{
    "type": "bundle",
    "id": "bundle--59c561be-c660-49d3-8193-e0c7950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-25T13:03:16.000Z",
            "modified": "2017-09-25T13:03:16.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--59c561be-c660-49d3-8193-e0c7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-25T13:03:16.000Z",
            "modified": "2017-09-25T13:03:16.000Z",
            "name": "M2M -  Locky: \"Invoice RE-2017-09-21-00xxx\"\tfrom \"Amazon Marketplace\"",
            "published": "2017-09-25T13:03:22Z",
            "object_refs": [
                "indicator--59c561be-fa38-421b-83fc-48f8950d210f",
                "indicator--59c561bf-9720-416e-9b86-46f0950d210f",
                "indicator--59c561bf-ecd0-4323-96e1-43b0950d210f",
                "indicator--59c561bf-b0f8-4391-8ae4-4309950d210f",
                "indicator--59c561c0-b2a0-4e35-bd50-4bd6950d210f",
                "indicator--59c561c0-b5e0-4142-8649-4ec8950d210f",
                "observed-data--59c561c1-9178-4058-9cb3-d2d7950d210f",
                "network-traffic--59c561c1-9178-4058-9cb3-d2d7950d210f",
                "ipv4-addr--59c561c1-9178-4058-9cb3-d2d7950d210f",
                "indicator--59c561c2-3f34-494b-b73a-4875950d210f",
                "indicator--59c561c2-4e58-4fa3-bca7-4b66950d210f",
                "observed-data--59c561c2-aed4-4bb2-8c22-4aae950d210f",
                "network-traffic--59c561c2-aed4-4bb2-8c22-4aae950d210f",
                "ipv4-addr--59c561c2-aed4-4bb2-8c22-4aae950d210f",
                "indicator--59c561c3-9fa0-43bf-93b3-df79950d210f",
                "indicator--59c561c3-fc10-43e6-855d-47cd950d210f",
                "observed-data--59c561c3-97c8-4a82-a68c-e0d9950d210f",
                "network-traffic--59c561c3-97c8-4a82-a68c-e0d9950d210f",
                "ipv4-addr--59c561c3-97c8-4a82-a68c-e0d9950d210f",
                "indicator--59c561c4-7880-4a4b-b932-47ba950d210f",
                "indicator--59c561c4-af4c-4f57-a1f0-d2d7950d210f",
                "observed-data--59c561c4-9288-4676-bd19-7461950d210f",
                "network-traffic--59c561c4-9288-4676-bd19-7461950d210f",
                "ipv4-addr--59c561c4-9288-4676-bd19-7461950d210f",
                "indicator--59c561c5-e5a0-4e89-8240-48e2950d210f",
                "indicator--59c561c5-5350-430b-ab83-49ba950d210f",
                "observed-data--59c561c5-bdd4-4047-bb19-4656950d210f",
                "network-traffic--59c561c5-bdd4-4047-bb19-4656950d210f",
                "ipv4-addr--59c561c5-bdd4-4047-bb19-4656950d210f",
                "indicator--59c561c6-32bc-40b5-8b26-e0d9950d210f",
                "indicator--59c561c6-2a60-4934-afb3-4b36950d210f",
                "observed-data--59c561c6-a6c4-4293-b7ac-4260950d210f",
                "network-traffic--59c561c6-a6c4-4293-b7ac-4260950d210f",
                "ipv4-addr--59c561c6-a6c4-4293-b7ac-4260950d210f",
                "indicator--59c561c7-2b18-4256-b68a-41cf950d210f",
                "indicator--59c561c7-3358-4ad1-8ada-1330950d210f",
                "observed-data--59c561c7-7fb8-4db0-9207-e0c7950d210f",
                "network-traffic--59c561c7-7fb8-4db0-9207-e0c7950d210f",
                "ipv4-addr--59c561c7-7fb8-4db0-9207-e0c7950d210f",
                "indicator--59c561c8-df5c-4a42-9887-42d2950d210f",
                "indicator--59c561c8-cda8-4c40-a088-4fde950d210f",
                "observed-data--59c561c8-15ec-4b9d-bed3-4e91950d210f",
                "network-traffic--59c561c8-15ec-4b9d-bed3-4e91950d210f",
                "ipv4-addr--59c561c8-15ec-4b9d-bed3-4e91950d210f",
                "indicator--59c561c9-1a30-4595-972b-475f950d210f",
                "indicator--59c561c9-e21c-48e3-9b19-d2d7950d210f",
                "observed-data--59c561ca-5134-4bee-a8f5-7461950d210f",
                "network-traffic--59c561ca-5134-4bee-a8f5-7461950d210f",
                "ipv4-addr--59c561ca-5134-4bee-a8f5-7461950d210f",
                "indicator--59c561ca-d87c-4f1a-b49c-e0c7950d210f",
                "indicator--59c561ca-fe2c-4e66-8408-44e2950d210f",
                "observed-data--59c561ca-4290-4553-baa4-449d950d210f",
                "network-traffic--59c561ca-4290-4553-baa4-449d950d210f",
                "ipv4-addr--59c561ca-4290-4553-baa4-449d950d210f",
                "indicator--59c561cb-7710-463b-843c-411b950d210f",
                "indicator--59c561cb-22c0-4e86-9c65-4e82950d210f",
                "indicator--59c561cc-4128-45ea-ac19-df79950d210f",
                "indicator--59c561cc-44e0-43a8-a6c9-40aa950d210f",
                "observed-data--59c561cd-3be8-4825-a2e0-d2d7950d210f",
                "network-traffic--59c561cd-3be8-4825-a2e0-d2d7950d210f",
                "ipv4-addr--59c561cd-3be8-4825-a2e0-d2d7950d210f",
                "indicator--59c561cd-b0e8-4e76-9e05-4670950d210f",
                "observed-data--59c561d0-4d28-48f3-997d-1330950d210f",
                "url--59c561d0-4d28-48f3-997d-1330950d210f",
                "observed-data--59c561d6-b3d4-4c42-a4a9-48c0950d210f",
                "url--59c561d6-b3d4-4c42-a4a9-48c0950d210f",
                "observed-data--59c561d6-0cac-48c8-9a4d-42f9950d210f",
                "url--59c561d6-0cac-48c8-9a4d-42f9950d210f",
                "observed-data--59c561d6-1f8c-42d4-8dca-4d6a950d210f",
                "url--59c561d6-1f8c-42d4-8dca-4d6a950d210f",
                "indicator--59c56293-68e4-4593-a751-484802de0b81",
                "indicator--59c56293-cd4c-41e1-b0fa-463b02de0b81",
                "observed-data--59c56293-67c0-4948-a658-4c1402de0b81",
                "url--59c56293-67c0-4948-a658-4c1402de0b81",
                "indicator--59c56293-80c4-4db9-a9eb-44f702de0b81",
                "indicator--59c56293-6ca8-4988-b890-490c02de0b81",
                "observed-data--59c56293-5f64-49d4-8ff6-44e902de0b81",
                "url--59c56293-5f64-49d4-8ff6-44e902de0b81",
                "indicator--59c56293-4794-477d-8834-441a02de0b81",
                "observed-data--59c56293-9ffc-40dc-b442-4f9902de0b81",
                "url--59c56293-9ffc-40dc-b442-4f9902de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "ecsirt:malicious-code=\"ransomware\"",
                "misp-galaxy:ransomware=\"Locky\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561be-fa38-421b-83fc-48f8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[file:hashes.MD5 = '149d63efd95781f3d3a07b838d14f04e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561bf-9720-416e-9b86-46f0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[file:hashes.SHA256 = '35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561bf-ecd0-4323-96e1-43b0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[file:hashes.SHA256 = 'ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561bf-b0f8-4391-8ae4-4309950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[file:hashes.SHA256 = '7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c0-b2a0-4e35-bd50-4bd6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://81552.com/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c0-b5e0-4142-8649-4ec8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = '81552.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561c1-9178-4058-9cb3-d2d7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561c1-9178-4058-9cb3-d2d7950d210f",
                "ipv4-addr--59c561c1-9178-4058-9cb3-d2d7950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561c1-9178-4058-9cb3-d2d7950d210f",
            "dst_ref": "ipv4-addr--59c561c1-9178-4058-9cb3-d2d7950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561c1-9178-4058-9cb3-d2d7950d210f",
            "value": "203.83.241.105"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c2-3f34-494b-b73a-4875950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://accuflowfloors.com/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c2-4e58-4fa3-bca7-4b66950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'accuflowfloors.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561c2-aed4-4bb2-8c22-4aae950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561c2-aed4-4bb2-8c22-4aae950d210f",
                "ipv4-addr--59c561c2-aed4-4bb2-8c22-4aae950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561c2-aed4-4bb2-8c22-4aae950d210f",
            "dst_ref": "ipv4-addr--59c561c2-aed4-4bb2-8c22-4aae950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561c2-aed4-4bb2-8c22-4aae950d210f",
            "value": "65.182.174.12"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c3-9fa0-43bf-93b3-df79950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://adr-werbetechnik.de/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c3-fc10-43e6-855d-47cd950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'adr-werbetechnik.de']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561c3-97c8-4a82-a68c-e0d9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561c3-97c8-4a82-a68c-e0d9950d210f",
                "ipv4-addr--59c561c3-97c8-4a82-a68c-e0d9950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561c3-97c8-4a82-a68c-e0d9950d210f",
            "dst_ref": "ipv4-addr--59c561c3-97c8-4a82-a68c-e0d9950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561c3-97c8-4a82-a68c-e0d9950d210f",
            "value": "85.236.207.83"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c4-7880-4a4b-b932-47ba950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://aetozi.gr/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c4-af4c-4f57-a1f0-d2d7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'aetozi.gr']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561c4-9288-4676-bd19-7461950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561c4-9288-4676-bd19-7461950d210f",
                "ipv4-addr--59c561c4-9288-4676-bd19-7461950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561c4-9288-4676-bd19-7461950d210f",
            "dst_ref": "ipv4-addr--59c561c4-9288-4676-bd19-7461950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561c4-9288-4676-bd19-7461950d210f",
            "value": "185.4.135.15"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c5-e5a0-4e89-8240-48e2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://afmance.it/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c5-5350-430b-ab83-49ba950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'afmance.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561c5-bdd4-4047-bb19-4656950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561c5-bdd4-4047-bb19-4656950d210f",
                "ipv4-addr--59c561c5-bdd4-4047-bb19-4656950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561c5-bdd4-4047-bb19-4656950d210f",
            "dst_ref": "ipv4-addr--59c561c5-bdd4-4047-bb19-4656950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561c5-bdd4-4047-bb19-4656950d210f",
            "value": "151.1.140.206"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c6-32bc-40b5-8b26-e0d9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://afradem.com/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c6-2a60-4934-afb3-4b36950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'afradem.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561c6-a6c4-4293-b7ac-4260950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561c6-a6c4-4293-b7ac-4260950d210f",
                "ipv4-addr--59c561c6-a6c4-4293-b7ac-4260950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561c6-a6c4-4293-b7ac-4260950d210f",
            "dst_ref": "ipv4-addr--59c561c6-a6c4-4293-b7ac-4260950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561c6-a6c4-4293-b7ac-4260950d210f",
            "value": "178.255.99.134"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c7-2b18-4256-b68a-41cf950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://agricom.it/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c7-3358-4ad1-8ada-1330950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'agricom.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561c7-7fb8-4db0-9207-e0c7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561c7-7fb8-4db0-9207-e0c7950d210f",
                "ipv4-addr--59c561c7-7fb8-4db0-9207-e0c7950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561c7-7fb8-4db0-9207-e0c7950d210f",
            "dst_ref": "ipv4-addr--59c561c7-7fb8-4db0-9207-e0c7950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561c7-7fb8-4db0-9207-e0c7950d210f",
            "value": "195.225.168.230"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c8-df5c-4a42-9887-42d2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://agriturismobellaria.net/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c8-cda8-4c40-a088-4fde950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'agriturismobellaria.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561c8-15ec-4b9d-bed3-4e91950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561c8-15ec-4b9d-bed3-4e91950d210f",
                "ipv4-addr--59c561c8-15ec-4b9d-bed3-4e91950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561c8-15ec-4b9d-bed3-4e91950d210f",
            "dst_ref": "ipv4-addr--59c561c8-15ec-4b9d-bed3-4e91950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561c8-15ec-4b9d-bed3-4e91950d210f",
            "value": "80.88.87.95"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c9-1a30-4595-972b-475f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://agro-kerler.de/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561c9-e21c-48e3-9b19-d2d7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'agro-kerler.de']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561ca-5134-4bee-a8f5-7461950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561ca-5134-4bee-a8f5-7461950d210f",
                "ipv4-addr--59c561ca-5134-4bee-a8f5-7461950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561ca-5134-4bee-a8f5-7461950d210f",
            "dst_ref": "ipv4-addr--59c561ca-5134-4bee-a8f5-7461950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561ca-5134-4bee-a8f5-7461950d210f",
            "value": "213.165.96.3"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561ca-d87c-4f1a-b49c-e0c7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://ahlbrandt.eu/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561ca-fe2c-4e66-8408-44e2950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'ahlbrandt.eu']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561ca-4290-4553-baa4-449d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561ca-4290-4553-baa4-449d950d210f",
                "ipv4-addr--59c561ca-4290-4553-baa4-449d950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561ca-4290-4553-baa4-449d950d210f",
            "dst_ref": "ipv4-addr--59c561ca-4290-4553-baa4-449d950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561ca-4290-4553-baa4-449d950d210f",
            "value": "87.230.26.149"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561cb-7710-463b-843c-411b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://fulcar.info/p66/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561cb-22c0-4e86-9c65-4e82950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'fulcar.info']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561cc-4128-45ea-ac19-df79950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[url:value = 'http://moonmusic.com.au/IUGiwe8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561cc-44e0-43a8-a6c9-40aa950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "pattern": "[domain-name:value = 'moonmusic.com.au']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561cd-3be8-4825-a2e0-d2d7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--59c561cd-3be8-4825-a2e0-d2d7950d210f",
                "ipv4-addr--59c561cd-3be8-4825-a2e0-d2d7950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--59c561cd-3be8-4825-a2e0-d2d7950d210f",
            "dst_ref": "ipv4-addr--59c561cd-3be8-4825-a2e0-d2d7950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--59c561cd-3be8-4825-a2e0-d2d7950d210f",
            "value": "117.55.235.14"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c561cd-b0e8-4e76-9e05-4670950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-25T12:56:13.000Z",
            "modified": "2017-09-25T12:56:13.000Z",
            "pattern": "[url:value = 'http://blog.dynamoo.com/2017/09/malware-spam-invoice-re-2017-09-21.html']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-25T12:56:13Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "External analysis"
                }
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561d0-4d28-48f3-997d-1330950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c561d0-4d28-48f3-997d-1330950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c561d0-4d28-48f3-997d-1330950d210f",
            "value": "https://www.virustotal.com/#/file/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca/detection"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561d6-b3d4-4c42-a4a9-48c0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c561d6-b3d4-4c42-a4a9-48c0950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c561d6-b3d4-4c42-a4a9-48c0950d210f",
            "value": "https://www.virustotal.com/#/file/ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53/detection"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561d6-0cac-48c8-9a4d-42f9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c561d6-0cac-48c8-9a4d-42f9950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c561d6-0cac-48c8-9a4d-42f9950d210f",
            "value": "https://www.hybrid-analysis.com/sample/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca?environmentId=100"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c561d6-1f8c-42d4-8dca-4d6a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:50.000Z",
            "modified": "2017-09-22T19:20:50.000Z",
            "first_observed": "2017-09-22T19:20:50Z",
            "last_observed": "2017-09-22T19:20:50Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c561d6-1f8c-42d4-8dca-4d6a950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c561d6-1f8c-42d4-8dca-4d6a950d210f",
            "value": "https://www.hybrid-analysis.com/sample/7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c?environmentId=100"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56293-68e4-4593-a751-484802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "description": "- Xchecked via VT: 35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca",
            "pattern": "[file:hashes.SHA1 = '7eb945458b1f489b351b86e3ff4403edc3503653']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56293-cd4c-41e1-b0fa-463b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "description": "- Xchecked via VT: 35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca",
            "pattern": "[file:hashes.MD5 = 'f3fcbc16b37e56f7a89ddf7d0f718291']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56293-67c0-4948-a658-4c1402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c56293-67c0-4948-a658-4c1402de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c56293-67c0-4948-a658-4c1402de0b81",
            "value": "https://www.virustotal.com/file/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca/analysis/1506079172/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56293-80c4-4db9-a9eb-44f702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "description": "- Xchecked via VT: 7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c",
            "pattern": "[file:hashes.SHA1 = 'cb540085bef26e1b627476636701006abdff5de9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56293-6ca8-4988-b890-490c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "description": "- Xchecked via VT: 7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c",
            "pattern": "[file:hashes.MD5 = 'c47bc13595d44521b3f5567ded0a0a13']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56293-5f64-49d4-8ff6-44e902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c56293-5f64-49d4-8ff6-44e902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c56293-5f64-49d4-8ff6-44e902de0b81",
            "value": "https://www.virustotal.com/file/7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c/analysis/1505989331/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59c56293-4794-477d-8834-441a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "description": "- Xchecked via VT: ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53",
            "pattern": "[file:hashes.SHA1 = '0f4ca32e004dbbf7c3e485b3ccd6ed1adac7fb65']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-09-22T19:20:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59c56293-9ffc-40dc-b442-4f9902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-09-22T19:20:51.000Z",
            "modified": "2017-09-22T19:20:51.000Z",
            "first_observed": "2017-09-22T19:20:51Z",
            "last_observed": "2017-09-22T19:20:51Z",
            "number_observed": 1,
            "object_refs": [
                "url--59c56293-9ffc-40dc-b442-4f9902de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59c56293-9ffc-40dc-b442-4f9902de0b81",
            "value": "https://www.virustotal.com/file/ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53/analysis/1506053433/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}