{
    "type": "bundle",
    "id": "bundle--59d68cfe-723c-4b5e-b737-fbfd02de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-06T09:52:59.000Z",
            "modified": "2017-10-06T09:52:59.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--59d68cfe-723c-4b5e-b737-fbfd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-06T09:52:59.000Z",
            "modified": "2017-10-06T09:52:59.000Z",
            "name": "OSINT - FreeMilk: A Highly Targeted Spear Phishing Campaign",
            "published": "2017-10-06T09:53:07Z",
            "object_refs": [
                "observed-data--59d68d30-fef8-46e2-8299-4c2b02de0b81",
                "url--59d68d30-fef8-46e2-8299-4c2b02de0b81",
                "x-misp-attribute--59d68d50-3d28-4831-8b96-fbfd02de0b81",
                "indicator--59d68def-93ac-417a-95dd-400802de0b81",
                "indicator--59d68def-76dc-4ac8-8b0b-444802de0b81",
                "indicator--59d68def-e5ec-416b-8650-45e502de0b81",
                "indicator--59d68def-89dc-4632-8c84-4dfc02de0b81",
                "indicator--59d68def-84a8-4265-94ec-49dd02de0b81",
                "indicator--59d68def-6160-4073-8635-4de102de0b81",
                "indicator--59d68def-3968-412f-82f1-4f8602de0b81",
                "vulnerability--59d68e21-a364-43f8-b09e-421402de0b81",
                "indicator--59d68ea6-7d58-426b-8637-403a02de0b81",
                "indicator--59d68ea6-6038-4f14-b78f-42c102de0b81",
                "indicator--59d68ecc-8668-4775-8992-fbfd02de0b81",
                "indicator--59d68ef1-2558-4156-a0b7-7ed002de0b81",
                "indicator--59d68ef1-ba78-4aec-8fd4-7ed002de0b81",
                "indicator--59d68ef1-5fe8-475f-a18e-7ed002de0b81",
                "indicator--59d68ef1-8a9c-40fa-96f0-7ed002de0b81",
                "indicator--59d68ef1-cd70-4af0-81f9-7ed002de0b81",
                "indicator--59d68ef1-a150-4d30-a712-7ed002de0b81",
                "indicator--59d68ef1-0b54-4ac7-a770-7ed002de0b81",
                "indicator--59d68ef1-053c-4ed0-962d-7ed002de0b81",
                "indicator--59d68ef1-3c14-42eb-bad5-7ed002de0b81",
                "indicator--59d68f38-6028-4934-8183-4cf702de0b81",
                "indicator--59d68f38-2850-481e-8d9c-43bf02de0b81",
                "observed-data--59d68f38-0658-420d-954b-4adf02de0b81",
                "url--59d68f38-0658-420d-954b-4adf02de0b81",
                "indicator--59d68f38-2664-4f17-a556-455502de0b81",
                "indicator--59d68f38-2e9c-4f28-9978-4ee302de0b81",
                "observed-data--59d68f38-ffc0-4f55-a249-475b02de0b81",
                "url--59d68f38-ffc0-4f55-a249-475b02de0b81",
                "indicator--59d68f38-00f0-49aa-8d6f-4f0102de0b81",
                "indicator--59d68f38-0f68-4dcb-a9f9-478d02de0b81",
                "observed-data--59d68f38-1868-461e-bcf3-4e7502de0b81",
                "url--59d68f38-1868-461e-bcf3-4e7502de0b81",
                "indicator--59d68f38-4238-455f-9053-4ffb02de0b81",
                "indicator--59d68f38-b6c8-4ecd-85ab-4d5e02de0b81",
                "observed-data--59d68f38-a048-4780-96ff-4d9302de0b81",
                "url--59d68f38-a048-4780-96ff-4d9302de0b81",
                "indicator--59d68f38-83c8-41c6-8060-4ba402de0b81",
                "indicator--59d68f38-9ec0-4be5-995a-4d2d02de0b81",
                "observed-data--59d68f38-9c6c-46b1-80d4-45ff02de0b81",
                "url--59d68f38-9c6c-46b1-80d4-45ff02de0b81",
                "indicator--59d68f38-a88c-4685-9964-43cd02de0b81",
                "indicator--59d68f38-c834-4724-8322-4b4b02de0b81",
                "observed-data--59d68f38-a574-409c-979d-4d0402de0b81",
                "url--59d68f38-a574-409c-979d-4d0402de0b81",
                "indicator--59d68f38-ec2c-4ac1-bacb-489e02de0b81",
                "indicator--59d68f38-a5e0-43e2-a403-4b1a02de0b81",
                "observed-data--59d68f38-d1a4-4ab2-a2cb-473c02de0b81",
                "url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81",
                "indicator--59d68f38-9710-4f62-95af-44b002de0b81",
                "indicator--59d68f38-c400-4825-bc49-456702de0b81",
                "observed-data--59d68f38-0d10-4f4f-859c-470a02de0b81",
                "url--59d68f38-0d10-4f4f-859c-470a02de0b81",
                "indicator--59d68f38-5044-4612-a378-484802de0b81",
                "indicator--59d68f38-4eb8-4a29-8339-40b802de0b81",
                "observed-data--59d68f38-630c-481b-b4fb-4cdc02de0b81",
                "url--59d68f38-630c-481b-b4fb-4cdc02de0b81",
                "indicator--59d68f38-c38c-4a45-98f7-462b02de0b81",
                "indicator--59d68f38-ed5c-4691-a55d-489802de0b81",
                "observed-data--59d68f38-bcf0-4ab9-8041-447502de0b81",
                "url--59d68f38-bcf0-4ab9-8041-447502de0b81",
                "indicator--59d68f38-f18c-4d90-8c81-462102de0b81",
                "indicator--59d68f38-5da0-4303-ae0c-408a02de0b81",
                "observed-data--59d68f38-f7b0-4bcf-bf68-414702de0b81",
                "url--59d68f38-f7b0-4bcf-bf68-414702de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68d30-fef8-46e2-8299-4c2b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68d30-fef8-46e2-8299-4c2b02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68d30-fef8-46e2-8299-4c2b02de0b81",
            "value": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--59d68d50-3d28-4831-8b96-fbfd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "In May 2017, Palo Alto Networks Unit 42 identified a limited spear phishing campaign targeting various individuals across the world. The threat actor leveraged the CVE-2017-0199 Microsoft Word Office/WordPad Remote Code Execution Vulnerability with carefully crafted decoy content customized for each target recipient. Our research showed that the spear phishing emails came from multiple compromised email accounts tied to a legitimate domain in North East Asia. We believe that the threat actor hijacked an existing, legitimate in-progress conversation and posed as the legitimate senders to send malicious spear phishing emails to the recipients"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68def-93ac-417a-95dd-400802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "JavaScript to extract and run the payload",
            "pattern": "[file:hashes.SHA256 = '1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68def-76dc-4ac8-8b0b-444802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[url:value = 'http://old.jrchina.com/btob_asiana/udel_ok.ipp']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68def-e5ec-416b-8650-45e502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "Fake image extracts to Freenki downloader",
            "pattern": "[file:hashes.SHA256 = '64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68def-89dc-4632-8c84-4dfc02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[url:value = 'http://old.jrchina.com/btob_asiana/appach01.jpg']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68def-84a8-4265-94ec-49dd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[file:hashes.SHA256 = '7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68def-6160-4073-8635-4de102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "PoohMilk loader",
            "pattern": "[file:hashes.SHA256 = '40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68def-3968-412f-82f1-4f8602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[file:hashes.SHA256 = '35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "vulnerability",
            "spec_version": "2.1",
            "id": "vulnerability--59d68e21-a364-43f8-b09e-421402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "name": "CVE-2017-0199",
            "labels": [
                "misp:type=\"vulnerability\"",
                "misp:category=\"Payload delivery\""
            ],
            "external_references": [
                {
                    "source_name": "cve",
                    "external_id": "CVE-2017-0199"
                }
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ea6-7d58-426b-8637-403a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "Windows-KB276133-x86.exe",
            "pattern": "[file:hashes.SHA256 = '1163da8c37ad9ba98d59b921ba8cf8e54bfc1282712cf754f4ff82b63f8e6027']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ea6-6038-4f14-b78f-42c102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-06T09:52:59.000Z",
            "modified": "2017-10-06T09:52:59.000Z",
            "description": "Windows-KB251952-x86.exe",
            "pattern": "[file:hashes.SHA256 = 'ba5905c2fe46bd6734973139e759ba405fd193c2342dfcac396e9d529b57821b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-06T09:52:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\"",
                "circl:incident-classification=\"malware\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ecc-8668-4775-8992-fbfd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js",
            "pattern": "[file:hashes.SHA256 = '99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-2558-4156-a0b7-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[file:hashes.SHA256 = 'a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-ba78-4aec-8fd4-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[file:hashes.SHA256 = '201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-5fe8-475f-a18e-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[file:hashes.SHA256 = '0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-8a9c-40fa-96f0-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[file:hashes.SHA256 = '34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-cd70-4af0-81f9-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[file:hashes.SHA256 = 'ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-a150-4d30-a712-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[domain-name:value = 'old.jrchina.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-0b54-4ac7-a770-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[domain-name:value = 'foodforu.heliohost.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-053c-4ed0-962d-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[domain-name:value = 'www.ethanpublishing.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68ef1-3c14-42eb-bad5-7ed002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "pattern": "[domain-name:value = 'discgolfglow.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-6028-4934-8183-4cf702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2",
            "pattern": "[file:hashes.SHA1 = '67cd2e35fd6e06afe80724f53effabbfdf80349b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-2850-481e-8d9c-43bf02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2",
            "pattern": "[file:hashes.MD5 = '9f022df0bcfded9377baf4da1fbe7b8c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-0658-420d-954b-4adf02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-0658-420d-954b-4adf02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-0658-420d-954b-4adf02de0b81",
            "value": "https://www.virustotal.com/file/ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2/analysis/1507220836/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-2664-4f17-a556-455502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9",
            "pattern": "[file:hashes.SHA1 = 'f374436ec085e8bb254c3bf42d0dc84536cc4a90']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-2e9c-4f28-9978-4ee302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9",
            "pattern": "[file:hashes.MD5 = '36ab73294dbbcdfe2554c5e29544de24']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-ffc0-4f55-a249-475b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-ffc0-4f55-a249-475b02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-ffc0-4f55-a249-475b02de0b81",
            "value": "https://www.virustotal.com/file/34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9/analysis/1507217555/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-00f0-49aa-8d6f-4f0102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313",
            "pattern": "[file:hashes.SHA1 = '419a86472fa374a333fd616152a4e1c2e94e8c8d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-0f68-4dcb-a9f9-478d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313",
            "pattern": "[file:hashes.MD5 = 'fed4b7096553965a07e0f340494889fe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-1868-461e-bcf3-4e7502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-1868-461e-bcf3-4e7502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-1868-461e-bcf3-4e7502de0b81",
            "value": "https://www.virustotal.com/file/0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313/analysis/1507217556/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-4238-455f-9053-4ffb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30",
            "pattern": "[file:hashes.SHA1 = 'ad6fb28bd1eb1b992982648f0e78874e14e7b4ba']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-b6c8-4ecd-85ab-4d5e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30",
            "pattern": "[file:hashes.MD5 = '53fb994908b72067bc3d2f6f93c0de7d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-a048-4780-96ff-4d9302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-a048-4780-96ff-4d9302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-a048-4780-96ff-4d9302de0b81",
            "value": "https://www.virustotal.com/file/201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30/analysis/1506334002/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-83c8-41c6-8060-4ba402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a",
            "pattern": "[file:hashes.SHA1 = 'abe2753ea8c2c54163703c4a3ca86ae25a0ce780']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-9ec0-4be5-995a-4d2d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a",
            "pattern": "[file:hashes.MD5 = '321461c22c742328af1feb27a7c1c8e0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-9c6c-46b1-80d4-45ff02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-9c6c-46b1-80d4-45ff02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-9c6c-46b1-80d4-45ff02de0b81",
            "value": "https://www.virustotal.com/file/a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a/analysis/1507233005/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-a88c-4685-9964-43cd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js - Xchecked via VT: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5",
            "pattern": "[file:hashes.SHA1 = 'f7fcadc8c71752ce5d47af1e8069069cc70e6e27']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-c834-4724-8322-4b4b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js - Xchecked via VT: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5",
            "pattern": "[file:hashes.MD5 = '6c668fd6a98f0659abc54d88c1db209e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-a574-409c-979d-4d0402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-a574-409c-979d-4d0402de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-a574-409c-979d-4d0402de0b81",
            "value": "https://www.virustotal.com/file/99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5/analysis/1507217555/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-ec2c-4ac1-bacb-489e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2",
            "pattern": "[file:hashes.SHA1 = '011604ce0e46229ece8d9266d69d0e68d5931e72']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-a5e0-43e2-a403-4b1a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2",
            "pattern": "[file:hashes.MD5 = '237ff78e9d8c9407f89563cb696c2539']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-d1a4-4ab2-a2cb-473c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81",
            "value": "https://www.virustotal.com/file/35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2/analysis/1496397207/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-9710-4f62-95af-44b002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "PoohMilk loader - Xchecked via VT: 40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574",
            "pattern": "[file:hashes.SHA1 = 'aa84276ca9a6ad2f644f927cc14c9bff09595d92']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-c400-4825-bc49-456702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "PoohMilk loader - Xchecked via VT: 40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574",
            "pattern": "[file:hashes.MD5 = 'f5cae9fcc8bad42b3dddb71ce68dbd92']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-0d10-4f4f-859c-470a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-0d10-4f4f-859c-470a02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-0d10-4f4f-859c-470a02de0b81",
            "value": "https://www.virustotal.com/file/40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574/analysis/1503367656/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-5044-4612-a378-484802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df",
            "pattern": "[file:hashes.SHA1 = '0f97d50ca513c6899204b59d594a0537a14aa81f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-4eb8-4a29-8339-40b802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "- Xchecked via VT: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df",
            "pattern": "[file:hashes.MD5 = 'f5463cd95632706cd7823bfea8fc118c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-630c-481b-b4fb-4cdc02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-630c-481b-b4fb-4cdc02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-630c-481b-b4fb-4cdc02de0b81",
            "value": "https://www.virustotal.com/file/7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df/analysis/1502302846/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-c38c-4a45-98f7-462b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "Fake image extracts to Freenki downloader - Xchecked via VT: 64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c",
            "pattern": "[file:hashes.SHA1 = '5bb865a0518862c9b47e678446e9968b8e2d0bed']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-ed5c-4691-a55d-489802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "Fake image extracts to Freenki downloader - Xchecked via VT: 64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c",
            "pattern": "[file:hashes.MD5 = '7c2ebfc7960aac6f8d58b37e3f092a9c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-bcf0-4ab9-8041-447502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-bcf0-4ab9-8041-447502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-bcf0-4ab9-8041-447502de0b81",
            "value": "https://www.virustotal.com/file/64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c/analysis/1502714265/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-f18c-4d90-8c81-462102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "JavaScript to extract and run the payload - Xchecked via VT: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c",
            "pattern": "[file:hashes.SHA1 = '73f84a1bfb63c06c43d570dd6fd0f08b14c2b7c6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d68f38-5da0-4303-ae0c-408a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "description": "JavaScript to extract and run the payload - Xchecked via VT: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c",
            "pattern": "[file:hashes.MD5 = 'ab4596f26b25730fbc9dc41e629980f1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-05T19:59:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d68f38-f7b0-4bcf-bf68-414702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-05T19:59:52.000Z",
            "modified": "2017-10-05T19:59:52.000Z",
            "first_observed": "2017-10-05T19:59:52Z",
            "last_observed": "2017-10-05T19:59:52Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d68f38-f7b0-4bcf-bf68-414702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d68f38-f7b0-4bcf-bf68-414702de0b81",
            "value": "https://www.virustotal.com/file/1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c/analysis/1502714265/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}