{
    "type": "bundle",
    "id": "bundle--584fabab-b03c-404c-8ff8-4433950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:32.000Z",
            "modified": "2016-12-13T08:08:32.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--584fabab-b03c-404c-8ff8-4433950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:32.000Z",
            "modified": "2016-12-13T08:08:32.000Z",
            "name": "OSINT - Windows 10: protection, detection, and response against recent Depriz malware attacks",
            "published": "2016-12-13T08:16:11Z",
            "object_refs": [
                "observed-data--584fabb7-4028-4bf3-b6b1-4963950d210f",
                "url--584fabb7-4028-4bf3-b6b1-4963950d210f",
                "x-misp-attribute--584fabcb-d218-44f6-ab11-40ab950d210f",
                "indicator--584fabe5-1424-464d-9330-46ef950d210f",
                "indicator--584fabe6-f5a8-4ecf-b0a1-4bd5950d210f",
                "indicator--584fabe6-5698-4cb8-93e8-4920950d210f",
                "indicator--584fabe6-3374-42f0-9f85-4b16950d210f",
                "indicator--584fabe6-1e18-4ab7-bea7-42b7950d210f",
                "indicator--584fac16-f83c-400f-9397-41dc950d210f",
                "indicator--584fac16-42c0-4af5-8c8d-4910950d210f",
                "x-misp-attribute--584fac33-c3c0-414a-92fb-464a950d210f",
                "x-misp-attribute--584fac33-7be4-4f0b-b5ec-4a30950d210f",
                "x-misp-attribute--584fac33-da00-4a71-92d7-4a09950d210f",
                "x-misp-attribute--584fac33-885c-41cd-84f8-4eee950d210f",
                "indicator--584fac80-e698-4685-8173-48f702de0b81",
                "indicator--584fac80-fa70-4953-a8a3-46f802de0b81",
                "observed-data--584fac81-86d8-44f1-be73-459502de0b81",
                "url--584fac81-86d8-44f1-be73-459502de0b81",
                "indicator--584fac81-38f0-460c-84b9-48d502de0b81",
                "indicator--584fac81-8a88-4819-8385-454302de0b81",
                "observed-data--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
                "url--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
                "indicator--584fac82-d864-4f8b-a64e-46ff02de0b81",
                "indicator--584fac82-2588-445b-a0d1-4d1502de0b81",
                "observed-data--584fac82-d674-48f2-ba3a-40d902de0b81",
                "url--584fac82-d674-48f2-ba3a-40d902de0b81",
                "indicator--584fac82-0bb4-4614-a42a-445b02de0b81",
                "indicator--584fac83-0cd0-4fb9-979e-4e7502de0b81",
                "observed-data--584fac83-e384-44ab-8511-432d02de0b81",
                "url--584fac83-e384-44ab-8511-432d02de0b81",
                "indicator--584fac83-5ef8-402e-ba66-4e0d02de0b81",
                "indicator--584fac83-3544-4270-9883-4ea502de0b81",
                "observed-data--584fac84-3308-4c86-b2e5-40e602de0b81",
                "url--584fac84-3308-4c86-b2e5-40e602de0b81",
                "indicator--584fac84-4a9c-442c-8fe1-4b8402de0b81",
                "indicator--584fac84-4b0c-4ffc-8888-4a8a02de0b81",
                "observed-data--584fac84-032c-4ca0-924d-450602de0b81",
                "url--584fac84-032c-4ca0-924d-450602de0b81",
                "indicator--584fac85-ad2c-42d1-890e-4f6202de0b81",
                "indicator--584fac85-01f4-4220-887d-438f02de0b81",
                "observed-data--584fac85-5e84-4d1b-b431-4f6902de0b81",
                "url--584fac85-5e84-4d1b-b431-4f6902de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:threat-actor=\"TERBIUM\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--584fabb7-4028-4bf3-b6b1-4963950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:05:11.000Z",
            "modified": "2016-12-13T08:05:11.000Z",
            "first_observed": "2016-12-13T08:05:11Z",
            "last_observed": "2016-12-13T08:05:11Z",
            "number_observed": 1,
            "object_refs": [
                "url--584fabb7-4028-4bf3-b6b1-4963950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--584fabb7-4028-4bf3-b6b1-4963950d210f",
            "value": "https://blogs.technet.microsoft.com/mmpc/2016/12/09/windows-10-protection-detection-and-response-against-recent-attacks/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--584fabcb-d218-44f6-ab11-40ab950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:05:31.000Z",
            "modified": "2016-12-13T08:05:31.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "A few weeks ago, multiple organizations in the Middle East fell victim to targeted and destructive attacks that wiped data from computers, and in many cases rendering them unstable and unbootable. Destructive attacks like these have been observed repeatedly over the years and the Windows Defender and Windows Defender Advanced Threat Protection Threat Intelligence teams are working on protection, detection, and response to these threats.\r\n\r\nMicrosoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fabe5-1424-464d-9330-46ef950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:05:57.000Z",
            "modified": "2016-12-13T08:05:57.000Z",
            "description": "malicious files",
            "pattern": "[file:hashes.SHA1 = '5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:05:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fabe6-f5a8-4ecf-b0a1-4bd5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:05:58.000Z",
            "modified": "2016-12-13T08:05:58.000Z",
            "description": "malicious files",
            "pattern": "[file:hashes.SHA1 = 'e7c7f41babdb279c099526ece03ede9076edca4e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:05:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fabe6-5698-4cb8-93e8-4920950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:05:58.000Z",
            "modified": "2016-12-13T08:05:58.000Z",
            "description": "malicious files",
            "pattern": "[file:hashes.SHA1 = 'a2669df6f7615d317f610f731b6a2129fbed4203']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:05:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fabe6-3374-42f0-9f85-4b16950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:05:58.000Z",
            "modified": "2016-12-13T08:05:58.000Z",
            "description": "malicious files",
            "pattern": "[file:hashes.SHA1 = '425f02028dcc4e89a07d2892fef9346dac6c140a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:05:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fabe6-1e18-4ab7-bea7-42b7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:05:58.000Z",
            "modified": "2016-12-13T08:05:58.000Z",
            "description": "malicious files",
            "pattern": "[file:hashes.SHA1 = 'ad6744c7ea5fee854261efa403ca06b68761e290']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:05:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac16-f83c-400f-9397-41dc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:06:46.000Z",
            "modified": "2016-12-13T08:06:46.000Z",
            "description": "legitimate RawDisk drivers",
            "pattern": "[file:hashes.SHA1 = '1292c7dd60214d96a71e7705e519006b9de7968f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:06:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac16-42c0-4af5-8c8d-4910950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:06:46.000Z",
            "modified": "2016-12-13T08:06:46.000Z",
            "description": "legitimate RawDisk drivers",
            "pattern": "[file:hashes.SHA1 = 'ce549714a11bd43b52be709581c6e144957136ec']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:06:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--584fac33-c3c0-414a-92fb-464a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:07:15.000Z",
            "modified": "2016-12-13T08:07:15.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "Trojan:Win32/Depriz.A!dha"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--584fac33-7be4-4f0b-b5ec-4a30950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:07:15.000Z",
            "modified": "2016-12-13T08:07:15.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "Trojan:Win32/Depriz.B!dha"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--584fac33-da00-4a71-92d7-4a09950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:07:15.000Z",
            "modified": "2016-12-13T08:07:15.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "Trojan:Win32/Depriz.C!dha"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--584fac33-885c-41cd-84f8-4eee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:07:15.000Z",
            "modified": "2016-12-13T08:07:15.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "Trojan:Win32/Depriz.D!dha"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac80-e698-4685-8173-48f702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:32.000Z",
            "modified": "2016-12-13T08:08:32.000Z",
            "description": "legitimate RawDisk drivers - Xchecked via VT: ce549714a11bd43b52be709581c6e144957136ec",
            "pattern": "[file:hashes.SHA256 = '4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac80-fa70-4953-a8a3-46f802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:32.000Z",
            "modified": "2016-12-13T08:08:32.000Z",
            "description": "legitimate RawDisk drivers - Xchecked via VT: ce549714a11bd43b52be709581c6e144957136ec",
            "pattern": "[file:hashes.MD5 = '1493d342e7a36553c56b2adea150949e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--584fac81-86d8-44f1-be73-459502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:33.000Z",
            "modified": "2016-12-13T08:08:33.000Z",
            "first_observed": "2016-12-13T08:08:33Z",
            "last_observed": "2016-12-13T08:08:33Z",
            "number_observed": 1,
            "object_refs": [
                "url--584fac81-86d8-44f1-be73-459502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--584fac81-86d8-44f1-be73-459502de0b81",
            "value": "https://www.virustotal.com/file/4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6/analysis/1481093448/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac81-38f0-460c-84b9-48d502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:33.000Z",
            "modified": "2016-12-13T08:08:33.000Z",
            "description": "legitimate RawDisk drivers - Xchecked via VT: 1292c7dd60214d96a71e7705e519006b9de7968f",
            "pattern": "[file:hashes.SHA256 = '5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac81-8a88-4819-8385-454302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:33.000Z",
            "modified": "2016-12-13T08:08:33.000Z",
            "description": "legitimate RawDisk drivers - Xchecked via VT: 1292c7dd60214d96a71e7705e519006b9de7968f",
            "pattern": "[file:hashes.MD5 = '76c643ab29d497317085e5db8c799960']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:33.000Z",
            "modified": "2016-12-13T08:08:33.000Z",
            "first_observed": "2016-12-13T08:08:33Z",
            "last_observed": "2016-12-13T08:08:33Z",
            "number_observed": 1,
            "object_refs": [
                "url--584fac81-05fc-42e5-ba7d-4dbd02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
            "value": "https://www.virustotal.com/file/5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a/analysis/1480997926/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac82-d864-4f8b-a64e-46ff02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:34.000Z",
            "modified": "2016-12-13T08:08:34.000Z",
            "description": "malicious files - Xchecked via VT: ad6744c7ea5fee854261efa403ca06b68761e290",
            "pattern": "[file:hashes.SHA256 = '128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac82-2588-445b-a0d1-4d1502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:34.000Z",
            "modified": "2016-12-13T08:08:34.000Z",
            "description": "malicious files - Xchecked via VT: ad6744c7ea5fee854261efa403ca06b68761e290",
            "pattern": "[file:hashes.MD5 = '2cd0a5f1e9bcce6807e57ec8477d222a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--584fac82-d674-48f2-ba3a-40d902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:34.000Z",
            "modified": "2016-12-13T08:08:34.000Z",
            "first_observed": "2016-12-13T08:08:34Z",
            "last_observed": "2016-12-13T08:08:34Z",
            "number_observed": 1,
            "object_refs": [
                "url--584fac82-d674-48f2-ba3a-40d902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--584fac82-d674-48f2-ba3a-40d902de0b81",
            "value": "https://www.virustotal.com/file/128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd/analysis/1481237179/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac82-0bb4-4614-a42a-445b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:34.000Z",
            "modified": "2016-12-13T08:08:34.000Z",
            "description": "malicious files - Xchecked via VT: 425f02028dcc4e89a07d2892fef9346dac6c140a",
            "pattern": "[file:hashes.SHA256 = 'c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac83-0cd0-4fb9-979e-4e7502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:35.000Z",
            "modified": "2016-12-13T08:08:35.000Z",
            "description": "malicious files - Xchecked via VT: 425f02028dcc4e89a07d2892fef9346dac6c140a",
            "pattern": "[file:hashes.MD5 = 'c843046e54b755ec63ccb09d0a689674']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--584fac83-e384-44ab-8511-432d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:35.000Z",
            "modified": "2016-12-13T08:08:35.000Z",
            "first_observed": "2016-12-13T08:08:35Z",
            "last_observed": "2016-12-13T08:08:35Z",
            "number_observed": 1,
            "object_refs": [
                "url--584fac83-e384-44ab-8511-432d02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--584fac83-e384-44ab-8511-432d02de0b81",
            "value": "https://www.virustotal.com/file/c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a/analysis/1480864286/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac83-5ef8-402e-ba66-4e0d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:35.000Z",
            "modified": "2016-12-13T08:08:35.000Z",
            "description": "malicious files - Xchecked via VT: a2669df6f7615d317f610f731b6a2129fbed4203",
            "pattern": "[file:hashes.SHA256 = '448ad1bc06ea26f4709159f72ed70ca199ff2176182619afa03435d38cd53237']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac83-3544-4270-9883-4ea502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:35.000Z",
            "modified": "2016-12-13T08:08:35.000Z",
            "description": "malicious files - Xchecked via VT: a2669df6f7615d317f610f731b6a2129fbed4203",
            "pattern": "[file:hashes.MD5 = '5289f4b806bbd7893fbda3ce4025683e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--584fac84-3308-4c86-b2e5-40e602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:36.000Z",
            "modified": "2016-12-13T08:08:36.000Z",
            "first_observed": "2016-12-13T08:08:36Z",
            "last_observed": "2016-12-13T08:08:36Z",
            "number_observed": 1,
            "object_refs": [
                "url--584fac84-3308-4c86-b2e5-40e602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--584fac84-3308-4c86-b2e5-40e602de0b81",
            "value": "https://www.virustotal.com/file/448ad1bc06ea26f4709159f72ed70ca199ff2176182619afa03435d38cd53237/analysis/1481042001/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac84-4a9c-442c-8fe1-4b8402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:36.000Z",
            "modified": "2016-12-13T08:08:36.000Z",
            "description": "malicious files - Xchecked via VT: e7c7f41babdb279c099526ece03ede9076edca4e",
            "pattern": "[file:hashes.SHA256 = '394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac84-4b0c-4ffc-8888-4a8a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:36.000Z",
            "modified": "2016-12-13T08:08:36.000Z",
            "description": "malicious files - Xchecked via VT: e7c7f41babdb279c099526ece03ede9076edca4e",
            "pattern": "[file:hashes.MD5 = '5446f46d89124462ae7aca4fce420423']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--584fac84-032c-4ca0-924d-450602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:36.000Z",
            "modified": "2016-12-13T08:08:36.000Z",
            "first_observed": "2016-12-13T08:08:36Z",
            "last_observed": "2016-12-13T08:08:36Z",
            "number_observed": 1,
            "object_refs": [
                "url--584fac84-032c-4ca0-924d-450602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--584fac84-032c-4ca0-924d-450602de0b81",
            "value": "https://www.virustotal.com/file/394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b/analysis/1481303798/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac85-ad2c-42d1-890e-4f6202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:37.000Z",
            "modified": "2016-12-13T08:08:37.000Z",
            "description": "malicious files - Xchecked via VT: 5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6",
            "pattern": "[file:hashes.SHA256 = '47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--584fac85-01f4-4220-887d-438f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:37.000Z",
            "modified": "2016-12-13T08:08:37.000Z",
            "description": "malicious files - Xchecked via VT: 5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6",
            "pattern": "[file:hashes.MD5 = '8fbe990c2d493f58a2afa2b746e49c86']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-12-13T08:08:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--584fac85-5e84-4d1b-b431-4f6902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-12-13T08:08:37.000Z",
            "modified": "2016-12-13T08:08:37.000Z",
            "first_observed": "2016-12-13T08:08:37Z",
            "last_observed": "2016-12-13T08:08:37Z",
            "number_observed": 1,
            "object_refs": [
                "url--584fac85-5e84-4d1b-b431-4f6902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--584fac85-5e84-4d1b-b431-4f6902de0b81",
            "value": "https://www.virustotal.com/file/47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34/analysis/1481303775/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}