{
  "Event": {
    "analysis": "0",
    "date": "2020-06-24",
    "extends_uuid": "",
    "info": "zloader: VBA, R1C1 References, and Other Tomfoolery",
    "publish_timestamp": "1677075131",
    "published": true,
    "threat_level_id": "4",
    "timestamp": "1612475411",
    "uuid": "0733f160-8e52-4548-a4c8-19a1cfb41d0d",
    "Orgc": {
      "name": "Centre for Cyber security Belgium",
      "uuid": "5cf66e53-b5f8-43e7-be9a-49880a3b4631"
    },
    "Tag": [
      {
        "colour": "#f82378",
        "local": false,
        "name": "zloader",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#DADCF0",
        "local": false,
        "name": "inthreat:event-src=\"feed-osint\"",
        "relationship_type": ""
      },
      {
        "colour": "#0fc000",
        "local": false,
        "name": "admiralty-scale:information-credibility=\"2\"",
        "relationship_type": ""
      },
      {
        "colour": "#075200",
        "local": false,
        "name": "admiralty-scale:source-reliability=\"b\"",
        "relationship_type": ""
      },
      {
        "colour": "#e2007a",
        "local": false,
        "name": "workflow:state=\"complete\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1592995840",
        "to_ids": true,
        "type": "sha256",
        "uuid": "9c87b754-6bc2-414d-82e9-0d07f2130be7",
        "value": "b29c145d4b78daed34dea28a0a11bab857d5583dc6a00578a877511d0d01d3d2"
      }
    ],
    "Object": [
      {
        "comment": "External Analysis",
        "deleted": false,
        "description": "An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.",
        "meta-category": "misc",
        "name": "annotation",
        "template_uuid": "5d8dc046-15a1-4ca3-a09f-ed4ede7c4487",
        "template_version": "2",
        "timestamp": "1593003580",
        "uuid": "5ef34e3c-f70c-4526-9abb-44f6ac13a7a7",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "ref",
            "timestamp": "1593003580",
            "to_ids": false,
            "type": "link",
            "uuid": "5ef34e3c-3620-41b8-a096-44f6ac13a7a7",
            "value": "https://clickallthethings.wordpress.com/2020/06/19/zloader-vba-r1c1-references-and-other-tomfoolery/"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "ref",
            "timestamp": "1593003580",
            "to_ids": false,
            "type": "link",
            "uuid": "5ef34e3c-3110-40af-8f22-44f6ac13a7a7",
            "value": "https://twitter.com/abuse_ch"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1593003580",
            "to_ids": false,
            "type": "text",
            "uuid": "5ef34e3c-d9e4-4ca8-957b-44f6ac13a7a7",
            "value": "zloader: VBA, R1C1 References, and Other Tomfoolery\r\nJune 19, 2020 ~ Jamie\t\r\n\r\nThe other day, @reecDeep tweeted about new behavior from zloader documents. Another document from the same campaign crossed my path and I decided to take a crack at it."
          }
        ]
      },
      {
        "comment": "Domains",
        "deleted": false,
        "description": "Whois records information for a domain name or an IP address.",
        "meta-category": "network",
        "name": "whois",
        "template_uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a",
        "template_version": "10",
        "timestamp": "1593003610",
        "uuid": "5ef34e5a-b2a8-4ca8-8a0e-44f6ac13a7a7",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1593003610",
            "to_ids": true,
            "type": "domain",
            "uuid": "5ef34e5a-6d34-4a50-87a8-44f6ac13a7a7",
            "value": "procacardenla.ga"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1593003611",
            "to_ids": true,
            "type": "domain",
            "uuid": "5ef34e5b-ac9c-41e2-91a5-44f6ac13a7a7",
            "value": "datalibacbi.ml"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1593003611",
            "to_ids": true,
            "type": "domain",
            "uuid": "5ef34e5b-a1b0-4af0-8636-44f6ac13a7a7",
            "value": "wireborg.com"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1593003611",
            "to_ids": true,
            "type": "domain",
            "uuid": "5ef34e5b-6df8-49d5-9b09-44f6ac13a7a7",
            "value": "zmedia.shwetech.com"
          }
        ]
      }
    ]
  }
}