{
  "Event": {
    "analysis": "0",
    "date": "2018-05-15",
    "extends_uuid": "",
    "info": "OSINT - A tale of two zero-days",
    "publish_timestamp": "1526398981",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1526398950",
    "uuid": "5afafce0-0598-4ca0-b52a-41f4950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#00223b",
        "name": "osint:source-type=\"blog-post\""
      },
      {
        "colour": "#0082e1",
        "name": "osint:certainty=\"75\""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1526398191",
        "to_ids": false,
        "type": "link",
        "uuid": "5afafcef-4ebc-4561-bcd3-4ec7950d210f",
        "value": "https://www.welivesecurity.com/2018/05/15/tale-two-zero-days/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1526398212",
        "to_ids": false,
        "type": "text",
        "uuid": "5afafd04-9874-4fb6-afa8-3556950d210f",
        "value": "Late in March 2018, ESET researchers identified an interesting malicious PDF sample. A closer look revealed that the sample exploits two previously unknown vulnerabilities: a remote-code execution vulnerability in Adobe Reader and a privilege escalation vulnerability in Microsoft Windows.\r\n\r\nThe use of the combined vulnerabilities is extremely powerful, as it allows an attacker to execute arbitrary code with the highest possible privileges on the vulnerable target, and with only the most minimal of user interaction. APT groups regularly use such combinations to perform their attacks, such as in the Sednit campaign from last year.\r\n\r\nOnce the PDF sample was discovered, ESET contacted and worked together with the Microsoft Security Response Center, Windows Defender ATP research team, and Adobe Product Security Incident Response Team as they fixed these bugs."
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1526398245",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "5afafd25-5ed0-4e07-8d1e-4572950d210f",
        "value": "CVE-2018-4990",
        "Tag": [
          {
            "colour": "#0088cc",
            "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exploitation of Vulnerability - T1068\""
          }
        ]
      },
      {
        "category": "Payload installation",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1526398263",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "5afafd37-b6d8-48ea-9226-4e32950d210f",
        "value": "CVE-2018-8120",
        "Tag": [
          {
            "colour": "#0088cc",
            "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exploitation of Vulnerability - T1068\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1526398282",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5afafd4a-8f80-4711-8ec3-4fb0950d210f",
        "value": "c82cfead292eeca601d3cf82c8c5340cb579d1c6"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1526398283",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5afafd4b-48e8-4271-98d2-477b950d210f",
        "value": "0d3f335ccca4575593054446f5f219eba6cd93fe"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1526398926",
        "to_ids": false,
        "type": "link",
        "uuid": "5afaffce-12b8-41cf-8ce1-434a950d210f",
        "value": "http://www.ivanlef0u.tuxfamily.org/?p=86"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1526398947",
        "to_ids": false,
        "type": "link",
        "uuid": "5afaffe3-f688-4ddb-ad6b-4d54950d210f",
        "value": "http://j00ru.vexillium.org/?p=290"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "11",
        "timestamp": "1526398358",
        "uuid": "e1aaf6c9-d880-4111-ae8c-e18bacfa93e3",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "e1aaf6c9-d880-4111-ae8c-e18bacfa93e3",
            "referenced_uuid": "8e273621-4ed2-4eab-8afa-c8332486d797",
            "relationship_type": "analysed-with",
            "timestamp": "1526398359",
            "uuid": "5afafd97-8c48-4dc7-b535-42fc02de0b81"
          }
        ],
        "Attribute": []
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "2",
        "timestamp": "1526398356",
        "uuid": "8e273621-4ed2-4eab-8afa-c8332486d797",
        "Attribute": []
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "11",
        "timestamp": "1526398360",
        "uuid": "87e5d719-47c0-48f7-a306-167eae1963bf",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "87e5d719-47c0-48f7-a306-167eae1963bf",
            "referenced_uuid": "55b2aaba-335d-46dc-95ba-5460b43332fd",
            "relationship_type": "analysed-with",
            "timestamp": "1526398359",
            "uuid": "5afafd97-ddf0-4ac2-9163-472702de0b81"
          }
        ],
        "Attribute": []
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "2",
        "timestamp": "1526398358",
        "uuid": "55b2aaba-335d-46dc-95ba-5460b43332fd",
        "Attribute": []
      }
    ]
  }
}