8adf-884cac0b7dca", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:30.000Z", "modified": "2018-06-17T12:32:30.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "2539474aa6202371abd37a4d66031955", "category": "Payload delivery", "to_ids": true, "uuid": "8193f910-b6a6-4882-b2db-8953d9005fbc" }, { "type": "float", "object_relation": "entropy", "value": "6.641666", "category": "Other", "uuid": "a64b04be-5226-480a-bfd6-533d4351210a" }, { "type": "text", "object_relation": "name", "value": ".text", "category": "Other", "uuid": "82d7de21-f2e6-4063-8d5b-7706e21afb07" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "86016", "category": "Other", "uuid": "cd2231da-2e2b-4e4e-a97f-3f282001bf7a" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--1b2178c0-7302-4bf6-a196-e7088086d1e7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:30.000Z", "modified": "2018-06-17T12:32:30.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "b97c14b801643b3a61ea28266f3f71b1", "category": "Payload delivery", "to_ids": true, "uuid": "5a312721-fd48-476c-9654-e8e41472f1c4" }, { "type": "float", "object_relation": "entropy", "value": "4.735406", "category": "Other", "uuid": "b74266f1-cd11-4044-8312-00950e9ee312" }, { "type": "text", "object_relation": "name", "value": ".rdata", "category": "Other", "uuid": "875163fd-907d-4d52-a24d-02644bde7c9d" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "8192", "category": "Other", "uuid": "10bb4ac1-f150-47c4-8ded-aa009ede3f86" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f6bf304a-cd3f-4bf4-8731-e4ad2e85c5c6", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:31.000Z", "modified": "2018-06-17T12:32:31.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "48eb8a67d4fd42ea24da9dc9029cb101", "category": "Payload delivery", "to_ids": true, "uuid": "8f75c9c7-80a2-41fa-b5ab-8735956638d2" }, { "type": "float", "object_relation": "entropy", "value": "1.857068", "category": "Other", "uuid": "15bc8756-8f47-494f-840b-861e802a419b" }, { "type": "text", "object_relation": "name", "value": ".data", "category": "Other", "uuid": "ee33eb1b-d468-4e3e-9864-f0be95463ee9" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "16384", "category": "Other", "uuid": "14303c6c-455c-4e90-acf1-bd235be80e5e" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--245d12e0-fda7-41de-935c-5fc5208ea77a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:31.000Z", "modified": "2018-06-17T12:32:31.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "c139ac9cb34e0620a10c15e5d42b85d2", "category": "Payload delivery", "to_ids": true, "uuid": "9382818d-b836-4bce-be05-0dc121894ce4" }, { "type": "float", "object_relation": "entropy", "value": "1.174962", "category": "Other", "uuid": "6024c08a-0a67-468d-a7ca-5b316029ebde" }, { "type": "text", "object_relation": "name", "value": ".rsrc", "category": "Other", "uuid": "1c6d2b79-dc6c-4b92-9132-d8e6c9b6f0a6" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "4096", "category": "Other", "uuid": "aa257733-68ee-4822-92e8-a75ff29fed05" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--a5bf7615-9482-49f6-9959-55010346971f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:37.000Z", "modified": "2018-06-17T12:32:37.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "float", "object_relation": "entropy", "value": "2.558659", "category": "Other", "uuid": "6f846829-c071-4357-834a-88d3c908d07d" }, { "type": "md5", "object_relation": "md5", "value": "55b6d1ed6d76c7d17cc270bc1843d2cb", "category": "Payload delivery", "to_ids": true, "uuid": "12337d08-e2f7-4a13-b25a-9018dc6fb5a3" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "1024", "category": "Other", "uuid": "00869999-96fa-4094-8e60-8fd9643b04e5" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e20e89de-dedb-4493-9f39-d19bca906c68", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:37.000Z", "modified": "2018-06-17T12:32:37.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "6e501513865a783fa945269010ac3785", "category": "Payload delivery", "to_ids": true, "uuid": "594249fb-de2c-44c7-9c72-b883b0bbd722" }, { "type": "float", "object_relation": "entropy", "value": "6.390707", "category": "Other", "uuid": "5399e04c-6797-4851-9c02-4498d8fedeb8" }, { "type": "text", "object_relation": "name", "value": ".text", "category": "Other", "uuid": "28cf08e9-586f-40ff-88e6-24f58b74ef7b" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "69632", "category": "Other", "uuid": "d63e0b10-bf65-429e-a385-577f4a7ca1d4" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--a640c76e-6b15-4f46-bb4a-3c41a62700c5", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:38.000Z", "modified": "2018-06-17T12:32:38.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "45584c7afdc086b651d7299673643506", "category": "Payload delivery", "to_ids": true, "uuid": "2a4a9051-94ca-498b-ace2-73b414564804" }, { "type": "float", "object_relation": "entropy", "value": "4.704433", "category": "Other", "uuid": "7633f9f1-2783-41d6-9348-b190763c9718" }, { "type": "text", "object_relation": "name", "value": ".rdata", "category": "Other", "uuid": "0214cb1a-7528-4f12-bcd6-f954bb7d6323" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "24064", "category": "Other", "uuid": "7403a39b-afb6-4849-bef1-16b02e384da7" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--940a978d-4e70-4357-a7c1-2e1a9e80b784", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:38.000Z", "modified": "2018-06-17T12:32:38.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--fe2d8b67-f422-4335-be73-542f40ee8559", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:39.000Z", "modified": "2018-06-17T12:32:39.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "de3fe99833797faa77379640174d16c4", "category": "Payload delivery", "to_ids": true, "uuid": "26ce7da5-8330-403a-babf-afa9f4e8bbbc" }, { "type": "float", "object_relation": "entropy", "value": "4.786623", "category": "Other", "uuid": "7fbfbec0-c2a2-4968-beb9-2bcd00bf4234" }, { "type": "text", "object_relation": "name", "value": ".pdata", "category": "Other", "uuid": "4d3c86ab-bd7e-4d16-8645-8faf593a8b0e" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "4096", "category": "Other", "uuid": "af55cdc6-ae33-4a93-a0f1-183d270362ad" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c11a828a-e1d5-4299-9329-7908ca5aeea8", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:39.000Z", "modified": "2018-06-17T12:32:39.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "0cc425d0556c63acb7c04b9b1a211d5b", "category": "Payload delivery", "to_ids": true, "uuid": "fdac98ce-e37a-4a40-a5fa-6cbae5a0d41d" }, { "type": "float", "object_relation": "entropy", "value": "5.105006", "category": "Other", "uuid": "fab78eda-b6fc-4db9-9983-f7c622a5b838" }, { "type": "text", "object_relation": "name", "value": ".rsrc", "category": "Other", "uuid": "9f7e4bc6-7a0f-4830-9152-696b88b5719d" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "512", "category": "Other", "uuid": "5f0f9cfa-6975-4e6e-bdec-05c056a9b3b2" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f5d96ec9-8867-4032-8088-5c539234665c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:40.000Z", "modified": "2018-06-17T12:32:40.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "914f25782a74f42e42d7974b13bd01c8", "category": "Payload delivery", "to_ids": true, "uuid": "af06b21f-d9a4-44d7-91e4-1e533736ec2d" }, { "type": "float", "object_relation": "entropy", "value": "2.869845", "category": "Other", "uuid": "2a4ff6aa-6535-4cc3-bb2b-3bcf214b5924" }, { "type": "text", "object_relation": "name", "value": ".reloc", "category": "Other", "uuid": "18e88c8c-0485-4da2-b13b-34bc3ca648b5" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "1536", "category": "Other", "uuid": "4552ec2e-a15f-4e81-a1ce-ba951b0585ba" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--90eb0a08-a0d8-49c6-8ec7-dccc20d06199", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:46.000Z", "modified": "2018-06-17T12:32:46.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "float", "object_relation": "entropy", "value": "2.623906", "category": "Other", "uuid": "4f20d754-af06-4bf8-a089-e1604183d051" }, { "type": "md5", "object_relation": "md5", "value": "2082ea5adc4b910e8673c04dc7d962d2", "category": "Payload delivery", "to_ids": true, "uuid": "77867ffc-adae-4cb2-b0b7-31f5a2fcaf04" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "1024", "category": "Other", "uuid": "746ff0db-a29c-47e9-b429-a582329f3bee" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--073bfabc-0580-4fde-8659-c3854029937d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:46.000Z", "modified": "2018-06-17T12:32:46.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "e6e5ce270a5e80221a815dbf739883a2", "category": "Payload delivery", "to_ids": true, "uuid": "e49319ec-2ee0-40a3-8ff4-3c94373b1bd2" }, { "type": "float", "object_relation": "entropy", "value": "6.434048", "category": "Other", "uuid": "efff8e0d-ca3c-482e-909f-517d3b0f429e" }, { "type": "text", "object_relation": "name", "value": ".text", "category": "Other", "uuid": "dfb19b82-e9d3-4b43-8eac-c37e3fcfe445" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "111616", "category": "Other", "uuid": "9ea0245b-8cf8-4e5d-99d4-f5fb3222d571" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e5f2a5b2-f9b6-4536-8068-1e610b0a5b17", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:47.000Z", "modified": "2018-06-17T12:32:47.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--592953b3-0474-4ad1-8942-757124e30a99", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:47.000Z", "modified": "2018-06-17T12:32:47.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--d4bf7b4c-7f49-46cd-94a6-c12dc5a471eb", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:48.000Z", "modified": "2018-06-17T12:32:48.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--3a63168f-d604-46d2-80c0-d24afea4639b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:48.000Z", "modified": "2018-06-17T12:32:48.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c8df1989-af8f-49db-838c-ef2f8bb96eb5", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:49.000Z", "modified": "2018-06-17T12:32:49.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--81962a81-10c7-4f4d-ba8b-b9df3d5d741d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:52.000Z", "modified": "2018-06-17T12:32:52.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "float", "object_relation": "entropy", "value": "0.736742", "category": "Other", "uuid": "fc7e52c1-6011-43c6-86de-e8aaab9a61de" }, { "type": "md5", "object_relation": "md5", "value": "f066de8df54d4f92795472d981374309", "category": "Payload delivery", "to_ids": true, "uuid": "4e34dda4-b9ad-4519-959a-0825f5d71bb3" }, { "type": "md5", "object_relation": "md5", "value": "f066de8df54d4f92795472d981374309", "category": "Payload delivery", "to_ids": true, "uuid": "d42cac4e-b0d6-46d6-9f8a-f35f08f40a06" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "4096", "category": "Other", "uuid": "494565ac-b506-4c9a-9af8-7d6b07e59ab3" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--0f3b61d8-1fdd-408b-9710-61e6e3a05220", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:52.000Z", "modified": "2018-06-17T12:32:52.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "e321dba33ae4db3b9e29aa6072b92e77", "category": "Payload delivery", "to_ids": true, "uuid": "6656b273-6c7a-4832-a86c-c2e3f7a660dc" }, { "type": "float", "object_relation": "entropy", "value": "6.464385", "category": "Other", "uuid": "2e222367-ab5f-4682-8801-5e1df46ec400" }, { "type": "text", "object_relation": "name", "value": ".text", "category": "Other", "uuid": "0107108d-10f0-43c8-95db-edddeefda13b" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "57344", "category": "Other", "uuid": "08610deb-6845-469f-bff4-eb4952548ea2" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5690876b-7f5b-4032-bb10-3f690b1ce2cd", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:53.000Z", "modified": "2018-06-17T12:32:53.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "e321dba33ae4db3b9e29aa6072b92e77", "category": "Payload delivery", "to_ids": true, "uuid": "0c9f8b24-4858-41b6-84ee-3cdc6d14c88d" }, { "type": "float", "object_relation": "entropy", "value": "6.464385", "category": "Other", "uuid": "57a2e7f2-3dd1-4271-a6ef-f60f642c14ad" }, { "type": "text", "object_relation": "name", "value": ".text", "category": "Other", "uuid": "cec5ad39-baa9-4390-953f-f4a921c5c4d4" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "57344", "category": "Other", "uuid": "7fcb8b99-d6ed-419b-b839-b59567bbaa05" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--05809cc2-e217-49db-a128-b8b63d1b5171", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:54.000Z", "modified": "2018-06-17T12:32:54.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "a256d5f52608331df8545a9d38751462", "category": "Payload delivery", "to_ids": true, "uuid": "080b39a2-0110-4edc-a43c-a9484d0f01d8" }, { "type": "float", "object_relation": "entropy", "value": "3.62856", "category": "Other", "uuid": "fd32f17e-c693-4ae4-86a9-220e71e8ff3d" }, { "type": "text", "object_relation": "name", "value": ".rdata", "category": "Other", "uuid": "9e32adde-d36d-446c-bec6-c68ce69cd29d" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "8192", "category": "Other", "uuid": "68d693c4-6d58-4174-a992-04bd071efdeb" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--58af18ac-7fad-4504-85de-90947ece0028", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:54.000Z", "modified": "2018-06-17T12:32:54.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "a256d5f52608331df8545a9d38751462", "category": "Payload delivery", "to_ids": true, "uuid": "69c33713-7739-4f5e-a7e3-d58476a58de6" }, { "type": "float", "object_relation": "entropy", "value": "3.62856", "category": "Other", "uuid": "4311be4a-1510-4945-ae3c-d5bcb855ab5c" }, { "type": "text", "object_relation": "name", "value": ".rdata", "category": "Other", "uuid": "857498ed-6f15-4196-8d87-3b2522567d38" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "8192", "category": "Other", "uuid": "3ee3d7b1-1268-4b31-b195-679c3fb83b1c" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--75cd1bef-0d6e-4c7f-bc48-293403212159", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:55.000Z", "modified": "2018-06-17T12:32:55.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "1d905ad87919346eb6c8463f61b599e8", "category": "Payload delivery", "to_ids": true, "uuid": "8c837b33-91dd-44e1-a433-145918d62c3e" }, { "type": "float", "object_relation": "entropy", "value": "1.547483", "category": "Other", "uuid": "6d8b2665-bdd9-4b08-98c9-71eff4a95c71" }, { "type": "text", "object_relation": "name", "value": ".data", "category": "Other", "uuid": "0d60a67c-0f8e-4dd3-b20e-4ff453638f33" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "16384", "category": "Other", "uuid": "2b4024d6-5a16-4d3c-8d50-d142267c9bd5" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e1eb04f2-bccb-4dd0-9f93-a1f2ccb4e650", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:55.000Z", "modified": "2018-06-17T12:32:55.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "1d905ad87919346eb6c8463f61b599e8", "category": "Payload delivery", "to_ids": true, "uuid": "cc978b97-e011-4b39-baa6-83cf5041703f" }, { "type": "float", "object_relation": "entropy", "value": "1.547483", "category": "Other", "uuid": "5b1c2cd7-1fa1-4f92-b2a2-eae73347d002" }, { "type": "text", "object_relation": "name", "value": ".data", "category": "Other", "uuid": "6c3936b8-dd84-4b92-9d71-712e542bd4c5" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "16384", "category": "Other", "uuid": "6f514aa7-57c0-49a9-9a7b-2f22321f196a" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5ddcf5da-400b-4bad-b4f3-9dd0708a6644", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:56.000Z", "modified": "2018-06-17T12:32:56.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "afdf2120655e37010482a536d552199e", "category": "Payload delivery", "to_ids": true, "uuid": "99f5f2f6-5baa-4c45-94e1-ddff00cf07ea" }, { "type": "float", "object_relation": "entropy", "value": "7.100033", "category": "Other", "uuid": "a1e21134-1f3c-4e92-aae6-42379c3da323" }, { "type": "text", "object_relation": "name", "value": ".rsrc", "category": "Other", "uuid": "494d887a-1d0f-409f-a595-aaf5caf25c66" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "32768", "category": "Other", "uuid": "6124ec92-36cb-438b-a015-afa57fceec91" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--52d6ebd2-4ad3-44c5-9029-ccbff450c8b7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:56.000Z", "modified": "2018-06-17T12:32:56.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "afdf2120655e37010482a536d552199e", "category": "Payload delivery", "to_ids": true, "uuid": "686fbb2b-c415-4079-9ce3-98c34cf8d5b8" }, { "type": "float", "object_relation": "entropy", "value": "7.100033", "category": "Other", "uuid": "61a03fd9-9828-4b54-b80a-1a73ddcedb89" }, { "type": "text", "object_relation": "name", "value": ".rsrc", "category": "Other", "uuid": "e1eb6292-bff0-4bee-8a3d-1801bc5535c6" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "32768", "category": "Other", "uuid": "aa9f8684-a9c1-41c5-8cb9-acd831c71bc5" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--59e02386-d00c-417d-b9c1-7a1dce691aad", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:57.000Z", "modified": "2018-06-17T12:32:57.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "bbeec3983cc5b2094f8311718d327480", "category": "Payload delivery", "to_ids": true, "uuid": "8a17878e-ae39-4389-b735-22c96fdb12ac" }, { "type": "float", "object_relation": "entropy", "value": "3.234713", "category": "Other", "uuid": "c4a78694-bbed-4f91-91b0-b95a9d843611" }, { "type": "text", "object_relation": "name", "value": ".reloc", "category": "Other", "uuid": "c261f65c-d412-48de-961e-d515053ab4b2" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "8192", "category": "Other", "uuid": "211934d9-2206-4993-ae25-72076f830b38" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--dee24e7d-32ac-427d-a6be-952cf291e5f6", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-06-17T12:32:58.000Z", "modified": "2018-06-17T12:32:58.000Z", "labels": [ "misp:name=\"pe-section\"", "misp:meta-category=\"file\"" ], "x_misp_attributes": [ { "type": "md5", "object_relation": "md5", "value": "bbeec3983cc5b2094f8311718d327480", "category": "Payload delivery", "to_ids": true, "uuid": "37431fbf-1e5d-4a02-bff9-bb3ecf2d3a0e" }, { "type": "float", "object_relation": "entropy", "value": "3.234713", "category": "Other", "uuid": "5b1f36af-aa43-4bf1-b1f7-3688a70e9bee" }, { "type": "text", "object_relation": "name", "value": ".reloc", "category": "Other", "uuid": "11f28e1c-8719-4b63-8bc0-9bb631db7792" }, { "type": "size-in-bytes", "object_relation": "size-in-bytes", "value": "8192", "category": "Other", "uuid": "b0a0607b-0f9c-4442-9b61-bf940e11d278" } ], "x_misp_meta_category": "file", "x_misp_name": "pe-section" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7b622deb-1c41-4317-a123-2eaeb8b29793", "created": "2018-06-17T12:33:01.000Z", "modified": "2018-06-17T12:33:01.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--331a2fb4-3f10-45ca-89c9-60cf96c9205f", "target_ref": "x-misp-object--2c6f9016-4377-447f-84df-ddc4c2d59f35" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb31a47e-429c-43c3-8c04-6103ed1cc6de", "created": "2018-06-17T12:33:02.000Z", "modified": "2018-06-17T12:33:02.000Z", "relationship_type": "contained-within", "source_ref": "x-misp-object--2c6f9016-4377-447f-84df-ddc4c2d59f35", "target_ref": "x-misp-object--331a2fb4-3f10-45ca-89c9-60cf96c9205f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c4dbacbd-e03e-4e67-a5f7-494b7ccce961", "created": "2018-06-17T12:33:02.000Z", "modified": "2018-06-17T12:33:02.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--bd2613b3-ef57-4c37-9e55-26e51493ba3a", "target_ref": "x-misp-object--16c183f2-2c3f-4304-ad99-9e19c2323ee0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1facf535-531f-462f-bd04-7945eb1dccab", "created": "2018-06-17T12:33:03.000Z", "modified": "2018-06-17T12:33:03.000Z", "relationship_type": "contained-within", "source_ref": "x-misp-object--16c183f2-2c3f-4304-ad99-9e19c2323ee0", "target_ref": "x-misp-object--bd2613b3-ef57-4c37-9e55-26e51493ba3a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--49ff7b04-791c-4e57-b676-be98222ae2b8", "created": "2018-06-17T12:33:04.000Z", "modified": "2018-06-17T12:33:04.000Z", "relationship_type": "contains", "source_ref": "indicator--1dd9ce3a-5709-4b5b-9dd2-12d9bf32e1d0", "target_ref": "indicator--c2593c36-69f5-4c43-9fcc-b335d606d569" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c1506d8-ed51-4502-b62c-6e9d9ceba718", "created": "2018-06-17T12:33:05.000Z", "modified": "2018-06-17T12:33:05.000Z", "relationship_type": "contained-within", "source_ref": "indicator--c2593c36-69f5-4c43-9fcc-b335d606d569", "target_ref": "indicator--1dd9ce3a-5709-4b5b-9dd2-12d9bf32e1d0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e1da164-6a5a-4621-bbb7-ae0cf2afca17", "created": "2018-06-17T12:33:05.000Z", "modified": "2018-06-17T12:33:05.000Z", "relationship_type": "contains", "source_ref": "indicator--35046b12-4171-4598-ab66-f6c536f03862", "target_ref": "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f3f7b81d-15a4-4d59-8dd8-8728c04bfa85", "created": "2018-06-17T12:33:06.000Z", "modified": "2018-06-17T12:33:06.000Z", "relationship_type": "contained-within", "source_ref": "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f", "target_ref": "indicator--35046b12-4171-4598-ab66-f6c536f03862" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--883da042-b6d4-47a8-a490-c41de8a9c2dc", "created": "2018-06-17T12:40:50.000Z", "modified": "2018-06-17T12:40:50.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f", "target_ref": "x-misp-object--450c3377-2c9b-4b69-8381-f51dfe41f149" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--843e7d19-3683-4fdf-954d-3ec5cdfb0634", "created": "2018-06-17T12:33:06.000Z", "modified": "2018-06-17T12:33:06.000Z", "relationship_type": "contains", "source_ref": "indicator--a84b8d9c-0175-411b-8b89-fc0ac709df56", "target_ref": "indicator--f94d3e39-27ea-4214-bb44-c25505dc2326" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3a3cc2eb-a5bb-433b-a0ed-25f3f387da24", "created": "2018-06-17T12:33:06.000Z", "modified": "2018-06-17T12:33:06.000Z", "relationship_type": "contained-within", "source_ref": "indicator--f94d3e39-27ea-4214-bb44-c25505dc2326", "target_ref": "indicator--a84b8d9c-0175-411b-8b89-fc0ac709df56" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }