{
  "Event": {
    "analysis": "2",
    "date": "2017-09-01",
    "extends_uuid": "",
    "info": "OSINT - Malspam pushing Locky ransomware tries HoeflerText notifications for Chrome and FireFox",
    "publish_timestamp": "1514467995",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1513825223",
    "uuid": "5a37cd2b-208c-44c1-a08c-41d0950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Locky\"",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#2c4f00",
        "local": false,
        "name": "malware_classification:malware-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#00223b",
        "local": false,
        "name": "osint:source-type=\"blog-post\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": false,
        "type": "link",
        "uuid": "5a37cd40-6088-45e7-b54a-4d04950d210f",
        "value": "https://isc.sans.edu/forums/diary/Malspam+pushing+Locky+ransomware+tries+HoeflerText+notifications+for+Chrome+and+FireFox/22776/",
        "Tag": [
          {
            "colour": "#00223b",
            "local": false,
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "filename",
        "uuid": "5a3a1e48-52d4-47a1-b8d3-460e950d210f",
        "value": "Win.JSFontlib09.js"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-3420-4754-bacd-453c950d210f",
        "value": "http://albion-cx22.co.uk/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-8750-4c0c-a4d0-49e5950d210f",
        "value": "http://ambrogiauto.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-6e58-488b-8495-49bc950d210f",
        "value": "http://arthurdenniswilliams.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-4034-41af-a308-4951950d210f",
        "value": "http://autoecoleathena.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-b194-48f4-a871-4bb7950d210f",
        "value": "http://autoecoleboisdesroches.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-bf10-46cd-9059-49be950d210f",
        "value": "http://autoecoledufrene.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-17fc-432c-a44c-4f7a950d210f",
        "value": "http://avtokhim.ru/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-aa70-4c51-a59d-463e950d210f",
        "value": "http://bayimpex.be/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-b238-4836-9eae-4094950d210f",
        "value": "http://binarycousins.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-5f60-4884-955e-47ff950d210f",
        "value": "http://charleskeener.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-ba40-45e6-812d-4384950d210f",
        "value": "http://campusvoltaire.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-d978-4ece-9b07-4b81950d210f",
        "value": "http://dar-alataa.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-7958-4178-95d6-4f53950d210f",
        "value": "http://flooringforyou.co.uk/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-9e48-4272-baee-4679950d210f",
        "value": "http://gestionale-orbit.it/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-8ab8-4a50-bc42-42a4950d210f",
        "value": "http://griffithphoto.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-39d4-4340-ad1e-4ebb950d210f",
        "value": "http://jakuboweb.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-2238-4268-89d5-4be0950d210f",
        "value": "http://jaysonmorrison.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-9760-43a6-9fea-4397950d210f",
        "value": "http://patrickreeves.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-7b64-4c90-8d7d-4a8e950d210f",
        "value": "http://potamitis.gr/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760996",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-0d10-4521-9524-4264950d210f",
        "value": "http://tasgetiren.com/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760997",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1eb1-6a60-4d6a-b11b-4b53950d210f",
        "value": "http://willemshoeck.nl/dropbox.html"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760997",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1f10-5848-4059-9a36-4a98950d210f",
        "value": "http://dippydado.net/af0.js"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760997",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1f11-9afc-4071-acb1-469e950d210f",
        "value": "http://dippydado.net/json.php"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760997",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1f11-645c-4d46-b938-4cd9950d210f",
        "value": "http://gclubrace.info/json.php"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760997",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1f11-2f14-42d4-9f65-4c6a950d210f",
        "value": "http://geocean.co.id/657erikftgvb??pGDIWEKDHD=pGDIWEKDHD"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760997",
        "to_ids": true,
        "type": "url",
        "uuid": "5a3a1f11-58b8-4c97-aa1a-4619950d210f",
        "value": "http://46.183.165.45/imageload.cgi"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1513760997",
        "to_ids": false,
        "type": "comment",
        "uuid": "5a3a211d-2174-4ecf-a3ae-4896950d210f",
        "value": "During past two weeks or so, we've seen plenty of botnet-based malicious spam (malspam) pushing Locky ransomware.  In recent days, I've noticed multiple waves of malspam every weekday.  It gets a bit boring after a while, but as 2017-08-31 came to a close, I noticed a different technique from this malspam.\r\n\r\nToday's malspam had links to fake Dropbox pages.  If you viewed the pages in Chrome or Firefox, they showed a fake notification stating you don't have the HoeflerText font.  These fake notifications had an \"update\" button that returned a malicious JavaScript (.js) file.  These .js files were disguised as a font library.\r\n\r\nOf note, I was unable to get any malware when using Internet Explorer or Microsoft Edge.",
        "Tag": [
          {
            "colour": "#00223b",
            "local": false,
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "7",
        "timestamp": "1513761000",
        "uuid": "0e7faf3f-4ac4-466b-a1da-c150689904f1",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "0e7faf3f-4ac4-466b-a1da-c150689904f1",
            "referenced_uuid": "74ecff04-dcdd-4249-aa4a-371757d83918",
            "relationship_type": "analysed-with",
            "timestamp": "1514467995",
            "uuid": "5a3a28e6-5264-4cd0-8bb6-4c4002de0b81"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Locky binary",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1513760997",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5a3a28e5-6c5c-446c-8528-477302de0b81",
            "value": "a7b42163d1d160e1f40e9578bba81bd933571b1e"
          },
          {
            "category": "Payload delivery",
            "comment": "Locky binary",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1513760997",
            "to_ids": true,
            "type": "md5",
            "uuid": "5a3a28e5-e974-4238-b8ec-444102de0b81",
            "value": "1974edcb8326835d1ad1ca94d70a914a"
          },
          {
            "category": "Payload delivery",
            "comment": "Locky binary",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1513760997",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5a3a28e5-5524-4e6c-bbb2-49ac02de0b81",
            "value": "19865bb16f4609b4703eaba1d773d60a85009b715274ad862ca4cbb5772c621a"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "1",
        "timestamp": "1513760997",
        "uuid": "74ecff04-dcdd-4249-aa4a-371757d83918",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "Locky binary",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1513760998",
            "to_ids": false,
            "type": "link",
            "uuid": "5a3a28e6-421c-4d2a-982e-4fb802de0b81",
            "value": "https://www.virustotal.com/file/19865bb16f4609b4703eaba1d773d60a85009b715274ad862ca4cbb5772c621a/analysis/1507259344/"
          },
          {
            "category": "Other",
            "comment": "Locky binary",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1513760998",
            "to_ids": false,
            "type": "text",
            "uuid": "5a3a28e6-a5e0-4a87-9f2b-422302de0b81",
            "value": "56/65"
          },
          {
            "category": "Other",
            "comment": "Locky binary",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1513760998",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5a3a28e6-0f48-4a31-be00-419002de0b81",
            "value": "2017-10-06T03:09:04"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "7",
        "timestamp": "1513761001",
        "uuid": "3334d310-ae6e-4012-b062-5090c6e59cae",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "3334d310-ae6e-4012-b062-5090c6e59cae",
            "referenced_uuid": "3f9b2a17-38a2-46fe-b1e4-d35b07326474",
            "relationship_type": "analysed-with",
            "timestamp": "1514467995",
            "uuid": "5a3a28e7-c1b0-4f7f-8111-4cbf02de0b81"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Win.JSFontlib09.js",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1513760998",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5a3a28e6-d114-42e2-9310-44ae02de0b81",
            "value": "05ff3b6bc80e3eef785aca0a7c65e86da6fcd32d"
          },
          {
            "category": "Payload delivery",
            "comment": "Win.JSFontlib09.js",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1513760998",
            "to_ids": true,
            "type": "md5",
            "uuid": "5a3a28e6-51d8-4aad-b209-4ae602de0b81",
            "value": "009e6dffb0f760c9ee154f46fa212e01"
          },
          {
            "category": "Payload delivery",
            "comment": "Win.JSFontlib09.js",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1513760998",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5a3a28e6-1ad0-4c94-9cee-4bb702de0b81",
            "value": "decd71ae3b5e683f0c3d057ac0576cbd624ca10734e1984f15cb77fcd23c4a37"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "1",
        "timestamp": "1513760998",
        "uuid": "3f9b2a17-38a2-46fe-b1e4-d35b07326474",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "Win.JSFontlib09.js",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1513760998",
            "to_ids": false,
            "type": "link",
            "uuid": "5a3a28e6-b8c8-4beb-8c2d-4d9d02de0b81",
            "value": "https://www.virustotal.com/file/decd71ae3b5e683f0c3d057ac0576cbd624ca10734e1984f15cb77fcd23c4a37/analysis/1507189498/"
          },
          {
            "category": "Other",
            "comment": "Win.JSFontlib09.js",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1513760998",
            "to_ids": false,
            "type": "text",
            "uuid": "5a3a28e6-0054-4738-9612-4ac102de0b81",
            "value": "38/59"
          },
          {
            "category": "Other",
            "comment": "Win.JSFontlib09.js",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1513760998",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5a3a28e6-2fd4-49a4-8c94-426702de0b81",
            "value": "2017-10-05T07:44:58"
          }
        ]
      }
    ]
  }
}