{
    "type": "bundle",
    "id": "bundle--57a89edc-e184-41da-8e51-4f98950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:54.000Z",
            "modified": "2016-08-08T15:36:54.000Z",
            "name": "CthulhuSPRL.be",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--57a89edc-e184-41da-8e51-4f98950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:54.000Z",
            "modified": "2016-08-08T15:36:54.000Z",
            "name": "OSINT Group5: Syria and the Iranian Connection by Citizen Lab",
            "published": "2016-08-09T07:35:10Z",
            "object_refs": [
                "observed-data--57a89ef1-3684-48b6-9cd9-4cec950d210f",
                "url--57a89ef1-3684-48b6-9cd9-4cec950d210f",
                "indicator--57a89f46-5164-4d62-8950-4010950d210f",
                "indicator--57a89f5b-3f98-466d-b470-45ae950d210f",
                "indicator--57a89f5c-d490-4b3d-a562-4ea1950d210f",
                "indicator--57a89f6f-88e4-4f31-bf88-415d950d210f",
                "indicator--57a89f6f-7f94-4071-8a23-4708950d210f",
                "indicator--57a89fab-e96c-48d6-9442-4b20950d210f",
                "x-misp-attribute--57a8a01e-2584-4989-b50e-459f950d210f",
                "x-misp-attribute--57a8a01e-e384-4834-900a-4bf6950d210f",
                "x-misp-attribute--57a8a01e-8d70-4809-a4c1-4158950d210f",
                "indicator--57a8a053-5038-4cb1-ac18-4dcc950d210f",
                "indicator--57a8a053-b898-48f8-9c30-4008950d210f",
                "indicator--57a8a053-1490-4c4e-88b5-4c61950d210f",
                "indicator--57a8a053-b750-48d2-9d45-4063950d210f",
                "indicator--57a8a053-2210-463f-b62e-4265950d210f",
                "indicator--57a8a054-3510-4d4b-bd37-40e7950d210f",
                "indicator--57a8a054-5cc4-4553-b98f-413a950d210f",
                "indicator--57a8a054-b8ec-46a3-b7fe-4c77950d210f",
                "indicator--57a8a054-20dc-40ab-8aed-4d5e950d210f",
                "indicator--57a8a054-cf94-4942-8e56-466f950d210f",
                "indicator--57a8a055-6638-4b69-9e04-43a9950d210f",
                "indicator--57a8a055-731c-479e-a426-466c950d210f",
                "indicator--57a8a716-1d6c-41e8-be1b-4d2902de0b81",
                "indicator--57a8a717-d62c-4284-a088-47df02de0b81",
                "observed-data--57a8a717-834c-4153-b603-4d9902de0b81",
                "url--57a8a717-834c-4153-b603-4d9902de0b81",
                "indicator--57a8a717-7ec4-42fc-b873-440e02de0b81",
                "indicator--57a8a717-84cc-4665-8892-4e7e02de0b81",
                "observed-data--57a8a717-2594-4bb1-b473-49cc02de0b81",
                "url--57a8a717-2594-4bb1-b473-49cc02de0b81",
                "indicator--57a8a717-c404-4e9f-9104-41b902de0b81",
                "indicator--57a8a718-aef0-42d1-a4d8-419202de0b81",
                "observed-data--57a8a718-f384-49b9-89d6-4bbe02de0b81",
                "url--57a8a718-f384-49b9-89d6-4bbe02de0b81",
                "indicator--57a8a718-32a8-4164-9838-450302de0b81",
                "indicator--57a8a718-25ac-479c-96fa-403602de0b81",
                "observed-data--57a8a718-4c30-445b-81d3-4d5902de0b81",
                "url--57a8a718-4c30-445b-81d3-4d5902de0b81",
                "indicator--57a8a719-d824-49f3-bd2f-4dae02de0b81",
                "indicator--57a8a719-0518-4529-875f-425c02de0b81",
                "observed-data--57a8a719-c3a4-4e5b-ac9d-4d5f02de0b81",
                "url--57a8a719-c3a4-4e5b-ac9d-4d5f02de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57a89ef1-3684-48b6-9cd9-4cec950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:02:09.000Z",
            "modified": "2016-08-08T15:02:09.000Z",
            "first_observed": "2016-08-08T15:02:09Z",
            "last_observed": "2016-08-08T15:02:09Z",
            "number_observed": 1,
            "object_refs": [
                "url--57a89ef1-3684-48b6-9cd9-4cec950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57a89ef1-3684-48b6-9cd9-4cec950d210f",
            "value": "https://citizenlab.org/2016/08/group5-syria/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a89f46-5164-4d62-8950-4010950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:03:34.000Z",
            "modified": "2016-08-08T15:03:34.000Z",
            "pattern": "[file:hashes.MD5 = '76f8142b4e52c671871b3df87f10c30c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:03:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a89f5b-3f98-466d-b470-45ae950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:03:55.000Z",
            "modified": "2016-08-08T15:03:55.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:hashes.MD5 = '7d898530d2e77f15f5badce8d7df215e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:03:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a89f5c-d490-4b3d-a562-4ea1950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:03:56.000Z",
            "modified": "2016-08-08T15:03:56.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:hashes.SHA256 = 'c19bc1ff5f8472fb7ba64f33c2168b42ea881a6ae6e134a1cc142e984fb6647f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:03:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a89f6f-88e4-4f31-bf88-415d950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:04:15.000Z",
            "modified": "2016-08-08T15:04:15.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:hashes.MD5 = 'a4f1f4921bb11ff9d22fad89b19b155d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:04:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a89f6f-7f94-4071-8a23-4708950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:04:15.000Z",
            "modified": "2016-08-08T15:04:15.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:hashes.SHA256 = 'd81ec563387e2ea47bc8ed50fd36e1de955cb2331d6eaae9f966b5d7ab094806']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:04:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a89fab-e96c-48d6-9442-4b20950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:05:15.000Z",
            "modified": "2016-08-08T15:05:15.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '88.198.222.163']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:05:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--57a8a01e-2584-4989-b50e-459f950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:07:10.000Z",
            "modified": "2016-08-08T15:07:10.000Z",
            "labels": [
                "misp:type=\"pdb\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Artifacts dropped",
            "x_misp_type": "pdb",
            "x_misp_value": "%USERPROFILE%\\documents\\visual studio 2013\\projects\\paccryptnano core dehgani -vds\\windowsapplication2\\obj\\debug\\launch manager.pdb"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--57a8a01e-e384-4834-900a-4bf6950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:07:10.000Z",
            "modified": "2016-08-08T15:07:10.000Z",
            "labels": [
                "misp:type=\"pdb\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Artifacts dropped",
            "x_misp_type": "pdb",
            "x_misp_value": "%USERPROFILE%\\Documents\\Visual Studio 2013\\Projects\\paccrypt11njratmalii\\paccryptalipnahzade\\obj\\Debug\\LManager.pdb"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--57a8a01e-8d70-4809-a4c1-4158950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:07:10.000Z",
            "modified": "2016-08-08T15:07:10.000Z",
            "labels": [
                "misp:type=\"pdb\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Artifacts dropped",
            "x_misp_type": "pdb",
            "x_misp_value": "%USERPROFILE%\\Documents\\Visual Studio 2013\\Projects\\njrat7stubsoures \u00e2\u20ac\u201c Copy\\njrat7stubsoures\\obj\\Debug\\dvvm.pdb"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a053-5038-4cb1-ac18-4dcc950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:03.000Z",
            "modified": "2016-08-08T15:08:03.000Z",
            "pattern": "[file:hashes.MD5 = '2fc276e1c06c3c78c6d7b66a141213be']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a053-b898-48f8-9c30-4008950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:03.000Z",
            "modified": "2016-08-08T15:08:03.000Z",
            "pattern": "[file:hashes.MD5 = '30bb678db3ad0140fc33acd9803385c3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a053-1490-4c4e-88b5-4c61950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:03.000Z",
            "modified": "2016-08-08T15:08:03.000Z",
            "pattern": "[file:hashes.MD5 = '366908f6c5c4f4329478d60586eca5bc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a053-b750-48d2-9d45-4063950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:03.000Z",
            "modified": "2016-08-08T15:08:03.000Z",
            "pattern": "[file:hashes.MD5 = '494bab7fd0b42b0b14051ed9abbd651f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a053-2210-463f-b62e-4265950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:03.000Z",
            "modified": "2016-08-08T15:08:03.000Z",
            "pattern": "[file:hashes.MD5 = '5c4ec3d93a664e4bfa1ce6286ccf0249']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a054-3510-4d4b-bd37-40e7950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:04.000Z",
            "modified": "2016-08-08T15:08:04.000Z",
            "pattern": "[file:hashes.MD5 = '6161083021b695814434450c1882f9f3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a054-5cc4-4553-b98f-413a950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:04.000Z",
            "modified": "2016-08-08T15:08:04.000Z",
            "pattern": "[file:hashes.MD5 = '7d898530d2e77f15f5badce8d7df215e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a054-b8ec-46a3-b7fe-4c77950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:04.000Z",
            "modified": "2016-08-08T15:08:04.000Z",
            "pattern": "[file:hashes.MD5 = '8ebeb3f91cda8e985a9c61beb8cdde9d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a054-20dc-40ab-8aed-4d5e950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:04.000Z",
            "modified": "2016-08-08T15:08:04.000Z",
            "pattern": "[file:hashes.MD5 = 'a4f1f4921bb11ff9d22fad89b19b155d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a054-cf94-4942-8e56-466f950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:04.000Z",
            "modified": "2016-08-08T15:08:04.000Z",
            "pattern": "[file:hashes.MD5 = 'b4121c3a1892332402000ef0d587c0ee']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:04Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a055-6638-4b69-9e04-43a9950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:05.000Z",
            "modified": "2016-08-08T15:08:05.000Z",
            "pattern": "[file:hashes.MD5 = 'dd5bedd915967c5efe00733cf7478cb4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a055-731c-479e-a426-466c950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:08:05.000Z",
            "modified": "2016-08-08T15:08:05.000Z",
            "pattern": "[file:hashes.MD5 = 'f1f84ea3229dca0ccacb7381a2f49f99']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:08:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a716-1d6c-41e8-be1b-4d2902de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:54.000Z",
            "modified": "2016-08-08T15:36:54.000Z",
            "description": "- Xchecked via VT: f1f84ea3229dca0ccacb7381a2f49f99",
            "pattern": "[file:hashes.SHA256 = '29cedb039e43988730c13f702deb3cb90e2fd9927538d172ad7e1ed50f8ca67b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a717-d62c-4284-a088-47df02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:55.000Z",
            "modified": "2016-08-08T15:36:55.000Z",
            "description": "- Xchecked via VT: f1f84ea3229dca0ccacb7381a2f49f99",
            "pattern": "[file:hashes.SHA1 = '9801609d68d925b9dc9ef653be10467b1bcc3b92']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57a8a717-834c-4153-b603-4d9902de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:55.000Z",
            "modified": "2016-08-08T15:36:55.000Z",
            "first_observed": "2016-08-08T15:36:55Z",
            "last_observed": "2016-08-08T15:36:55Z",
            "number_observed": 1,
            "object_refs": [
                "url--57a8a717-834c-4153-b603-4d9902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57a8a717-834c-4153-b603-4d9902de0b81",
            "value": "https://www.virustotal.com/file/29cedb039e43988730c13f702deb3cb90e2fd9927538d172ad7e1ed50f8ca67b/analysis/1470114448/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a717-7ec4-42fc-b873-440e02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:55.000Z",
            "modified": "2016-08-08T15:36:55.000Z",
            "description": "- Xchecked via VT: 8ebeb3f91cda8e985a9c61beb8cdde9d",
            "pattern": "[file:hashes.SHA256 = '19febea0be411a36ea9cdc46241242fe103d043a8aaf932cba53cf8f04a54973']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a717-84cc-4665-8892-4e7e02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:55.000Z",
            "modified": "2016-08-08T15:36:55.000Z",
            "description": "- Xchecked via VT: 8ebeb3f91cda8e985a9c61beb8cdde9d",
            "pattern": "[file:hashes.SHA1 = 'bbf4836a86604d1f54a8d3335653625c5f813e71']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57a8a717-2594-4bb1-b473-49cc02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:55.000Z",
            "modified": "2016-08-08T15:36:55.000Z",
            "first_observed": "2016-08-08T15:36:55Z",
            "last_observed": "2016-08-08T15:36:55Z",
            "number_observed": 1,
            "object_refs": [
                "url--57a8a717-2594-4bb1-b473-49cc02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57a8a717-2594-4bb1-b473-49cc02de0b81",
            "value": "https://www.virustotal.com/file/19febea0be411a36ea9cdc46241242fe103d043a8aaf932cba53cf8f04a54973/analysis/1470114667/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a717-c404-4e9f-9104-41b902de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:55.000Z",
            "modified": "2016-08-08T15:36:55.000Z",
            "description": "- Xchecked via VT: 494bab7fd0b42b0b14051ed9abbd651f",
            "pattern": "[file:hashes.SHA256 = '511801eda3d01c580f1e999f5c9d50d0f0d539d560e6d2476a9ee822029bafd8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a718-aef0-42d1-a4d8-419202de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:56.000Z",
            "modified": "2016-08-08T15:36:56.000Z",
            "description": "- Xchecked via VT: 494bab7fd0b42b0b14051ed9abbd651f",
            "pattern": "[file:hashes.SHA1 = 'e555e5d99d1f52b484aa1c26ec45cb2dce054203']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57a8a718-f384-49b9-89d6-4bbe02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:56.000Z",
            "modified": "2016-08-08T15:36:56.000Z",
            "first_observed": "2016-08-08T15:36:56Z",
            "last_observed": "2016-08-08T15:36:56Z",
            "number_observed": 1,
            "object_refs": [
                "url--57a8a718-f384-49b9-89d6-4bbe02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57a8a718-f384-49b9-89d6-4bbe02de0b81",
            "value": "https://www.virustotal.com/file/511801eda3d01c580f1e999f5c9d50d0f0d539d560e6d2476a9ee822029bafd8/analysis/1470114544/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a718-32a8-4164-9838-450302de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:56.000Z",
            "modified": "2016-08-08T15:36:56.000Z",
            "description": "- Xchecked via VT: 30bb678db3ad0140fc33acd9803385c3",
            "pattern": "[file:hashes.SHA256 = 'dd35724d3d1167d917234d0321aa5b874d15cb62d2e95a246a96d6c0b77580c9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a718-25ac-479c-96fa-403602de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:56.000Z",
            "modified": "2016-08-08T15:36:56.000Z",
            "description": "- Xchecked via VT: 30bb678db3ad0140fc33acd9803385c3",
            "pattern": "[file:hashes.SHA1 = '110fe73259097d12f52e1843470d41b2bb7f6132']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57a8a718-4c30-445b-81d3-4d5902de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:56.000Z",
            "modified": "2016-08-08T15:36:56.000Z",
            "first_observed": "2016-08-08T15:36:56Z",
            "last_observed": "2016-08-08T15:36:56Z",
            "number_observed": 1,
            "object_refs": [
                "url--57a8a718-4c30-445b-81d3-4d5902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57a8a718-4c30-445b-81d3-4d5902de0b81",
            "value": "https://www.virustotal.com/file/dd35724d3d1167d917234d0321aa5b874d15cb62d2e95a246a96d6c0b77580c9/analysis/1470114482/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a719-d824-49f3-bd2f-4dae02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:57.000Z",
            "modified": "2016-08-08T15:36:57.000Z",
            "description": "- Xchecked via VT: 76f8142b4e52c671871b3df87f10c30c",
            "pattern": "[file:hashes.SHA256 = '16b8b3b9969660f773e611438e0455082cfafb277ea9256bacc028cdf85f25ec']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57a8a719-0518-4529-875f-425c02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:57.000Z",
            "modified": "2016-08-08T15:36:57.000Z",
            "description": "- Xchecked via VT: 76f8142b4e52c671871b3df87f10c30c",
            "pattern": "[file:hashes.SHA1 = '1dd44a61faee089f7d31d870fd1a5cc635701952']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-08T15:36:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57a8a719-c3a4-4e5b-ac9d-4d5f02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-08T15:36:57.000Z",
            "modified": "2016-08-08T15:36:57.000Z",
            "first_observed": "2016-08-08T15:36:57Z",
            "last_observed": "2016-08-08T15:36:57Z",
            "number_observed": 1,
            "object_refs": [
                "url--57a8a719-c3a4-4e5b-ac9d-4d5f02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57a8a719-c3a4-4e5b-ac9d-4d5f02de0b81",
            "value": "https://www.virustotal.com/file/16b8b3b9969660f773e611438e0455082cfafb277ea9256bacc028cdf85f25ec/analysis/1470114420/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}