{
    "type": "bundle",
    "id": "bundle--59245883-c54c-4072-b07f-6a00950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:15.000Z",
            "modified": "2017-05-23T15:43:15.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "grouping",
            "spec_version": "2.1",
            "id": "grouping--59245883-c54c-4072-b07f-6a00950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:15.000Z",
            "modified": "2017-05-23T15:43:15.000Z",
            "name": "Password-protected docs 2017-05-23 : Ursnif 2002 - \"C John Doe\" - \"ab1_c23def4lg56hi#78j.docx\"",
            "context": "suspicious-activity",
            "object_refs": [
                "indicator--59245893-31c8-42b2-b8c0-c159950d210f",
                "indicator--5924588d-a82c-4ebd-9de1-6bfa950d210f",
                "indicator--5924588f-347c-421e-9bef-46cf950d210f",
                "indicator--59245892-06a8-4a29-a872-6b79950d210f",
                "indicator--59245885-37f4-45e5-a504-180d950d210f",
                "indicator--59245888-0318-4f98-a9b3-c150950d210f",
                "indicator--59245889-bc34-4517-abf1-9198950d210f",
                "indicator--5924588a-94bc-4917-88c9-69b6950d210f",
                "indicator--5924588b-3584-454d-a6c9-c154950d210f",
                "indicator--5924588c-02bc-4e47-b456-c153950d210f",
                "indicator--59245884-3dc8-4d88-b419-c14e950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59245893-31c8-42b2-b8c0-c159950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:15.000Z",
            "modified": "2017-05-23T15:43:15.000Z",
            "pattern": "[url:value = 'advisedhtdisclaimerth.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5924588d-a82c-4ebd-9de1-6bfa950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:09.000Z",
            "modified": "2017-05-23T15:43:09.000Z",
            "pattern": "[url:value = 'http://www.php.net/license/3_0.txt']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5924588f-347c-421e-9bef-46cf950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:11.000Z",
            "modified": "2017-05-23T15:43:11.000Z",
            "pattern": "[domain-name:value = 'www.php.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59245892-06a8-4a29-a872-6b79950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:14.000Z",
            "modified": "2017-05-23T15:43:14.000Z",
            "description": "www.php.net",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '82.100.240.32']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:14Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59245885-37f4-45e5-a504-180d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:01.000Z",
            "modified": "2017-05-23T15:43:01.000Z",
            "pattern": "[file:hashes.MD5 = '12ffff6f269599e64c1f9ae1a4d7661c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59245888-0318-4f98-a9b3-c150950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:04.000Z",
            "modified": "2017-05-23T15:43:04.000Z",
            "pattern": "[url:value = 'http://kosbal.uv.ro/main.txt']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59245889-bc34-4517-abf1-9198950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:05.000Z",
            "modified": "2017-05-23T15:43:05.000Z",
            "pattern": "[domain-name:value = 'kosbal.uv.ro']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5924588a-94bc-4917-88c9-69b6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:06.000Z",
            "modified": "2017-05-23T15:43:06.000Z",
            "description": "kosbal.uv.ro",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.216.151.56']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5924588b-3584-454d-a6c9-c154950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:07.000Z",
            "modified": "2017-05-23T15:43:07.000Z",
            "pattern": "[url:value = 'http://91.210.166.177/un.jpg']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5924588c-02bc-4e47-b456-c153950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:08.000Z",
            "modified": "2017-05-23T15:43:08.000Z",
            "pattern": "[domain-name:value = '91.210.166.177']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59245884-3dc8-4d88-b419-c14e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-23T15:43:00.000Z",
            "modified": "2017-05-23T15:43:00.000Z",
            "pattern": "[file:hashes.MD5 = '21ecba6d854567d63f59258a49ed0d91']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-05-23T15:43:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}