{
    "type": "bundle",
    "id": "bundle--5717777b-a8b4-4876-b060-4339950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:24.000Z",
            "modified": "2016-04-20T13:37:24.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5717777b-a8b4-4876-b060-4339950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:24.000Z",
            "modified": "2016-04-20T13:37:24.000Z",
            "name": "OSINT - New Crypto-Ransomware JIGSAW Plays Nasty Games",
            "published": "2016-04-20T13:43:42Z",
            "object_refs": [
                "observed-data--57177796-cd7c-4b46-a680-4827950d210f",
                "url--57177796-cd7c-4b46-a680-4827950d210f",
                "x-misp-attribute--571777ae-4f00-4231-8d8e-4796950d210f",
                "indicator--5717794f-427c-4971-94ca-47bf950d210f",
                "indicator--5717794f-0c2c-4338-87a6-4d0e950d210f",
                "indicator--57177950-ec94-43ac-a41e-4c54950d210f",
                "indicator--57177951-809c-4786-9ec1-4811950d210f",
                "indicator--57177951-d710-4bb8-a20d-4f46950d210f",
                "indicator--57177952-8580-4612-9c15-4335950d210f",
                "indicator--57177953-74fc-41bd-a542-4398950d210f",
                "indicator--57177953-5220-4571-8029-4538950d210f",
                "indicator--57177954-d174-401f-a3f4-4209950d210f",
                "observed-data--57177a3e-6b44-4c2d-b80d-49a4950d210f",
                "url--57177a3e-6b44-4c2d-b80d-49a4950d210f",
                "observed-data--57177a3f-2c24-44ec-88d4-4858950d210f",
                "domain-name--57177a3f-2c24-44ec-88d4-4858950d210f",
                "indicator--57178615-9754-4898-8b08-400802de0b81",
                "indicator--57178615-2894-45d4-9c9c-4fdd02de0b81",
                "observed-data--57178615-4ccc-4cb3-ba9f-4e5d02de0b81",
                "url--57178615-4ccc-4cb3-ba9f-4e5d02de0b81",
                "indicator--57178616-8334-49a1-894b-47b002de0b81",
                "indicator--57178616-2f48-49c5-b09f-43a102de0b81",
                "observed-data--57178616-c38c-41e1-8153-427302de0b81",
                "url--57178616-c38c-41e1-8153-427302de0b81",
                "indicator--57178617-f8f4-4418-9175-4c7802de0b81",
                "indicator--57178617-772c-419a-a05c-4ac202de0b81",
                "observed-data--57178617-7e78-4d57-b580-4ff702de0b81",
                "url--57178617-7e78-4d57-b580-4ff702de0b81",
                "indicator--57178618-2640-429a-9dfb-444602de0b81",
                "indicator--57178618-ec14-4daa-8a55-4db802de0b81",
                "observed-data--57178618-842c-4ff0-b9b4-4d3602de0b81",
                "url--57178618-842c-4ff0-b9b4-4d3602de0b81",
                "indicator--57178619-addc-4013-afec-4bb102de0b81",
                "indicator--57178619-42e0-4a5e-b2d3-472302de0b81",
                "observed-data--57178619-654c-44e2-9428-438c02de0b81",
                "url--57178619-654c-44e2-9428-438c02de0b81",
                "indicator--5717861a-8e9c-47e1-84c8-494702de0b81",
                "indicator--5717861a-3d08-457e-be9c-480c02de0b81",
                "observed-data--5717861a-3ab0-4f6d-8331-407602de0b81",
                "url--5717861a-3ab0-4f6d-8331-407602de0b81",
                "indicator--5717861b-7674-4714-b055-4ecb02de0b81",
                "indicator--5717861b-f874-4e76-b5a2-40e702de0b81",
                "observed-data--5717861b-b2fc-4335-9464-418e02de0b81",
                "url--5717861b-b2fc-4335-9464-418e02de0b81",
                "indicator--5717861c-d81c-455a-97a2-477902de0b81",
                "indicator--5717861c-56f4-4465-ae03-4a2402de0b81",
                "observed-data--5717861c-20c0-438e-b295-489a02de0b81",
                "url--5717861c-20c0-438e-b295-489a02de0b81",
                "indicator--5717861c-d06c-475f-bb8f-47eb02de0b81",
                "indicator--5717861d-adf0-4e8c-8670-4d5202de0b81",
                "observed-data--5717861d-48a0-448a-a172-431402de0b81",
                "url--5717861d-48a0-448a-a172-431402de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "malware_classification:malware-category=\"Ransomware\"",
                "type:OSINT"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57177796-cd7c-4b46-a680-4827950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:35:34.000Z",
            "modified": "2016-04-20T12:35:34.000Z",
            "first_observed": "2016-04-20T12:35:34Z",
            "last_observed": "2016-04-20T12:35:34Z",
            "number_observed": 1,
            "object_refs": [
                "url--57177796-cd7c-4b46-a680-4827950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57177796-cd7c-4b46-a680-4827950d210f",
            "value": "http://blog.trendmicro.com/trendlabs-security-intelligence/jigsaw-ransomware-plays-games-victims/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--571777ae-4f00-4231-8d8e-4796950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:35:58.000Z",
            "modified": "2016-04-20T12:35:58.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "The evolution of crypto-ransomware in terms of behavior takes a step forward, and a creepy one at that. We have recently encountered a nasty crypto-ransomware variant called JIGSAW. Reminiscent to the horror film Saw, this malware toys with users by locking and deleting their files incrementally. To an extent, it instills fear and pressures users into paying the ransom. It even comes with an image of Saw\u00e2\u20ac\u2122s very own Billy the puppet, and the red analog clock to boot.\r\n\r\nIt\u00e2\u20ac\u2122s no longer a surprise that crypto-ransomware is the prevalent threat in today\u00e2\u20ac\u2122s computing landscape, given its promise of quick ROI for the cybercriminals behind it. It\u00e2\u20ac\u2122s also not surprising that many have joined this bandwagon.  These days, the name of the crypto-ransomware game is to add \u00e2\u20ac\u0153unique\u00e2\u20ac\u009d features or \u00e2\u20ac\u0153creative\u00e2\u20ac\u009d ways to instill fear and put more pressure to users to pay up, despite the fact that, when it comes to their technical routines, there\u00e2\u20ac\u2122s not much difference among these malware. JIGSAW joins notable families like PETYA and CERBER that have emerged in the past couple of months alone."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717794f-427c-4971-94ca-47bf950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:42:55.000Z",
            "modified": "2016-04-20T12:42:55.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.A' AND file:hashes.SHA1 = '0c269c5a641fd479269c2f353841a5bf9910888b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:42:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717794f-0c2c-4338-87a6-4d0e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:42:55.000Z",
            "modified": "2016-04-20T12:42:55.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.A' AND file:hashes.SHA1 = 'dc307a673aa5eecb5c1400f1d342e03697564f98']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:42:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57177950-ec94-43ac-a41e-4c54950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:42:56.000Z",
            "modified": "2016-04-20T12:42:56.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.A' AND file:hashes.SHA1 = 'ce42e2c694ca4737ae68d3c9e333554c55afee27']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:42:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57177951-809c-4786-9ec1-4811950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:42:57.000Z",
            "modified": "2016-04-20T12:42:57.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.B' AND file:hashes.SHA1 = '1ad9f8695c10adb69bdebd6bdc39b119707d500e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:42:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57177951-d710-4bb8-a20d-4f46950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:42:57.000Z",
            "modified": "2016-04-20T12:42:57.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.C' AND file:hashes.SHA1 = 'ca40233610d40258539da0212a06af29b07c13f6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:42:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57177952-8580-4612-9c15-4335950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:42:58.000Z",
            "modified": "2016-04-20T12:42:58.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.C' AND file:hashes.SHA1 = 'f8431cf0a73e4ede5b4b38185d73d8472cfe2ae7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:42:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57177953-74fc-41bd-a542-4398950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:42:59.000Z",
            "modified": "2016-04-20T12:42:59.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.D' AND file:hashes.SHA1 = 'dce911b1c05da965c8733935723b88bc29d12756']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:42:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57177953-5220-4571-8029-4538950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:42:59.000Z",
            "modified": "2016-04-20T12:42:59.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.E' AND file:hashes.SHA1 = '3f6e3e5126c837f46a18ee988dbf5756c2b856aa']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:42:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57177954-d174-401f-a3f4-4209950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:43:00.000Z",
            "modified": "2016-04-20T12:43:00.000Z",
            "description": "Imported via the freetext import.",
            "pattern": "[file:name = 'Ransom_JIGSAW.E' AND file:hashes.SHA1 = '92620194a581a91874a5284a775014e0d71a9db1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T12:43:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename|sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57177a3e-6b44-4c2d-b80d-49a4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:46:54.000Z",
            "modified": "2016-04-20T12:46:54.000Z",
            "first_observed": "2016-04-20T12:46:54Z",
            "last_observed": "2016-04-20T12:46:54Z",
            "number_observed": 1,
            "object_refs": [
                "url--57177a3e-6b44-4c2d-b80d-49a4950d210f"
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57177a3e-6b44-4c2d-b80d-49a4950d210f",
            "value": "http://waldorftrust.com"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57177a3f-2c24-44ec-88d4-4858950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T12:46:55.000Z",
            "modified": "2016-04-20T12:46:55.000Z",
            "first_observed": "2016-04-20T12:46:55Z",
            "last_observed": "2016-04-20T12:46:55Z",
            "number_observed": 1,
            "object_refs": [
                "domain-name--57177a3f-2c24-44ec-88d4-4858950d210f"
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--57177a3f-2c24-44ec-88d4-4858950d210f",
            "value": "1fichier.com"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178615-9754-4898-8b08-400802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:25.000Z",
            "modified": "2016-04-20T13:37:25.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: 92620194a581a91874a5284a775014e0d71a9db1",
            "pattern": "[file:hashes.SHA256 = '4cd26e0d543e7da413bff2d85a18d1fd18164059c68996049da570f9bdeb6c42']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178615-2894-45d4-9c9c-4fdd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:25.000Z",
            "modified": "2016-04-20T13:37:25.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: 92620194a581a91874a5284a775014e0d71a9db1",
            "pattern": "[file:hashes.MD5 = '473807de0d05cd6149060403ad01b658']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57178615-4ccc-4cb3-ba9f-4e5d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:25.000Z",
            "modified": "2016-04-20T13:37:25.000Z",
            "first_observed": "2016-04-20T13:37:25Z",
            "last_observed": "2016-04-20T13:37:25Z",
            "number_observed": 1,
            "object_refs": [
                "url--57178615-4ccc-4cb3-ba9f-4e5d02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57178615-4ccc-4cb3-ba9f-4e5d02de0b81",
            "value": "https://www.virustotal.com/file/4cd26e0d543e7da413bff2d85a18d1fd18164059c68996049da570f9bdeb6c42/analysis/1461138833/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178616-8334-49a1-894b-47b002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:26.000Z",
            "modified": "2016-04-20T13:37:26.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: 3f6e3e5126c837f46a18ee988dbf5756c2b856aa",
            "pattern": "[file:hashes.SHA256 = '773295583998b76b4e24b562f85fa685577067614133db4a7df3d2a28cb4cc3a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178616-2f48-49c5-b09f-43a102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:26.000Z",
            "modified": "2016-04-20T13:37:26.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: 3f6e3e5126c837f46a18ee988dbf5756c2b856aa",
            "pattern": "[file:hashes.MD5 = '89d6fc6c1a51cef335f7ee2bc2aa60ae']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57178616-c38c-41e1-8153-427302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:26.000Z",
            "modified": "2016-04-20T13:37:26.000Z",
            "first_observed": "2016-04-20T13:37:26Z",
            "last_observed": "2016-04-20T13:37:26Z",
            "number_observed": 1,
            "object_refs": [
                "url--57178616-c38c-41e1-8153-427302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57178616-c38c-41e1-8153-427302de0b81",
            "value": "https://www.virustotal.com/file/773295583998b76b4e24b562f85fa685577067614133db4a7df3d2a28cb4cc3a/analysis/1461097304/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178617-f8f4-4418-9175-4c7802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:27.000Z",
            "modified": "2016-04-20T13:37:27.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: dce911b1c05da965c8733935723b88bc29d12756",
            "pattern": "[file:hashes.SHA256 = 'a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178617-772c-419a-a05c-4ac202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:27.000Z",
            "modified": "2016-04-20T13:37:27.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: dce911b1c05da965c8733935723b88bc29d12756",
            "pattern": "[file:hashes.MD5 = '3bee1d24189d4941f68b96da6e207be4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57178617-7e78-4d57-b580-4ff702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:27.000Z",
            "modified": "2016-04-20T13:37:27.000Z",
            "first_observed": "2016-04-20T13:37:27Z",
            "last_observed": "2016-04-20T13:37:27Z",
            "number_observed": 1,
            "object_refs": [
                "url--57178617-7e78-4d57-b580-4ff702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57178617-7e78-4d57-b580-4ff702de0b81",
            "value": "https://www.virustotal.com/file/a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710/analysis/1461135574/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178618-2640-429a-9dfb-444602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:28.000Z",
            "modified": "2016-04-20T13:37:28.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: f8431cf0a73e4ede5b4b38185d73d8472cfe2ae7",
            "pattern": "[file:hashes.SHA256 = '9580e6c4deba3bd46419a402b6309f77c2ed47ad62299c82ec8578400c2a3a64']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178618-ec14-4daa-8a55-4db802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:28.000Z",
            "modified": "2016-04-20T13:37:28.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: f8431cf0a73e4ede5b4b38185d73d8472cfe2ae7",
            "pattern": "[file:hashes.MD5 = '64e7c95aefe82efb39185321a6cdd5c4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57178618-842c-4ff0-b9b4-4d3602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:28.000Z",
            "modified": "2016-04-20T13:37:28.000Z",
            "first_observed": "2016-04-20T13:37:28Z",
            "last_observed": "2016-04-20T13:37:28Z",
            "number_observed": 1,
            "object_refs": [
                "url--57178618-842c-4ff0-b9b4-4d3602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57178618-842c-4ff0-b9b4-4d3602de0b81",
            "value": "https://www.virustotal.com/file/9580e6c4deba3bd46419a402b6309f77c2ed47ad62299c82ec8578400c2a3a64/analysis/1461138863/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178619-addc-4013-afec-4bb102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:29.000Z",
            "modified": "2016-04-20T13:37:29.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: ca40233610d40258539da0212a06af29b07c13f6",
            "pattern": "[file:hashes.SHA256 = 'd41b5d3d0c6c0e8e9c850eaedf84623f48ba8e72f3867e57b0d94ddaaca738ee']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57178619-42e0-4a5e-b2d3-472302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:29.000Z",
            "modified": "2016-04-20T13:37:29.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: ca40233610d40258539da0212a06af29b07c13f6",
            "pattern": "[file:hashes.MD5 = '4fe313da6d94379f996c31754df8eb30']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57178619-654c-44e2-9428-438c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:29.000Z",
            "modified": "2016-04-20T13:37:29.000Z",
            "first_observed": "2016-04-20T13:37:29Z",
            "last_observed": "2016-04-20T13:37:29Z",
            "number_observed": 1,
            "object_refs": [
                "url--57178619-654c-44e2-9428-438c02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57178619-654c-44e2-9428-438c02de0b81",
            "value": "https://www.virustotal.com/file/d41b5d3d0c6c0e8e9c850eaedf84623f48ba8e72f3867e57b0d94ddaaca738ee/analysis/1460698641/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717861a-8e9c-47e1-84c8-494702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:30.000Z",
            "modified": "2016-04-20T13:37:30.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: 1ad9f8695c10adb69bdebd6bdc39b119707d500e",
            "pattern": "[file:hashes.SHA256 = '917809beb6566079dbb6b686107756d9eb3ff4543f6b41ef327cea7497118457']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717861a-3d08-457e-be9c-480c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:30.000Z",
            "modified": "2016-04-20T13:37:30.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: 1ad9f8695c10adb69bdebd6bdc39b119707d500e",
            "pattern": "[file:hashes.MD5 = '6984a724843fb60130a965a9fc317f2d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5717861a-3ab0-4f6d-8331-407602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:30.000Z",
            "modified": "2016-04-20T13:37:30.000Z",
            "first_observed": "2016-04-20T13:37:30Z",
            "last_observed": "2016-04-20T13:37:30Z",
            "number_observed": 1,
            "object_refs": [
                "url--5717861a-3ab0-4f6d-8331-407602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5717861a-3ab0-4f6d-8331-407602de0b81",
            "value": "https://www.virustotal.com/file/917809beb6566079dbb6b686107756d9eb3ff4543f6b41ef327cea7497118457/analysis/1461128493/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717861b-7674-4714-b055-4ecb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:31.000Z",
            "modified": "2016-04-20T13:37:31.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: ce42e2c694ca4737ae68d3c9e333554c55afee27",
            "pattern": "[file:hashes.SHA256 = '31823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717861b-f874-4e76-b5a2-40e702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:31.000Z",
            "modified": "2016-04-20T13:37:31.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: ce42e2c694ca4737ae68d3c9e333554c55afee27",
            "pattern": "[file:hashes.MD5 = '4c153eacdfa8807f1c8fd98e5267da4b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5717861b-b2fc-4335-9464-418e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:31.000Z",
            "modified": "2016-04-20T13:37:31.000Z",
            "first_observed": "2016-04-20T13:37:31Z",
            "last_observed": "2016-04-20T13:37:31Z",
            "number_observed": 1,
            "object_refs": [
                "url--5717861b-b2fc-4335-9464-418e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5717861b-b2fc-4335-9464-418e02de0b81",
            "value": "https://www.virustotal.com/file/31823040d8ccb20eab0b8653d01af370a6537017e69ead69f6f7b73d6ef7ac14/analysis/1460584418/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717861c-d81c-455a-97a2-477902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:32.000Z",
            "modified": "2016-04-20T13:37:32.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: dc307a673aa5eecb5c1400f1d342e03697564f98",
            "pattern": "[file:hashes.SHA256 = '80a6681b00056a487bba1b66c046b798dfe18bf37aa30d8a4a1be968b9add997']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717861c-56f4-4465-ae03-4a2402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:32.000Z",
            "modified": "2016-04-20T13:37:32.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: dc307a673aa5eecb5c1400f1d342e03697564f98",
            "pattern": "[file:hashes.MD5 = '1e0812fbdaa20a2b9aaddf531daed935']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5717861c-20c0-438e-b295-489a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:32.000Z",
            "modified": "2016-04-20T13:37:32.000Z",
            "first_observed": "2016-04-20T13:37:32Z",
            "last_observed": "2016-04-20T13:37:32Z",
            "number_observed": 1,
            "object_refs": [
                "url--5717861c-20c0-438e-b295-489a02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5717861c-20c0-438e-b295-489a02de0b81",
            "value": "https://www.virustotal.com/file/80a6681b00056a487bba1b66c046b798dfe18bf37aa30d8a4a1be968b9add997/analysis/1461138898/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717861c-d06c-475f-bb8f-47eb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:32.000Z",
            "modified": "2016-04-20T13:37:32.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: 0c269c5a641fd479269c2f353841a5bf9910888b",
            "pattern": "[file:hashes.SHA256 = 'bc83ef30422eb7b0c8903d3b4f1d4258e25cf78e9357a30dac773f8d2c17aa28']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5717861d-adf0-4e8c-8670-4d5202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:33.000Z",
            "modified": "2016-04-20T13:37:33.000Z",
            "description": "Imported via the freetext import. - Xchecked via VT: 0c269c5a641fd479269c2f353841a5bf9910888b",
            "pattern": "[file:hashes.MD5 = '5a9bd3d7f1534431a396a033d16ca496']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-04-20T13:37:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5717861d-48a0-448a-a172-431402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T13:37:33.000Z",
            "modified": "2016-04-20T13:37:33.000Z",
            "first_observed": "2016-04-20T13:37:33Z",
            "last_observed": "2016-04-20T13:37:33Z",
            "number_observed": 1,
            "object_refs": [
                "url--5717861d-48a0-448a-a172-431402de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5717861d-48a0-448a-a172-431402de0b81",
            "value": "https://www.virustotal.com/file/bc83ef30422eb7b0c8903d3b4f1d4258e25cf78e9357a30dac773f8d2c17aa28/analysis/1460698688/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}