{
    "type": "bundle",
    "id": "bundle--595d508c-dc3c-49e8-8288-4a6002de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--595d508c-dc3c-49e8-8288-4a6002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "name": "OSINT - The MeDoc Connection",
            "published": "2017-07-05T20:51:47Z",
            "object_refs": [
                "x-misp-attribute--595d509a-d224-4645-b1ac-439102de0b81",
                "observed-data--595d50a4-bd20-437d-8737-434802de0b81",
                "url--595d50a4-bd20-437d-8737-434802de0b81",
                "x-misp-attribute--595d50c5-f144-46fd-b6ff-46db02de0b81",
                "x-misp-attribute--595d50c6-db5c-4e7e-9db0-4d1002de0b81",
                "x-misp-attribute--595d50c6-569c-4921-b849-47d002de0b81",
                "x-misp-attribute--595d50c6-3ab8-40f2-bf02-4c4a02de0b81",
                "x-misp-attribute--595d50c6-8674-4393-aaa3-434a02de0b81",
                "x-misp-attribute--595d50c6-f770-47d6-a061-496202de0b81",
                "indicator--595d50d5-2328-427b-9535-4fe302de0b81",
                "indicator--595d50d5-f8e8-4769-93b1-400e02de0b81",
                "indicator--595d50e8-d3f0-4552-9306-437c02de0b81",
                "indicator--595d50e8-307c-4a7f-b19b-4e0502de0b81",
                "indicator--595d50e8-7a6c-493f-a1c8-452502de0b81",
                "indicator--595d50fb-f4a8-4e59-8d73-436402de0b81",
                "indicator--595d50fb-3ac8-473b-82c8-45f002de0b81",
                "indicator--595d50fb-1dcc-4ac3-9755-4ff802de0b81",
                "indicator--595d514c-c9ac-4ccd-bb65-499602de0b81",
                "indicator--595d514c-d144-4815-98f0-4c9d02de0b81",
                "observed-data--595d514c-81e4-4e91-8bc4-4be202de0b81",
                "url--595d514c-81e4-4e91-8bc4-4be202de0b81",
                "indicator--595d514c-a0ac-487c-a2ba-41f202de0b81",
                "indicator--595d514c-4188-483d-9fd9-4a9702de0b81",
                "observed-data--595d514c-1d84-4628-99a6-44a102de0b81",
                "url--595d514c-1d84-4628-99a6-44a102de0b81",
                "indicator--595d514c-857c-4902-81e0-455102de0b81",
                "indicator--595d514c-5fe8-42ca-850a-42c002de0b81",
                "observed-data--595d514c-d7c0-4e20-ba7f-4b9d02de0b81",
                "url--595d514c-d7c0-4e20-ba7f-4b9d02de0b81",
                "indicator--595d514c-9030-4303-9902-496d02de0b81",
                "indicator--595d514c-b8bc-4293-a0ea-4dff02de0b81",
                "observed-data--595d514c-c4e0-49cc-82d7-468802de0b81",
                "url--595d514c-c4e0-49cc-82d7-468802de0b81",
                "indicator--595d514c-0284-4d7b-9762-494a02de0b81",
                "indicator--595d514c-d754-4082-9b7a-451102de0b81",
                "observed-data--595d514c-3d18-431e-bcf0-457c02de0b81",
                "url--595d514c-3d18-431e-bcf0-457c02de0b81",
                "indicator--595d514c-0248-4f6d-a21e-422702de0b81",
                "indicator--595d514c-363c-4b80-b083-469102de0b81",
                "observed-data--595d514c-a394-41bb-9d53-404102de0b81",
                "url--595d514c-a394-41bb-9d53-404102de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "osint:source-type=\"blog-post\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--595d509a-d224-4645-b1ac-439102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "The Nyetya attack was a destructive ransomware variant that affected many organizations inside of Ukraine and multinational corporations with operations in Ukraine. In cooperation with Cisco Advanced Services Incident Response, Talos identified several key aspects of the attack. The investigation found a supply chain-focused attack at M.E.Doc software that delivered a destructive payload disguised as ransomware. By utilizing stolen credentials, the actor was able to manipulate the update server for M.E.Doc to proxy connections to an actor-controlled server. Based on the findings, Talos remains confident that the attack was destructive in nature. The effects were broad reaching, with Ukraine Cyber police confirming over 2000 affected companies in Ukraine alone."
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595d50a4-bd20-437d-8737-434802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "first_observed": "2017-07-05T20:51:23Z",
            "last_observed": "2017-07-05T20:51:23Z",
            "number_observed": 1,
            "object_refs": [
                "url--595d50a4-bd20-437d-8737-434802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595d50a4-bd20-437d-8737-434802de0b81",
            "value": "http://blog.talosintelligence.com/2017/07/the-medoc-connection.html"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--595d50c5-f144-46fd-b6ff-46db02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "W32.Ransomware.Nyetya.Talos"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--595d50c6-db5c-4e7e-9db0-4d1002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "W32.F9D6FE8BD8.Backdoor.Ransomware.Nyetya.Talos"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--595d50c6-569c-4921-b849-47d002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "W32.D462966166.Backdoor.Ransomware.Nyetya.Talos"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--595d50c6-3ab8-40f2-bf02-4c4a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "W32.2FD2863D71.Backdoor.Ransomware.Nyetya.Talos"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--595d50c6-8674-4393-aaa3-434a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "W32.02EF73BD24-95.SBX.TG"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--595d50c6-f770-47d6-a061-496202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "W32.GenericKD:Petya.20h1.1201"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d50d5-2328-427b-9535-4fe302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "description": "MALICIOUS IP ADDRESSES:",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.31.182.167']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d50d5-f8e8-4769-93b1-400e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "description": "MALICIOUS IP ADDRESSES:",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '159.148.186.214']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d50e8-d3f0-4552-9306-437c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "description": "NYETYA MALWARE",
            "pattern": "[file:hashes.SHA256 = '027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d50e8-307c-4a7f-b19b-4e0502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "description": "NYETYA MALWARE",
            "pattern": "[file:hashes.SHA256 = '02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d50e8-7a6c-493f-a1c8-452502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "description": "NYETYA MALWARE",
            "pattern": "[file:hashes.SHA256 = 'eae9771e2eeb7ea3c6059485da39e77b8c0c369232f01334954fbac1c186c998']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d50fb-f4a8-4e59-8d73-436402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR:",
            "pattern": "[file:hashes.SHA256 = 'f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d50fb-3ac8-473b-82c8-45f002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR:",
            "pattern": "[file:hashes.SHA256 = 'd462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d50fb-1dcc-4ac3-9755-4ff802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:23.000Z",
            "modified": "2017-07-05T20:51:23.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR:",
            "pattern": "[file:hashes.SHA256 = '2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-c9ac-4ccd-bb65-499602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR: - Xchecked via VT: 2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277",
            "pattern": "[file:hashes.SHA1 = '3567434e2e49358e8210674641a20b147e0bd23c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-d144-4815-98f0-4c9d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR: - Xchecked via VT: 2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277",
            "pattern": "[file:hashes.MD5 = '3efe62f6cb7285153114f888900a0962']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595d514c-81e4-4e91-8bc4-4be202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "first_observed": "2017-07-05T20:51:24Z",
            "last_observed": "2017-07-05T20:51:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--595d514c-81e4-4e91-8bc4-4be202de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595d514c-81e4-4e91-8bc4-4be202de0b81",
            "value": "https://www.virustotal.com/file/2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277/analysis/1499286304/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-a0ac-487c-a2ba-41f202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR: - Xchecked via VT: d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac",
            "pattern": "[file:hashes.SHA1 = '7f3b1c56c180369ae7891483675bec61f3182f27']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-4188-483d-9fd9-4a9702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR: - Xchecked via VT: d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac",
            "pattern": "[file:hashes.MD5 = '87db6af04613f4bd70467720239117e5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595d514c-1d84-4628-99a6-44a102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "first_observed": "2017-07-05T20:51:24Z",
            "last_observed": "2017-07-05T20:51:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--595d514c-1d84-4628-99a6-44a102de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595d514c-1d84-4628-99a6-44a102de0b81",
            "value": "https://www.virustotal.com/file/d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac/analysis/1499278990/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-857c-4902-81e0-455102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR: - Xchecked via VT: f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740",
            "pattern": "[file:hashes.SHA1 = '7b051e7e7a82f07873fa360958acc6492e4385dd']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-5fe8-42ca-850a-42c002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "M.E.DOC ZVITPUBLISHEDOBJECTS.DLL FILES WITH BACKDOOR: - Xchecked via VT: f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740",
            "pattern": "[file:hashes.MD5 = '8f5718be4ba2c6e4f8ce1597248bb03f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595d514c-d7c0-4e20-ba7f-4b9d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "first_observed": "2017-07-05T20:51:24Z",
            "last_observed": "2017-07-05T20:51:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--595d514c-d7c0-4e20-ba7f-4b9d02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595d514c-d7c0-4e20-ba7f-4b9d02de0b81",
            "value": "https://www.virustotal.com/file/f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740/analysis/1499256049/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-9030-4303-9902-496d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "NYETYA MALWARE - Xchecked via VT: eae9771e2eeb7ea3c6059485da39e77b8c0c369232f01334954fbac1c186c998",
            "pattern": "[file:hashes.SHA1 = '56c03d8e43f50568741704aee482704a4f5005ad']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-b8bc-4293-a0ea-4dff02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "NYETYA MALWARE - Xchecked via VT: eae9771e2eeb7ea3c6059485da39e77b8c0c369232f01334954fbac1c186c998",
            "pattern": "[file:hashes.MD5 = '2813d34f6197eb4df42c886ec7f234a1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595d514c-c4e0-49cc-82d7-468802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "first_observed": "2017-07-05T20:51:24Z",
            "last_observed": "2017-07-05T20:51:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--595d514c-c4e0-49cc-82d7-468802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595d514c-c4e0-49cc-82d7-468802de0b81",
            "value": "https://www.virustotal.com/file/eae9771e2eeb7ea3c6059485da39e77b8c0c369232f01334954fbac1c186c998/analysis/1498939521/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-0284-4d7b-9762-494a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "NYETYA MALWARE - Xchecked via VT: 02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f",
            "pattern": "[file:hashes.SHA1 = '38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-d754-4082-9b7a-451102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "NYETYA MALWARE - Xchecked via VT: 02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f",
            "pattern": "[file:hashes.MD5 = '7e37ab34ecdcc3e77e24522ddfd4852d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595d514c-3d18-431e-bcf0-457c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "first_observed": "2017-07-05T20:51:24Z",
            "last_observed": "2017-07-05T20:51:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--595d514c-3d18-431e-bcf0-457c02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595d514c-3d18-431e-bcf0-457c02de0b81",
            "value": "https://www.virustotal.com/file/02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f/analysis/1499122164/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-0248-4f6d-a21e-422702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "NYETYA MALWARE - Xchecked via VT: 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745",
            "pattern": "[file:hashes.SHA1 = '34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--595d514c-363c-4b80-b083-469102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "description": "NYETYA MALWARE - Xchecked via VT: 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745",
            "pattern": "[file:hashes.MD5 = '71b6a493388e7d0b40c83ce903bc6b04']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-07-05T20:51:24Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--595d514c-a394-41bb-9d53-404102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-07-05T20:51:24.000Z",
            "modified": "2017-07-05T20:51:24.000Z",
            "first_observed": "2017-07-05T20:51:24Z",
            "last_observed": "2017-07-05T20:51:24Z",
            "number_observed": 1,
            "object_refs": [
                "url--595d514c-a394-41bb-9d53-404102de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--595d514c-a394-41bb-9d53-404102de0b81",
            "value": "https://www.virustotal.com/file/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745/analysis/1499267430/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}