{
  "Event": {
    "analysis": "2",
    "date": "2015-07-15",
    "extends_uuid": "",
    "info": "OSINT Microsoft Office Zero-Day CVE-2015-2424 Leveraged By Tsar Team report by iSight",
    "publish_timestamp": "1466001432",
    "published": true,
    "threat_level_id": "1",
    "timestamp": "1466000979",
    "uuid": "5761398f-31d0-46b0-808f-41de950d210f",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": "0",
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989581",
        "to_ids": false,
        "type": "link",
        "uuid": "576139cd-c990-43a1-a4a8-4bf3950d210f",
        "value": "https://www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989606",
        "to_ids": true,
        "type": "md5",
        "uuid": "576139e6-3f30-4918-b364-4153950d210f",
        "value": "112c64f7c07a959a1cbff6621850a4ad"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989661",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "57613a1d-35ec-44c0-8aec-4b7f950d210f",
        "value": "66.172.11.207"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989661",
        "to_ids": true,
        "type": "domain",
        "uuid": "57613a1d-2914-4a97-aa60-44c8950d210f",
        "value": "wscapi.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989661",
        "to_ids": true,
        "type": "domain",
        "uuid": "57613a1d-6308-40a1-845c-4a40950d210f",
        "value": "tabsync.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989661",
        "to_ids": true,
        "type": "domain",
        "uuid": "57613a1d-13dc-43ee-8402-4e0c950d210f",
        "value": "storsvc.org"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989686",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "57613a36-abb0-413a-abcf-48ea950d210f",
        "value": "APT28"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989687",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "57613a37-0114-48a8-8e8a-4be9950d210f",
        "value": "Sofacy"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1465989687",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "57613a37-a08c-4103-874e-403f950d210f",
        "value": "Tsar Team"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 112c64f7c07a959a1cbff6621850a4ad",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1466000979",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57616653-a3f8-4374-9d69-b45602de0b81",
        "value": "9e5fbd79d8febe7a162cd5200041772db60dc83244605b1ff37ef8d14334f512"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 112c64f7c07a959a1cbff6621850a4ad",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1466000979",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57616653-8898-4177-ae78-b45602de0b81",
        "value": "e7f7f6caaede6cc29c2e7e4888019f2d1be37cef"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 112c64f7c07a959a1cbff6621850a4ad",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1466000980",
        "to_ids": false,
        "type": "link",
        "uuid": "57616654-5384-4905-8b97-b45602de0b81",
        "value": "https://www.virustotal.com/file/9e5fbd79d8febe7a162cd5200041772db60dc83244605b1ff37ef8d14334f512/analysis/1464765865/"
      }
    ]
  }
}