3566 lines
No EOL
152 KiB
JSON
3566 lines
No EOL
152 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5b265497-b458-4c11-a57c-45db02de0b81",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:46:47.000Z",
|
|
"modified": "2018-06-17T12:46:47.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5b265497-b458-4c11-a57c-45db02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:46:47.000Z",
|
|
"modified": "2018-06-17T12:46:47.000Z",
|
|
"name": "Malware Analysis Report (AR18-165A) MAR-10135536-12 \u00e2\u20ac\u201c North Korean Trojan: TYPEFRAME",
|
|
"published": "2018-06-17T13:00:35Z",
|
|
"object_refs": [
|
|
"indicator--eb2fc06f-a0a1-4f4a-bea3-adab040d70ff",
|
|
"indicator--7c86a82b-ba54-4ff1-8705-e11f3f7141e7",
|
|
"indicator--7ee15758-a1b1-430e-9c0d-99de31050d3f",
|
|
"indicator--2735b91e-6dfa-4588-a0d6-28fb8d167d7e",
|
|
"indicator--0987500d-f42e-44f8-95fc-d18c1b1093af",
|
|
"indicator--7b0d562b-47d2-442d-b783-db5287da59ac",
|
|
"indicator--e4484d7e-0ce1-4aaf-860d-dbbdb89e6aca",
|
|
"observed-data--5b2655ca-0590-41e5-aeec-6a6d02de0b81",
|
|
"url--5b2655ca-0590-41e5-aeec-6a6d02de0b81",
|
|
"x-misp-attribute--5b26563a-5330-43de-aac3-6a6202de0b81",
|
|
"x-misp-attribute--5b26569b-4d24-4f80-bfbc-170302de0b81",
|
|
"observed-data--5b265834-3cb0-4d59-a792-6a6d02de0b81",
|
|
"url--5b265834-3cb0-4d59-a792-6a6d02de0b81",
|
|
"x-misp-object--967ce91b-c8b4-42df-9f74-9e1ac6affd08",
|
|
"x-misp-object--0dbb16a9-0269-4682-a179-1d6891ff30b1",
|
|
"x-misp-object--ff95cbea-219e-4242-9f7d-a2d16a013a7b",
|
|
"x-misp-object--fd483ddd-cdc3-4296-8a89-c467247ede98",
|
|
"x-misp-object--7f5198c2-fd93-4401-80fa-e24b6a99bb3c",
|
|
"x-misp-object--345a90a3-5de7-44a1-8a57-a1a8999a1af5",
|
|
"x-misp-object--b94caa3a-5603-431b-8822-cca2a4ffa678",
|
|
"x-misp-object--bfc7f514-369a-40a2-9462-95c6228df9a4",
|
|
"x-misp-object--d9231a73-1ae1-4e99-877c-e6080aef6fd5",
|
|
"x-misp-object--e60aa2a5-bc11-4df9-9241-defe23af60a1",
|
|
"x-misp-object--ba4427c1-fc81-40e9-a10b-d14a0a20711d",
|
|
"x-misp-object--ac98153a-ec7f-4c54-b563-7917339cee04",
|
|
"x-misp-object--4afa330b-5bde-4778-b833-ba0ccdf53b67",
|
|
"x-misp-object--98db396b-fa79-441a-9ac6-f5c4b8ce4709",
|
|
"x-misp-object--331a2fb4-3f10-45ca-89c9-60cf96c9205f",
|
|
"x-misp-object--2c6f9016-4377-447f-84df-ddc4c2d59f35",
|
|
"x-misp-object--bd2613b3-ef57-4c37-9e55-26e51493ba3a",
|
|
"x-misp-object--16c183f2-2c3f-4304-ad99-9e19c2323ee0",
|
|
"x-misp-object--8a65ff90-3aad-4da9-a4be-b8b4a08878d2",
|
|
"indicator--1dd9ce3a-5709-4b5b-9dd2-12d9bf32e1d0",
|
|
"indicator--c2593c36-69f5-4c43-9fcc-b335d606d569",
|
|
"indicator--35046b12-4171-4598-ab66-f6c536f03862",
|
|
"indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f",
|
|
"indicator--137d6815-4196-433f-a8be-1fe04add3a5f",
|
|
"indicator--a84b8d9c-0175-411b-8b89-fc0ac709df56",
|
|
"indicator--f94d3e39-27ea-4214-bb44-c25505dc2326",
|
|
"indicator--d5b3a29b-484d-4619-b358-e8850a30e3a0",
|
|
"indicator--a13cfa83-8fb9-47f5-8bda-430bce2e0f7a",
|
|
"x-misp-object--8359531b-5e0a-4fdc-828d-d3901560fe58",
|
|
"x-misp-object--46e93d08-06fb-49ee-a465-b8680a4b04ae",
|
|
"x-misp-object--2543f106-3d8f-4855-a306-1f505ae9ee34",
|
|
"x-misp-object--8d81a602-68f0-470f-8eb3-3422ad8929fb",
|
|
"x-misp-object--1cc483ce-fc42-4c80-af86-6024c10f69f6",
|
|
"x-misp-object--0eb4a04f-9699-4e92-88a0-4a4dec688885",
|
|
"x-misp-object--5899141a-5be5-42de-90af-1e471b7b1d7c",
|
|
"x-misp-object--450c3377-2c9b-4b69-8381-f51dfe41f149",
|
|
"x-misp-object--3a9a5628-14e1-4f29-8722-93e142a93add",
|
|
"x-misp-object--f11af508-fb9e-49a3-a5ef-ed176fa9057b",
|
|
"x-misp-object--8b080900-6adf-4dd5-a3e3-470c719f6041",
|
|
"x-misp-object--0d3fcd9f-6a98-4566-b99c-941cf97a58c0",
|
|
"x-misp-object--15a888e0-c1b1-46cf-a341-32de4f623862",
|
|
"indicator--fc5663b5-c080-45b4-a405-147ca8570626",
|
|
"indicator--79461c6c-5900-4ecf-90f0-6157212636dd",
|
|
"indicator--206825c8-1f31-4ae3-be07-5cb1b63e98a1",
|
|
"indicator--0522e8ab-595b-46fd-b97c-bded45adfd05",
|
|
"indicator--cffd2eaa-1a45-40de-b9d1-aa6999601750",
|
|
"indicator--14dfc596-3c8f-4d1e-8194-56873bf809f0",
|
|
"indicator--c56a8843-6462-4e48-9354-ff3cea9b393c",
|
|
"x-misp-object--7dd632d5-39a8-491a-80cc-c163755c56db",
|
|
"x-misp-object--c22f54ef-0428-4b7e-aab1-c0ba1b6259ea",
|
|
"x-misp-object--be6d670d-923a-411a-97db-bf73901abf56",
|
|
"x-misp-object--b8e7aa5e-5681-4393-8581-a207f6651129",
|
|
"x-misp-object--2e3d47fa-ccc7-4549-8005-9d0b2481219a",
|
|
"x-misp-object--81c54539-acd4-4f39-981f-2c07d8e783df",
|
|
"x-misp-object--6a9e84ce-dc0b-48a5-a1b3-a70f871f6a08",
|
|
"x-misp-object--510ac6ad-b6d5-4be7-9a51-0ad210190eff",
|
|
"x-misp-object--f127c64b-bf6c-4448-a66f-b455d9f0a695",
|
|
"x-misp-object--72f0a63e-d53f-423b-b762-096a7f70ba1c",
|
|
"x-misp-object--33e578e5-10bc-4442-9737-ff332c9c2bbd",
|
|
"x-misp-object--d54ec2e8-330d-496a-bd90-c388db285a90",
|
|
"x-misp-object--cad943d1-b772-45d8-8cd1-7e3fde522cf7",
|
|
"x-misp-object--c07156a8-22b8-4496-9173-632a17da707a",
|
|
"x-misp-object--4d0aac8e-a228-4186-9626-37b23b6e06a3",
|
|
"x-misp-object--d25a50ab-2499-4d07-9ea8-d8db37a2a9ec",
|
|
"x-misp-object--43459484-03b7-4d3a-a023-d25e2950b7c6",
|
|
"x-misp-object--612783c6-7d6a-4f3b-999b-804d7dc94585",
|
|
"x-misp-object--017ac5c4-1f99-40ea-9b0e-845d1536894d",
|
|
"x-misp-object--938b67a4-6ddb-4390-8ba5-11137948a333",
|
|
"x-misp-object--2071bf37-4d11-4e1c-8a09-222cc01f3222",
|
|
"x-misp-object--5cea7400-2394-4125-a49b-64c020a3b2bf",
|
|
"x-misp-object--93c1fd93-dc41-40fa-8489-d2e820dcf54d",
|
|
"x-misp-object--fc5536a3-c1a4-4d19-aa3c-537ae72c0e37",
|
|
"x-misp-object--77a11458-9cba-4925-9e68-d34ffb6eb580",
|
|
"x-misp-object--d2bf0fa0-fd39-439c-ad04-c4b74103d928",
|
|
"x-misp-object--a68ac63a-c404-4f51-b5c3-a08c64b8c812",
|
|
"x-misp-object--9ed27605-49ae-4ddf-99b5-323110f08166",
|
|
"x-misp-object--c5188fa1-89e6-4034-b190-37d19d99693b",
|
|
"x-misp-object--bc1321a7-4ee5-4a27-8740-e98e3790543e",
|
|
"x-misp-object--6b9a35c8-f016-45f0-bc54-230462e36f3f",
|
|
"x-misp-object--368a60f3-4114-4f9e-ac30-8a6c4c3a15ec",
|
|
"x-misp-object--a615573c-e5d7-49d8-8f56-16b59a758b42",
|
|
"x-misp-object--e9f573b5-0f08-42d6-a8d2-c1078df73115",
|
|
"x-misp-object--3a947450-55ac-48b9-b46c-0b9e70a58cc0",
|
|
"x-misp-object--05aff0ac-857c-43b1-af37-a038cca8201b",
|
|
"x-misp-object--7a6e023e-973d-41da-ba8d-5817f5198428",
|
|
"x-misp-object--ff32b7ff-42ae-4b3d-acff-dcd99fb25eaf",
|
|
"x-misp-object--68f21999-9b07-41fc-9aac-8132f5dfb0c3",
|
|
"x-misp-object--a4f99cb3-f450-4b2e-8455-07dfe9e41cb0",
|
|
"x-misp-object--9acc8d38-4f15-4bf6-9c63-71613aaebbf7",
|
|
"x-misp-object--b6cd05be-e718-4b54-a890-ed1dd88697cb",
|
|
"x-misp-object--83c72de8-db0e-4c7d-8ea1-3236b485a86f",
|
|
"x-misp-object--014c32e7-b639-4a57-a5fb-18309fec2133",
|
|
"x-misp-object--b25804d1-5a0a-42f2-b5ad-0c01925ca1c7",
|
|
"x-misp-object--b31db49a-0a64-46f6-bf92-7d6d35eb8dfb",
|
|
"x-misp-object--2fbfd808-3ed1-4578-8a89-e0aa5d57a8b6",
|
|
"x-misp-object--9a97fc45-451c-4aee-8940-4a554ebf286f",
|
|
"x-misp-object--1d79df64-ad7a-4189-a107-1d2f27e8202c",
|
|
"x-misp-object--b4d6cf82-abf9-40ea-8adf-884cac0b7dca",
|
|
"x-misp-object--1b2178c0-7302-4bf6-a196-e7088086d1e7",
|
|
"x-misp-object--f6bf304a-cd3f-4bf4-8731-e4ad2e85c5c6",
|
|
"x-misp-object--245d12e0-fda7-41de-935c-5fc5208ea77a",
|
|
"x-misp-object--a5bf7615-9482-49f6-9959-55010346971f",
|
|
"x-misp-object--e20e89de-dedb-4493-9f39-d19bca906c68",
|
|
"x-misp-object--a640c76e-6b15-4f46-bb4a-3c41a62700c5",
|
|
"x-misp-object--940a978d-4e70-4357-a7c1-2e1a9e80b784",
|
|
"x-misp-object--fe2d8b67-f422-4335-be73-542f40ee8559",
|
|
"x-misp-object--c11a828a-e1d5-4299-9329-7908ca5aeea8",
|
|
"x-misp-object--f5d96ec9-8867-4032-8088-5c539234665c",
|
|
"x-misp-object--90eb0a08-a0d8-49c6-8ec7-dccc20d06199",
|
|
"x-misp-object--073bfabc-0580-4fde-8659-c3854029937d",
|
|
"x-misp-object--e5f2a5b2-f9b6-4536-8068-1e610b0a5b17",
|
|
"x-misp-object--592953b3-0474-4ad1-8942-757124e30a99",
|
|
"x-misp-object--d4bf7b4c-7f49-46cd-94a6-c12dc5a471eb",
|
|
"x-misp-object--3a63168f-d604-46d2-80c0-d24afea4639b",
|
|
"x-misp-object--c8df1989-af8f-49db-838c-ef2f8bb96eb5",
|
|
"x-misp-object--81962a81-10c7-4f4d-ba8b-b9df3d5d741d",
|
|
"x-misp-object--0f3b61d8-1fdd-408b-9710-61e6e3a05220",
|
|
"x-misp-object--5690876b-7f5b-4032-bb10-3f690b1ce2cd",
|
|
"x-misp-object--05809cc2-e217-49db-a128-b8b63d1b5171",
|
|
"x-misp-object--58af18ac-7fad-4504-85de-90947ece0028",
|
|
"x-misp-object--75cd1bef-0d6e-4c7f-bc48-293403212159",
|
|
"x-misp-object--e1eb04f2-bccb-4dd0-9f93-a1f2ccb4e650",
|
|
"x-misp-object--5ddcf5da-400b-4bad-b4f3-9dd0708a6644",
|
|
"x-misp-object--52d6ebd2-4ad3-44c5-9029-ccbff450c8b7",
|
|
"x-misp-object--59e02386-d00c-417d-b9c1-7a1dce691aad",
|
|
"x-misp-object--dee24e7d-32ac-427d-a6be-952cf291e5f6",
|
|
"relationship--7b622deb-1c41-4317-a123-2eaeb8b29793",
|
|
"relationship--bb31a47e-429c-43c3-8c04-6103ed1cc6de",
|
|
"relationship--c4dbacbd-e03e-4e67-a5f7-494b7ccce961",
|
|
"relationship--1facf535-531f-462f-bd04-7945eb1dccab",
|
|
"relationship--49ff7b04-791c-4e57-b676-be98222ae2b8",
|
|
"relationship--2c1506d8-ed51-4502-b62c-6e9d9ceba718",
|
|
"relationship--9e1da164-6a5a-4621-bbb7-ae0cf2afca17",
|
|
"relationship--f3f7b81d-15a4-4d59-8dd8-8728c04bfa85",
|
|
"relationship--883da042-b6d4-47a8-a490-c41de8a9c2dc",
|
|
"relationship--843e7d19-3683-4fdf-954d-3ec5cdfb0634",
|
|
"relationship--3a3cc2eb-a5bb-433b-a0ed-25f3f387da24"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"misp-galaxy:threat-actor=\"Lazarus Group\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--eb2fc06f-a0a1-4f4a-bea3-adab040d70ff",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:48.000Z",
|
|
"modified": "2018-06-17T12:33:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.56']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7c86a82b-ba54-4ff1-8705-e11f3f7141e7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:48.000Z",
|
|
"modified": "2018-06-17T12:33:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.101.211.162']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7ee15758-a1b1-430e-9c0d-99de31050d3f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:48.000Z",
|
|
"modified": "2018-06-17T12:33:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '59.90.93.97']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--2735b91e-6dfa-4588-a0d6-28fb8d167d7e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:48.000Z",
|
|
"modified": "2018-06-17T12:33:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '111.207.78.204']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--0987500d-f42e-44f8-95fc-d18c1b1093af",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:48.000Z",
|
|
"modified": "2018-06-17T12:33:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '80.91.118.45']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7b0d562b-47d2-442d-b783-db5287da59ac",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:48.000Z",
|
|
"modified": "2018-06-17T12:33:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '81.0.213.173']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--e4484d7e-0ce1-4aaf-860d-dbbdb89e6aca",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:48.000Z",
|
|
"modified": "2018-06-17T12:33:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '184.107.209.2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b2655ca-0590-41e5-aeec-6a6d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:36:26.000Z",
|
|
"modified": "2018-06-17T12:36:26.000Z",
|
|
"first_observed": "2018-06-17T12:36:26Z",
|
|
"last_observed": "2018-06-17T12:36:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5b2655ca-0590-41e5-aeec-6a6d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5b2655ca-0590-41e5-aeec-6a6d02de0b81",
|
|
"value": "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5b26563a-5330-43de-aac3-6a6202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:38:18.000Z",
|
|
"modified": "2018-06-17T12:38:18.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "This Malware Analysis Report (MAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. Government partners, DHS and FBI identified Trojan malware variants used by the North Korean government. This malware variant is known as TYPEFRAME. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.gov/hiddencobra.\r\n\r\nDHS and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity.\r\n\r\nThis MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended mitigation techniques. Users and administrators should flag activity associated with the malware, report the activity to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and give the activity the highest priority for enhanced mitigation.\r\n\r\nThis malware report contains analysis of 11 malware samples consisting of 32-bit and 64-bit Windows executable files and a malicious Microsoft Word document that contains Visual Basic for Applications (VBA) macros. These files have the capability to download and install malware, install proxy and Remote Access Trojans (RATs), connect to command and control (C2) servers to receive additional instructions, and modify the victim's firewall to allow incoming connections."
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5b26569b-4d24-4f80-bfbc-170302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:39:55.000Z",
|
|
"modified": "2018-06-17T12:39:55.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "(from CIRCL)\r\nSTIX import of https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-12_WHITE_stix.xml with additional expansions and information from the website (as the STIX original file is not including the meta-data)."
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b265834-3cb0-4d59-a792-6a6d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:46:44.000Z",
|
|
"modified": "2018-06-17T12:46:44.000Z",
|
|
"first_observed": "2018-06-17T12:46:44Z",
|
|
"last_observed": "2018-06-17T12:46:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5b265834-3cb0-4d59-a792-6a6d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5b265834-3cb0-4d59-a792-6a6d02de0b81",
|
|
"value": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-12_WHITE_stix.xml"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--967ce91b-c8b4-42df-9f74-9e1ac6affd08",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:22.000Z",
|
|
"modified": "2018-06-17T12:31:22.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--0dbb16a9-0269-4682-a179-1d6891ff30b1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:24.000Z",
|
|
"modified": "2018-06-17T12:31:24.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--ff95cbea-219e-4242-9f7d-a2d16a013a7b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:25.000Z",
|
|
"modified": "2018-06-17T12:31:25.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--fd483ddd-cdc3-4296-8a89-c467247ede98",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:26.000Z",
|
|
"modified": "2018-06-17T12:31:26.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--7f5198c2-fd93-4401-80fa-e24b6a99bb3c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:28.000Z",
|
|
"modified": "2018-06-17T12:31:28.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--345a90a3-5de7-44a1-8a57-a1a8999a1af5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:29.000Z",
|
|
"modified": "2018-06-17T12:31:29.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b94caa3a-5603-431b-8822-cca2a4ffa678",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:30.000Z",
|
|
"modified": "2018-06-17T12:31:30.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--bfc7f514-369a-40a2-9462-95c6228df9a4",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:32.000Z",
|
|
"modified": "2018-06-17T12:31:32.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d9231a73-1ae1-4e99-877c-e6080aef6fd5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:33.000Z",
|
|
"modified": "2018-06-17T12:31:33.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e60aa2a5-bc11-4df9-9241-defe23af60a1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:35.000Z",
|
|
"modified": "2018-06-17T12:31:35.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--ba4427c1-fc81-40e9-a10b-d14a0a20711d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:36.000Z",
|
|
"modified": "2018-06-17T12:31:36.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--ac98153a-ec7f-4c54-b563-7917339cee04",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:37.000Z",
|
|
"modified": "2018-06-17T12:31:37.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--4afa330b-5bde-4778-b833-ba0ccdf53b67",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:39.000Z",
|
|
"modified": "2018-06-17T12:31:39.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--98db396b-fa79-441a-9ac6-f5c4b8ce4709",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:41.000Z",
|
|
"modified": "2018-06-17T12:31:41.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--331a2fb4-3f10-45ca-89c9-60cf96c9205f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:47.000Z",
|
|
"modified": "2018-06-17T12:31:47.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2c6f9016-4377-447f-84df-ddc4c2d59f35",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:53.000Z",
|
|
"modified": "2018-06-17T12:31:53.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--bd2613b3-ef57-4c37-9e55-26e51493ba3a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:58.000Z",
|
|
"modified": "2018-06-17T12:31:58.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--16c183f2-2c3f-4304-ad99-9e19c2323ee0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:04.000Z",
|
|
"modified": "2018-06-17T12:32:04.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--8a65ff90-3aad-4da9-a4be-b8b4a08878d2",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:40:48.000Z",
|
|
"modified": "2018-06-17T12:40:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "file"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--1dd9ce3a-5709-4b5b-9dd2-12d9bf32e1d0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:17.000Z",
|
|
"modified": "2018-06-17T12:32:17.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'bf474b8acd55380b1169bb949d60e9e4' AND file:hashes.SHA1 = 'c60c18fc0226a53be15637ee3ef0b73b0dabd854' AND file:hashes.SHA256 = 'd1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92' AND file:hashes.SHA512 = '46995cf3516c160d2f4fa5957c8c67df75f2768b24562b22de46a5d4ef7ba17fecaef2ad900bc6925e0c4284802864361423653154ad0622af18d049fb0419be' AND file:hashes.SSDEEP = '12288:G+3/oi/EpRsV97/8Olq3p8YNk5oYEeLxCStEowZVKmZag:Gmoi/EpRsV9S3prgomLE9oVmQg' AND file:name = 'BF474B8ACD55380B1169BB949D60E9E4' AND file:size = '466241' AND file:x_misp_mimetype = 'PE32 executable (GUI) Intel 80386, for MS Windows' AND file:x_misp_entropy = '7.760001']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--c2593c36-69f5-4c43-9fcc-b335d606d569",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:23.000Z",
|
|
"modified": "2018-06-17T12:32:23.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'ca67f84d5a4ac1459934128442c53b03' AND file:hashes.SHA1 = 'f4eb6a50c60320edafb3e48c612c6a55560d0684' AND file:hashes.SHA256 = '40ef57ca2a617f5d24ac624339ba2027b6cf301c28684bf8b2075fc7a2e95116' AND file:hashes.SHA512 = '4695cf69e2ae52fc94eab31cbc3bb846022a3e1516d9bc293118f674ea1eb86468cff0a4c0dee8dff8a2d545df153116e8d86669513426e1b32a205041339e45' AND file:hashes.SSDEEP = '12288:drrF4D0d2QKPIyWE8QPnWnGHiS2VcL2ZotSNfpV532/dlZ:x6IGnWntQ2ZvfpvmdlZ' AND file:name = 'CA67F84D5A4AC1459934128442C53B03' AND file:size = '778240' AND file:x_misp_mimetype = 'PE32 executable (DLL) (GUI) Intel 80386, for MS Windows' AND file:x_misp_entropy = '6.710797']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--35046b12-4171-4598-ab66-f6c536f03862",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:30.000Z",
|
|
"modified": "2018-06-17T12:32:30.000Z",
|
|
"pattern": "[file:hashes.MD5 = '6ab301fc3296e1ceb140bf5d294894c5' AND file:hashes.SHA1 = '8d62498656db928f987b47bdbcfab5d6032be48a' AND file:hashes.SHA256 = '546dbd370a40c8e46f9b599a414f25000eec5ae6b3e046a035fe6e6cd5d874e1' AND file:hashes.SHA512 = '3abd7a690d821ace78d8f5e2394f0922308963c7ba8ee63661e9cdb2e36fe8353904346b4b0457c6ace3071505533187d62a41d47473a6a9680cab7fca209ceb' AND file:hashes.SSDEEP = '3072:JdHh7xVwMPRTxXX0bqkmvA7XKmJLiSi3Ix1DKXrlTNEsuFFCeojbmUkGVcNP+:17xVrxxn0PrWiv8hLnS+' AND file:name = '6AB301FC3296E1CEB140BF5D294894C5' AND file:size = '259584' AND file:x_misp_mimetype = 'PE32+ executable (DLL) (GUI) x86-64, for MS Windows' AND file:x_misp_entropy = '5.918488']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:40:48.000Z",
|
|
"modified": "2018-06-17T12:40:48.000Z",
|
|
"pattern": "[file:hashes.MD5 = '77b50bb476a85a7aa30c962a389838aa' AND file:hashes.SHA1 = 'df466a1f473c7c5eba5f22d90822fd1430b6a244' AND file:hashes.SHA256 = '3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210' AND file:hashes.SHA512 = '33b78e0bc8832958b79292bfebffe32c03b59b92044bb95331ee384f7061f6724c7d10bcf17ee1395dbd437b225c0813ba4bc5de6ef44f4bdd9ee58e446ad143' AND file:hashes.SSDEEP = '3072:sPhrkoI8QYJRMs4y5pe+/a5sN5t4+PXP:Mi/lqpe+/0sa' AND file:name = 'java.exe' AND file:size = '118784' AND file:x_misp_mimetype = 'PE32 executable (GUI) Intel 80386, for MS Windows' AND file:x_misp_entropy = '5.880053']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:40:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--137d6815-4196-433f-a8be-1fe04add3a5f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:35.000Z",
|
|
"modified": "2018-06-17T12:32:35.000Z",
|
|
"pattern": "[file:hashes.MD5 = '3229a6cea658b1b3ca5ca9ad7b40d8d4' AND file:hashes.SHA1 = '70730e608e2fcc68ce468ed148e965c5bacfb51c' AND file:hashes.SHA256 = '4bd7d801d7ce3fe9c2928dbc834b296e934473f5bbcc9a1fd18af5ebd43192cd' AND file:hashes.SHA512 = 'ff385a9446415412950562cca832eab1d17de56932f3633a86202dea829e8bd25e56864306f2e6c8bb7ff7d2cfe2785acc4261410e38348946baf72d4a0696de' AND file:hashes.SSDEEP = '12288:sh+81FiNloAzjMXJ1NPeZ3eMNZtF7fHRRAug0EX7:W1FiNWEYxeV3NfHDe' AND file:name = '3229A6CEA658B1B3CA5CA9AD7B40D8D4' AND file:size = '712192' AND file:x_misp_mimetype = 'Composite Document File V2 Document, Little Endian, O\\\\%WINDIR\\\\%\\\\ Version 6.2, Code page: 949, Author: ISkyISea, Template: Normal, Last Saved By: ISkyISea, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 17:00, Create Time/Date: Mon Apr 3 18:36:00 2017, Last Saved Time/Date: Thu Apr 6 00:34:00 2017, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0' AND file:x_misp_entropy = '5.446016']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--a84b8d9c-0175-411b-8b89-fc0ac709df56",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:44.000Z",
|
|
"modified": "2018-06-17T12:32:44.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'bfb41bc0c3856aa0a81a5256b7b8da51' AND file:hashes.SHA1 = 'cb96e29332fe94d1a70309837f73daf7bec81284' AND file:hashes.SHA256 = 'c9e3b83d77ce93cc1d70b22e967f049b13515c88572aa78e0a838103e5478777' AND file:hashes.SHA512 = '37223163a329ffa7b77a9190aab1da5fbf38c6d76139591d592d695e5caa81b56f6d3769540e2781c87a29de3d39e5e9c8ee70bd9ed6a0bee040917f530bc11a' AND file:hashes.SSDEEP = '12288:jxn1kOPTkEjkHsnCrYHM46QyFgHj+u1XC1GbA/UXAfAGZI3PWM+:jxn1kOLkEQHsYYDdD+u1HbA/Uw47/L+' AND file:name = 'BFB41BC0C3856AA0A81A5256B7B8DA51' AND file:size = '578174' AND file:x_misp_mimetype = 'PE32+ executable (GUI) x86-64, for MS Windows' AND file:x_misp_entropy = '7.848313']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f94d3e39-27ea-4214-bb44-c25505dc2326",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:46.000Z",
|
|
"modified": "2018-06-17T12:32:46.000Z",
|
|
"pattern": "[file:hashes.MD5 = '9722bc9e0efb4214116066d1ff14094c' AND file:hashes.SHA1 = '41a938499048a6ad8034d09e2fbb893da8f13ca9' AND file:hashes.SHA256 = 'e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef' AND file:hashes.SHA512 = '8470c240868441093314ebe263028ceef61d900b41aaeed77fd934edf81b9a75f6c96d0fccc0ac87364c8e23e0b8eb19ec8bcd47daf1d50c1182be999475fc4c' AND file:hashes.SSDEEP = '12288:nqU713B5hV7rJIBBAVbyjRbjSbdSYJ3raxt7o6qRBpDwQmnQ2bqPjD+PmCNVGsPf:nRxJIB7hSZSG37jo/GsPepCdOwy' AND file:name = 'dwnhost.dll' AND file:size = '1030144' AND file:x_misp_mimetype = 'PE32+ executable (DLL) (GUI) x86-64, for MS Windows' AND file:x_misp_entropy = '6.424883']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--d5b3a29b-484d-4619-b358-e8850a30e3a0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:52.000Z",
|
|
"modified": "2018-06-17T12:32:52.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'ef9db20ab0eebf0b7c55af4ec0b7bced' AND file:hashes.SHA1 = '0202942d11c994cece943bb873f3af156d820f59' AND file:hashes.SHA256 = '20abb95114de946da7595438e9edf0bf39c85ba8512709db7d5532d37d73bd64' AND file:hashes.SHA512 = '85fa80079c59da83e3b2471eab0d2981c92b6c589cbe5052bf438831ae464e6499040ead68d6bc9929edd9f6c08ecc6abf2a0173e31bd361a24fad89ff1f7064' AND file:hashes.SSDEEP = '3072:qocqUTuIzXblpGxqSDBiiBmLEEjdTIf3TIb9Qw/uAZyerrPabYlQ:qJqUnXKxqSAiBJyTC3TIb9QRL0lQ' AND file:name = 'EF9DB20AB0EEBF0B7C55AF4EC0B7BCED' AND file:size = '152064' AND file:x_misp_mimetype = 'PE32+ executable (GUI) x86-64, for MS Windows' AND file:x_misp_entropy = '6.269643']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--a13cfa83-8fb9-47f5-8bda-430bce2e0f7a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"pattern": "[file:hashes.MD5 = '1c53e7269fe9d84c6df0a25ba59b822c' AND file:hashes.SHA1 = 'b775d753671133cbc4919764d2fac0d298166b07' AND file:hashes.SHA256 = '201c7cd10a2bd50dde0948d14c3c7a0732955c908a3392aee3d08b94470c9d33' AND file:hashes.SHA512 = '3d3883b9b29e264d023b7034d980b7c206c9fc82010bf7f5f1dc454fdbd316830fe69e90579406a74afc1fca8e266d10c1b46784bd661dcb2815e370a68acd32' AND file:hashes.SSDEEP = '1536:EaMa/KVyD4hv6LLETuA1x+sh2iE1s44tz4qoWYUwnZ7hUOC2:G8YPZ6LLqQFX4tz4quxY' AND file:name = '1C53E7269FE9D84C6DF0A25BA59B822C' AND file:size = '126976' AND file:x_misp_mimetype = 'PE32 executable (DLL) (GUI) Intel 80386, for MS Windows' AND file:x_misp_entropy = '6.024087']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--8359531b-5e0a-4fdc-828d-d3901560fe58",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"labels": [
|
|
"misp:name=\"whois\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "whois"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--46e93d08-06fb-49ee-a465-b8680a4b04ae",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"labels": [
|
|
"misp:name=\"whois\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "whois"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2543f106-3d8f-4855-a306-1f505ae9ee34",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"labels": [
|
|
"misp:name=\"whois\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "whois"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--8d81a602-68f0-470f-8eb3-3422ad8929fb",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"labels": [
|
|
"misp:name=\"whois\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "whois"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--1cc483ce-fc42-4c80-af86-6024c10f69f6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"labels": [
|
|
"misp:name=\"whois\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "whois"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--0eb4a04f-9699-4e92-88a0-4a4dec688885",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"labels": [
|
|
"misp:name=\"whois\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "whois"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5899141a-5be5-42de-90af-1e471b7b1d7c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"labels": [
|
|
"misp:name=\"whois\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "whois"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--450c3377-2c9b-4b69-8381-f51dfe41f149",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:40:47.000Z",
|
|
"modified": "2018-06-17T12:40:47.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--3a9a5628-14e1-4f29-8722-93e142a93add",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:47.000Z",
|
|
"modified": "2018-06-17T12:31:47.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f11af508-fb9e-49a3-a5ef-ed176fa9057b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:53.000Z",
|
|
"modified": "2018-06-17T12:31:53.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--8b080900-6adf-4dd5-a3e3-470c719f6041",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:57.000Z",
|
|
"modified": "2018-06-17T12:31:57.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--0d3fcd9f-6a98-4566-b99c-941cf97a58c0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:03.000Z",
|
|
"modified": "2018-06-17T12:32:03.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--15a888e0-c1b1-46cf-a341-32de4f623862",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:12.000Z",
|
|
"modified": "2018-06-17T12:32:12.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--fc5663b5-c080-45b4-a405-147ca8570626",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:17.000Z",
|
|
"modified": "2018-06-17T12:32:17.000Z",
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '4' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'BF474B8ACD55380B1169BB949D60E9E4' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'BF474B8ACD55380B1169BB949D60E9E4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--79461c6c-5900-4ecf-90f0-6157212636dd",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:23.000Z",
|
|
"modified": "2018-06-17T12:32:23.000Z",
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '6' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'CA67F84D5A4AC1459934128442C53B03' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'CA67F84D5A4AC1459934128442C53B03']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--206825c8-1f31-4ae3-be07-5cb1b63e98a1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:30.000Z",
|
|
"modified": "2018-06-17T12:32:30.000Z",
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '7' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = '6AB301FC3296E1CEB140BF5D294894C5' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = '6AB301FC3296E1CEB140BF5D294894C5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--0522e8ab-595b-46fd-b97c-bded45adfd05",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:35.000Z",
|
|
"modified": "2018-06-17T12:32:35.000Z",
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '5' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'java.exe' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'java.exe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--cffd2eaa-1a45-40de-b9d1-aa6999601750",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:43.000Z",
|
|
"modified": "2018-06-17T12:32:43.000Z",
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '7' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'BFB41BC0C3856AA0A81A5256B7B8DA51' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'BFB41BC0C3856AA0A81A5256B7B8DA51']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--14dfc596-3c8f-4d1e-8194-56873bf809f0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:52.000Z",
|
|
"modified": "2018-06-17T12:32:52.000Z",
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '7' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'EF9DB20AB0EEBF0B7C55AF4EC0B7BCED' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'EF9DB20AB0EEBF0B7C55AF4EC0B7BCED']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:32:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--c56a8843-6462-4e48-9354-ff3cea9b393c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '12' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = '1C53E7269FE9D84C6DF0A25BA59B822C' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = '1C53E7269FE9D84C6DF0A25BA59B822C']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-06-17T12:33:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"pe\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--7dd632d5-39a8-491a-80cc-c163755c56db",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:42.000Z",
|
|
"modified": "2018-06-17T12:31:42.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c22f54ef-0428-4b7e-aab1-c0ba1b6259ea",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:42.000Z",
|
|
"modified": "2018-06-17T12:31:42.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--be6d670d-923a-411a-97db-bf73901abf56",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:43.000Z",
|
|
"modified": "2018-06-17T12:31:43.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b8e7aa5e-5681-4393-8581-a207f6651129",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:43.000Z",
|
|
"modified": "2018-06-17T12:31:43.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2e3d47fa-ccc7-4549-8005-9d0b2481219a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:46.000Z",
|
|
"modified": "2018-06-17T12:31:46.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--81c54539-acd4-4f39-981f-2c07d8e783df",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:47.000Z",
|
|
"modified": "2018-06-17T12:31:47.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--6a9e84ce-dc0b-48a5-a1b3-a70f871f6a08",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:47.000Z",
|
|
"modified": "2018-06-17T12:31:47.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--510ac6ad-b6d5-4be7-9a51-0ad210190eff",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:48.000Z",
|
|
"modified": "2018-06-17T12:31:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f127c64b-bf6c-4448-a66f-b455d9f0a695",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:49.000Z",
|
|
"modified": "2018-06-17T12:31:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--72f0a63e-d53f-423b-b762-096a7f70ba1c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:49.000Z",
|
|
"modified": "2018-06-17T12:31:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--33e578e5-10bc-4442-9737-ff332c9c2bbd",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:52.000Z",
|
|
"modified": "2018-06-17T12:31:52.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d54ec2e8-330d-496a-bd90-c388db285a90",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:53.000Z",
|
|
"modified": "2018-06-17T12:31:53.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--cad943d1-b772-45d8-8cd1-7e3fde522cf7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:53.000Z",
|
|
"modified": "2018-06-17T12:31:53.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c07156a8-22b8-4496-9173-632a17da707a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:54.000Z",
|
|
"modified": "2018-06-17T12:31:54.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--4d0aac8e-a228-4186-9626-37b23b6e06a3",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:57.000Z",
|
|
"modified": "2018-06-17T12:31:57.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d25a50ab-2499-4d07-9ea8-d8db37a2a9ec",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:57.000Z",
|
|
"modified": "2018-06-17T12:31:57.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--43459484-03b7-4d3a-a023-d25e2950b7c6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:58.000Z",
|
|
"modified": "2018-06-17T12:31:58.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--612783c6-7d6a-4f3b-999b-804d7dc94585",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:59.000Z",
|
|
"modified": "2018-06-17T12:31:59.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--017ac5c4-1f99-40ea-9b0e-845d1536894d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:31:59.000Z",
|
|
"modified": "2018-06-17T12:31:59.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--938b67a4-6ddb-4390-8ba5-11137948a333",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:00.000Z",
|
|
"modified": "2018-06-17T12:32:00.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2071bf37-4d11-4e1c-8a09-222cc01f3222",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:03.000Z",
|
|
"modified": "2018-06-17T12:32:03.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5cea7400-2394-4125-a49b-64c020a3b2bf",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:04.000Z",
|
|
"modified": "2018-06-17T12:32:04.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--93c1fd93-dc41-40fa-8489-d2e820dcf54d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:04.000Z",
|
|
"modified": "2018-06-17T12:32:04.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--fc5536a3-c1a4-4d19-aa3c-537ae72c0e37",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:05.000Z",
|
|
"modified": "2018-06-17T12:32:05.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--77a11458-9cba-4925-9e68-d34ffb6eb580",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:05.000Z",
|
|
"modified": "2018-06-17T12:32:05.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d2bf0fa0-fd39-439c-ad04-c4b74103d928",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:06.000Z",
|
|
"modified": "2018-06-17T12:32:06.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a68ac63a-c404-4f51-b5c3-a08c64b8c812",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:07.000Z",
|
|
"modified": "2018-06-17T12:32:07.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--9ed27605-49ae-4ddf-99b5-323110f08166",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:07.000Z",
|
|
"modified": "2018-06-17T12:32:07.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c5188fa1-89e6-4034-b190-37d19d99693b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:08.000Z",
|
|
"modified": "2018-06-17T12:32:08.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--bc1321a7-4ee5-4a27-8740-e98e3790543e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:08.000Z",
|
|
"modified": "2018-06-17T12:32:08.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--6b9a35c8-f016-45f0-bc54-230462e36f3f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:09.000Z",
|
|
"modified": "2018-06-17T12:32:09.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--368a60f3-4114-4f9e-ac30-8a6c4c3a15ec",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:12.000Z",
|
|
"modified": "2018-06-17T12:32:12.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a615573c-e5d7-49d8-8f56-16b59a758b42",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:13.000Z",
|
|
"modified": "2018-06-17T12:32:13.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e9f573b5-0f08-42d6-a8d2-c1078df73115",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:13.000Z",
|
|
"modified": "2018-06-17T12:32:13.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--3a947450-55ac-48b9-b46c-0b9e70a58cc0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:14.000Z",
|
|
"modified": "2018-06-17T12:32:14.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--05aff0ac-857c-43b1-af37-a038cca8201b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:17.000Z",
|
|
"modified": "2018-06-17T12:32:17.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "0.769911",
|
|
"category": "Other",
|
|
"uuid": "0c04251f-92e7-4fad-aba4-1f917b2c5a41"
|
|
},
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "5b1f93f0412e9f1c7a7ad42d729b292b",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "327c22ac-f353-45b7-ba68-f526a9114218"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "4096",
|
|
"category": "Other",
|
|
"uuid": "bba942be-afa9-4b4d-b77a-ad3ca5a40a6f"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--7a6e023e-973d-41da-ba8d-5817f5198428",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:17.000Z",
|
|
"modified": "2018-06-17T12:32:17.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "e6ea312f762f4df521b229a77f186664",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "af79506f-a8b6-4a12-8c44-795328d08ae5"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "6.629464",
|
|
"category": "Other",
|
|
"uuid": "507c7d3d-1c65-4d6f-bfa5-85713a2e3c37"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".text",
|
|
"category": "Other",
|
|
"uuid": "336d1eba-29d1-49dd-adfd-110df231cc6a"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "475136",
|
|
"category": "Other",
|
|
"uuid": "b711961d-3eb4-497a-a287-bbe5840057fe"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--ff32b7ff-42ae-4b3d-acff-dcd99fb25eaf",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:18.000Z",
|
|
"modified": "2018-06-17T12:32:18.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "b6fa7b267ea19010d44f056ec3cca39d",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "ceeab57a-d8c4-4941-b004-7993466cf5d2"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "5.920344",
|
|
"category": "Other",
|
|
"uuid": "91cf4983-ad20-4646-ad1b-a3ea701dc677"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rdata",
|
|
"category": "Other",
|
|
"uuid": "eb4b62bb-4d86-4f6f-84f8-4059883a520f"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "147456",
|
|
"category": "Other",
|
|
"uuid": "3f816338-d8c0-4f7f-a75a-93597a01605f"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--68f21999-9b07-41fc-9aac-8132f5dfb0c3",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:19.000Z",
|
|
"modified": "2018-06-17T12:32:19.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "1076ec3948d21da8d6c5036548880c63",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "3adf678e-7dbc-417e-89ff-556dfd83242b"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "4.972282",
|
|
"category": "Other",
|
|
"uuid": "00295843-7193-4c2f-b0b4-7b289611ad5a"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".data",
|
|
"category": "Other",
|
|
"uuid": "c27c2424-2ffa-4e04-9114-70e0a7b43583"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "77824",
|
|
"category": "Other",
|
|
"uuid": "8bad0807-50b0-4f57-90bb-7f9768e5a8fa"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a4f99cb3-f450-4b2e-8455-07dfe9e41cb0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:19.000Z",
|
|
"modified": "2018-06-17T12:32:19.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "77c814f5856057e7a7f6237bbba51a76",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "accf6116-8373-4ebc-8661-807d85cbac79"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "7.100017",
|
|
"category": "Other",
|
|
"uuid": "2ac4db88-5b9b-4133-8908-d00335e8343d"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rsrc",
|
|
"category": "Other",
|
|
"uuid": "065e3253-badf-404e-b7b5-933b0bac6264"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "32768",
|
|
"category": "Other",
|
|
"uuid": "a12e28e9-69bb-4650-b533-3057a2e66004"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--9acc8d38-4f15-4bf6-9c63-71613aaebbf7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:20.000Z",
|
|
"modified": "2018-06-17T12:32:20.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "3184d0afb653bf0723cadccc14d92071",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "1df50229-64fc-4e6f-abe3-8d8e86233a23"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "5.752155",
|
|
"category": "Other",
|
|
"uuid": "fcca6bfe-3cf2-42ed-aca4-f339d10970b6"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".reloc",
|
|
"category": "Other",
|
|
"uuid": "20bb5900-3e62-4064-bbab-304766550092"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "40960",
|
|
"category": "Other",
|
|
"uuid": "84062378-d0f4-4d54-8ddc-ceca715580cf"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b6cd05be-e718-4b54-a890-ed1dd88697cb",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:23.000Z",
|
|
"modified": "2018-06-17T12:32:23.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "2.821047",
|
|
"category": "Other",
|
|
"uuid": "cab440f5-5b76-4fcd-99e1-a4a96ec614e1"
|
|
},
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "24baa03194bc78f0184ea606128bc80f",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "346cccc4-2114-4c16-8089-271a5e2e6e5a"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "1024",
|
|
"category": "Other",
|
|
"uuid": "3e562b0c-d7ce-4a70-9447-5f65a1fba640"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--83c72de8-db0e-4c7d-8ea1-3236b485a86f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:24.000Z",
|
|
"modified": "2018-06-17T12:32:24.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "170ce86f9a7ffcd242f3903fafe1f302",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "4d4455d3-fff7-4faa-a28f-3e1ac431e365"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "6.433615",
|
|
"category": "Other",
|
|
"uuid": "60bb821b-a3da-4be5-8c23-1c094f4a51e2"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".text",
|
|
"category": "Other",
|
|
"uuid": "a8db3e4f-e864-4379-8286-8c775519f5eb"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "57856",
|
|
"category": "Other",
|
|
"uuid": "8cb59a2e-6282-4723-a82b-83abab0443b3"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--014c32e7-b639-4a57-a5fb-18309fec2133",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:24.000Z",
|
|
"modified": "2018-06-17T12:32:24.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "33b066692952c4534ebf0a56ca293085",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "991a8ecd-cbc5-4263-85e5-df75954ac8ea"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "5.09521",
|
|
"category": "Other",
|
|
"uuid": "5b93c1ad-3305-404c-a78e-9f8710982bb7"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rdata",
|
|
"category": "Other",
|
|
"uuid": "d3bc8e77-9d1c-46a3-9842-27e9f6a5e750"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "37888",
|
|
"category": "Other",
|
|
"uuid": "ddc25d67-c2e0-42ea-ad82-27bcba32aad5"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b25804d1-5a0a-42f2-b5ad-0c01925ca1c7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:25.000Z",
|
|
"modified": "2018-06-17T12:32:25.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "b4eed5366c4254a3c7f6c2f021c29efe",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "30b303bd-0864-4f31-9ba4-00d3a3a5bf45"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "4.916035",
|
|
"category": "Other",
|
|
"uuid": "8efc483e-7488-4dd0-9ad5-f8ad4434e6e5"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".data",
|
|
"category": "Other",
|
|
"uuid": "b1bd7dcf-9be7-4127-b059-558a181b6431"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "156160",
|
|
"category": "Other",
|
|
"uuid": "85b3c918-f450-456b-9df8-92a8133524c0"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b31db49a-0a64-46f6-bf92-7d6d35eb8dfb",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:25.000Z",
|
|
"modified": "2018-06-17T12:32:25.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "3ad7431aaa87a1e6b6400ca9b273d98a",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "b87f4901-64e2-46ca-8cf1-6dc07af84bff"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "4.579212",
|
|
"category": "Other",
|
|
"uuid": "6b0528a6-dc12-4d23-9523-441232dd81e6"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".pdata",
|
|
"category": "Other",
|
|
"uuid": "cfd48a77-00cf-4ac1-8c25-7cf9b151d62b"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "4096",
|
|
"category": "Other",
|
|
"uuid": "df3f5ac6-9f80-4dc4-802f-6b0c25ee2d3b"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2fbfd808-3ed1-4578-8a89-e0aa5d57a8b6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:26.000Z",
|
|
"modified": "2018-06-17T12:32:26.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "c23d2715b42b072fcf86b2aa58807b56",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "d43773fe-6170-4988-a5ab-e0089a29ef6e"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "4.714485",
|
|
"category": "Other",
|
|
"uuid": "80e3e91c-1b9d-4b82-88eb-881911fcb876"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rsrc",
|
|
"category": "Other",
|
|
"uuid": "9143f7c7-cd51-494a-9310-ec97904e65f0"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "512",
|
|
"category": "Other",
|
|
"uuid": "73b708ac-40ff-4625-bc96-0c88f1e79986"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--9a97fc45-451c-4aee-8940-4a554ebf286f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:26.000Z",
|
|
"modified": "2018-06-17T12:32:26.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "ad711ec082866631d620286bb36fdb72",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "385f884a-25f5-4950-88c4-f52210c34aba"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "4.752156",
|
|
"category": "Other",
|
|
"uuid": "4a70cc12-33d8-4cc4-98d4-28046dd05380"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".reloc",
|
|
"category": "Other",
|
|
"uuid": "83aa42d4-17a8-452c-8a7f-300c6981c0da"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "2048",
|
|
"category": "Other",
|
|
"uuid": "05c7cb56-ea7e-4ec5-9aeb-d04245e98199"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--1d79df64-ad7a-4189-a107-1d2f27e8202c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:29.000Z",
|
|
"modified": "2018-06-17T12:32:29.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "0.68996",
|
|
"category": "Other",
|
|
"uuid": "cf335a8c-65a1-4861-87aa-0dc50c6b92e1"
|
|
},
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "81c12eb5fc3cbdd06675cd1097363a40",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "be0e5848-f63f-4a60-b44e-88e691a579e2"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "4096",
|
|
"category": "Other",
|
|
"uuid": "e44574c6-ce7c-4e80-a945-2d93826c6c43"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b4d6cf82-abf9-40ea-8adf-884cac0b7dca",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:30.000Z",
|
|
"modified": "2018-06-17T12:32:30.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "2539474aa6202371abd37a4d66031955",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "8193f910-b6a6-4882-b2db-8953d9005fbc"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "6.641666",
|
|
"category": "Other",
|
|
"uuid": "a64b04be-5226-480a-bfd6-533d4351210a"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".text",
|
|
"category": "Other",
|
|
"uuid": "82d7de21-f2e6-4063-8d5b-7706e21afb07"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "86016",
|
|
"category": "Other",
|
|
"uuid": "cd2231da-2e2b-4e4e-a97f-3f282001bf7a"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--1b2178c0-7302-4bf6-a196-e7088086d1e7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:30.000Z",
|
|
"modified": "2018-06-17T12:32:30.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "b97c14b801643b3a61ea28266f3f71b1",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "5a312721-fd48-476c-9654-e8e41472f1c4"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "4.735406",
|
|
"category": "Other",
|
|
"uuid": "b74266f1-cd11-4044-8312-00950e9ee312"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rdata",
|
|
"category": "Other",
|
|
"uuid": "875163fd-907d-4d52-a24d-02644bde7c9d"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "8192",
|
|
"category": "Other",
|
|
"uuid": "10bb4ac1-f150-47c4-8ded-aa009ede3f86"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f6bf304a-cd3f-4bf4-8731-e4ad2e85c5c6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:31.000Z",
|
|
"modified": "2018-06-17T12:32:31.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "48eb8a67d4fd42ea24da9dc9029cb101",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "8f75c9c7-80a2-41fa-b5ab-8735956638d2"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "1.857068",
|
|
"category": "Other",
|
|
"uuid": "15bc8756-8f47-494f-840b-861e802a419b"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".data",
|
|
"category": "Other",
|
|
"uuid": "ee33eb1b-d468-4e3e-9864-f0be95463ee9"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "16384",
|
|
"category": "Other",
|
|
"uuid": "14303c6c-455c-4e90-acf1-bd235be80e5e"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--245d12e0-fda7-41de-935c-5fc5208ea77a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:31.000Z",
|
|
"modified": "2018-06-17T12:32:31.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "c139ac9cb34e0620a10c15e5d42b85d2",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "9382818d-b836-4bce-be05-0dc121894ce4"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "1.174962",
|
|
"category": "Other",
|
|
"uuid": "6024c08a-0a67-468d-a7ca-5b316029ebde"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rsrc",
|
|
"category": "Other",
|
|
"uuid": "1c6d2b79-dc6c-4b92-9132-d8e6c9b6f0a6"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "4096",
|
|
"category": "Other",
|
|
"uuid": "aa257733-68ee-4822-92e8-a75ff29fed05"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a5bf7615-9482-49f6-9959-55010346971f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:37.000Z",
|
|
"modified": "2018-06-17T12:32:37.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "2.558659",
|
|
"category": "Other",
|
|
"uuid": "6f846829-c071-4357-834a-88d3c908d07d"
|
|
},
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "55b6d1ed6d76c7d17cc270bc1843d2cb",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "12337d08-e2f7-4a13-b25a-9018dc6fb5a3"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "1024",
|
|
"category": "Other",
|
|
"uuid": "00869999-96fa-4094-8e60-8fd9643b04e5"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e20e89de-dedb-4493-9f39-d19bca906c68",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:37.000Z",
|
|
"modified": "2018-06-17T12:32:37.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "6e501513865a783fa945269010ac3785",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "594249fb-de2c-44c7-9c72-b883b0bbd722"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "6.390707",
|
|
"category": "Other",
|
|
"uuid": "5399e04c-6797-4851-9c02-4498d8fedeb8"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".text",
|
|
"category": "Other",
|
|
"uuid": "28cf08e9-586f-40ff-88e6-24f58b74ef7b"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "69632",
|
|
"category": "Other",
|
|
"uuid": "d63e0b10-bf65-429e-a385-577f4a7ca1d4"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a640c76e-6b15-4f46-bb4a-3c41a62700c5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:38.000Z",
|
|
"modified": "2018-06-17T12:32:38.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "45584c7afdc086b651d7299673643506",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "2a4a9051-94ca-498b-ace2-73b414564804"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "4.704433",
|
|
"category": "Other",
|
|
"uuid": "7633f9f1-2783-41d6-9348-b190763c9718"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rdata",
|
|
"category": "Other",
|
|
"uuid": "0214cb1a-7528-4f12-bcd6-f954bb7d6323"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "24064",
|
|
"category": "Other",
|
|
"uuid": "7403a39b-afb6-4849-bef1-16b02e384da7"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--940a978d-4e70-4357-a7c1-2e1a9e80b784",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:38.000Z",
|
|
"modified": "2018-06-17T12:32:38.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--fe2d8b67-f422-4335-be73-542f40ee8559",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:39.000Z",
|
|
"modified": "2018-06-17T12:32:39.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "de3fe99833797faa77379640174d16c4",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "26ce7da5-8330-403a-babf-afa9f4e8bbbc"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "4.786623",
|
|
"category": "Other",
|
|
"uuid": "7fbfbec0-c2a2-4968-beb9-2bcd00bf4234"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".pdata",
|
|
"category": "Other",
|
|
"uuid": "4d3c86ab-bd7e-4d16-8645-8faf593a8b0e"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "4096",
|
|
"category": "Other",
|
|
"uuid": "af55cdc6-ae33-4a93-a0f1-183d270362ad"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c11a828a-e1d5-4299-9329-7908ca5aeea8",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:39.000Z",
|
|
"modified": "2018-06-17T12:32:39.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "0cc425d0556c63acb7c04b9b1a211d5b",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "fdac98ce-e37a-4a40-a5fa-6cbae5a0d41d"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "5.105006",
|
|
"category": "Other",
|
|
"uuid": "fab78eda-b6fc-4db9-9983-f7c622a5b838"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rsrc",
|
|
"category": "Other",
|
|
"uuid": "9f7e4bc6-7a0f-4830-9152-696b88b5719d"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "512",
|
|
"category": "Other",
|
|
"uuid": "5f0f9cfa-6975-4e6e-bdec-05c056a9b3b2"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f5d96ec9-8867-4032-8088-5c539234665c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:40.000Z",
|
|
"modified": "2018-06-17T12:32:40.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "914f25782a74f42e42d7974b13bd01c8",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "af06b21f-d9a4-44d7-91e4-1e533736ec2d"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "2.869845",
|
|
"category": "Other",
|
|
"uuid": "2a4ff6aa-6535-4cc3-bb2b-3bcf214b5924"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".reloc",
|
|
"category": "Other",
|
|
"uuid": "18e88c8c-0485-4da2-b13b-34bc3ca648b5"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "1536",
|
|
"category": "Other",
|
|
"uuid": "4552ec2e-a15f-4e81-a1ce-ba951b0585ba"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--90eb0a08-a0d8-49c6-8ec7-dccc20d06199",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:46.000Z",
|
|
"modified": "2018-06-17T12:32:46.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "2.623906",
|
|
"category": "Other",
|
|
"uuid": "4f20d754-af06-4bf8-a089-e1604183d051"
|
|
},
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "2082ea5adc4b910e8673c04dc7d962d2",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "77867ffc-adae-4cb2-b0b7-31f5a2fcaf04"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "1024",
|
|
"category": "Other",
|
|
"uuid": "746ff0db-a29c-47e9-b429-a582329f3bee"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--073bfabc-0580-4fde-8659-c3854029937d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:46.000Z",
|
|
"modified": "2018-06-17T12:32:46.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "e6e5ce270a5e80221a815dbf739883a2",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "e49319ec-2ee0-40a3-8ff4-3c94373b1bd2"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "6.434048",
|
|
"category": "Other",
|
|
"uuid": "efff8e0d-ca3c-482e-909f-517d3b0f429e"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".text",
|
|
"category": "Other",
|
|
"uuid": "dfb19b82-e9d3-4b43-8eac-c37e3fcfe445"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "111616",
|
|
"category": "Other",
|
|
"uuid": "9ea0245b-8cf8-4e5d-99d4-f5fb3222d571"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e5f2a5b2-f9b6-4536-8068-1e610b0a5b17",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:47.000Z",
|
|
"modified": "2018-06-17T12:32:47.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--592953b3-0474-4ad1-8942-757124e30a99",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:47.000Z",
|
|
"modified": "2018-06-17T12:32:47.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d4bf7b4c-7f49-46cd-94a6-c12dc5a471eb",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:48.000Z",
|
|
"modified": "2018-06-17T12:32:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--3a63168f-d604-46d2-80c0-d24afea4639b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:48.000Z",
|
|
"modified": "2018-06-17T12:32:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c8df1989-af8f-49db-838c-ef2f8bb96eb5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:49.000Z",
|
|
"modified": "2018-06-17T12:32:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--81962a81-10c7-4f4d-ba8b-b9df3d5d741d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:52.000Z",
|
|
"modified": "2018-06-17T12:32:52.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "0.736742",
|
|
"category": "Other",
|
|
"uuid": "fc7e52c1-6011-43c6-86de-e8aaab9a61de"
|
|
},
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "f066de8df54d4f92795472d981374309",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "4e34dda4-b9ad-4519-959a-0825f5d71bb3"
|
|
},
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "f066de8df54d4f92795472d981374309",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "d42cac4e-b0d6-46d6-9f8a-f35f08f40a06"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "4096",
|
|
"category": "Other",
|
|
"uuid": "494565ac-b506-4c9a-9af8-7d6b07e59ab3"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--0f3b61d8-1fdd-408b-9710-61e6e3a05220",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:52.000Z",
|
|
"modified": "2018-06-17T12:32:52.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "e321dba33ae4db3b9e29aa6072b92e77",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "6656b273-6c7a-4832-a86c-c2e3f7a660dc"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "6.464385",
|
|
"category": "Other",
|
|
"uuid": "2e222367-ab5f-4682-8801-5e1df46ec400"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".text",
|
|
"category": "Other",
|
|
"uuid": "0107108d-10f0-43c8-95db-edddeefda13b"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "57344",
|
|
"category": "Other",
|
|
"uuid": "08610deb-6845-469f-bff4-eb4952548ea2"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5690876b-7f5b-4032-bb10-3f690b1ce2cd",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:53.000Z",
|
|
"modified": "2018-06-17T12:32:53.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "e321dba33ae4db3b9e29aa6072b92e77",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "0c9f8b24-4858-41b6-84ee-3cdc6d14c88d"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "6.464385",
|
|
"category": "Other",
|
|
"uuid": "57a2e7f2-3dd1-4271-a6ef-f60f642c14ad"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".text",
|
|
"category": "Other",
|
|
"uuid": "cec5ad39-baa9-4390-953f-f4a921c5c4d4"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "57344",
|
|
"category": "Other",
|
|
"uuid": "7fcb8b99-d6ed-419b-b839-b59567bbaa05"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--05809cc2-e217-49db-a128-b8b63d1b5171",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:54.000Z",
|
|
"modified": "2018-06-17T12:32:54.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "a256d5f52608331df8545a9d38751462",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "080b39a2-0110-4edc-a43c-a9484d0f01d8"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "3.62856",
|
|
"category": "Other",
|
|
"uuid": "fd32f17e-c693-4ae4-86a9-220e71e8ff3d"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rdata",
|
|
"category": "Other",
|
|
"uuid": "9e32adde-d36d-446c-bec6-c68ce69cd29d"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "8192",
|
|
"category": "Other",
|
|
"uuid": "68d693c4-6d58-4174-a992-04bd071efdeb"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--58af18ac-7fad-4504-85de-90947ece0028",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:54.000Z",
|
|
"modified": "2018-06-17T12:32:54.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "a256d5f52608331df8545a9d38751462",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "69c33713-7739-4f5e-a7e3-d58476a58de6"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "3.62856",
|
|
"category": "Other",
|
|
"uuid": "4311be4a-1510-4945-ae3c-d5bcb855ab5c"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rdata",
|
|
"category": "Other",
|
|
"uuid": "857498ed-6f15-4196-8d87-3b2522567d38"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "8192",
|
|
"category": "Other",
|
|
"uuid": "3ee3d7b1-1268-4b31-b195-679c3fb83b1c"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--75cd1bef-0d6e-4c7f-bc48-293403212159",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:55.000Z",
|
|
"modified": "2018-06-17T12:32:55.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "1d905ad87919346eb6c8463f61b599e8",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "8c837b33-91dd-44e1-a433-145918d62c3e"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "1.547483",
|
|
"category": "Other",
|
|
"uuid": "6d8b2665-bdd9-4b08-98c9-71eff4a95c71"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".data",
|
|
"category": "Other",
|
|
"uuid": "0d60a67c-0f8e-4dd3-b20e-4ff453638f33"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "16384",
|
|
"category": "Other",
|
|
"uuid": "2b4024d6-5a16-4d3c-8d50-d142267c9bd5"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e1eb04f2-bccb-4dd0-9f93-a1f2ccb4e650",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:55.000Z",
|
|
"modified": "2018-06-17T12:32:55.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "1d905ad87919346eb6c8463f61b599e8",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "cc978b97-e011-4b39-baa6-83cf5041703f"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "1.547483",
|
|
"category": "Other",
|
|
"uuid": "5b1c2cd7-1fa1-4f92-b2a2-eae73347d002"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".data",
|
|
"category": "Other",
|
|
"uuid": "6c3936b8-dd84-4b92-9d71-712e542bd4c5"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "16384",
|
|
"category": "Other",
|
|
"uuid": "6f514aa7-57c0-49a9-9a7b-2f22321f196a"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5ddcf5da-400b-4bad-b4f3-9dd0708a6644",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:56.000Z",
|
|
"modified": "2018-06-17T12:32:56.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "afdf2120655e37010482a536d552199e",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "99f5f2f6-5baa-4c45-94e1-ddff00cf07ea"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "7.100033",
|
|
"category": "Other",
|
|
"uuid": "a1e21134-1f3c-4e92-aae6-42379c3da323"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rsrc",
|
|
"category": "Other",
|
|
"uuid": "494d887a-1d0f-409f-a595-aaf5caf25c66"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "32768",
|
|
"category": "Other",
|
|
"uuid": "6124ec92-36cb-438b-a015-afa57fceec91"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--52d6ebd2-4ad3-44c5-9029-ccbff450c8b7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:56.000Z",
|
|
"modified": "2018-06-17T12:32:56.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "afdf2120655e37010482a536d552199e",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "686fbb2b-c415-4079-9ce3-98c34cf8d5b8"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "7.100033",
|
|
"category": "Other",
|
|
"uuid": "61a03fd9-9828-4b54-b80a-1a73ddcedb89"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".rsrc",
|
|
"category": "Other",
|
|
"uuid": "e1eb6292-bff0-4bee-8a3d-1801bc5535c6"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "32768",
|
|
"category": "Other",
|
|
"uuid": "aa9f8684-a9c1-41c5-8cb9-acd831c71bc5"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--59e02386-d00c-417d-b9c1-7a1dce691aad",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:57.000Z",
|
|
"modified": "2018-06-17T12:32:57.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "bbeec3983cc5b2094f8311718d327480",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "8a17878e-ae39-4389-b735-22c96fdb12ac"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "3.234713",
|
|
"category": "Other",
|
|
"uuid": "c4a78694-bbed-4f91-91b0-b95a9d843611"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".reloc",
|
|
"category": "Other",
|
|
"uuid": "c261f65c-d412-48de-961e-d515053ab4b2"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "8192",
|
|
"category": "Other",
|
|
"uuid": "211934d9-2206-4993-ae25-72076f830b38"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--dee24e7d-32ac-427d-a6be-952cf291e5f6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-06-17T12:32:58.000Z",
|
|
"modified": "2018-06-17T12:32:58.000Z",
|
|
"labels": [
|
|
"misp:name=\"pe-section\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "md5",
|
|
"object_relation": "md5",
|
|
"value": "bbeec3983cc5b2094f8311718d327480",
|
|
"category": "Payload delivery",
|
|
"to_ids": true,
|
|
"uuid": "37431fbf-1e5d-4a02-bff9-bb3ecf2d3a0e"
|
|
},
|
|
{
|
|
"type": "float",
|
|
"object_relation": "entropy",
|
|
"value": "3.234713",
|
|
"category": "Other",
|
|
"uuid": "5b1f36af-aa43-4bf1-b1f7-3688a70e9bee"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "name",
|
|
"value": ".reloc",
|
|
"category": "Other",
|
|
"uuid": "11f28e1c-8719-4b63-8bc0-9bb631db7792"
|
|
},
|
|
{
|
|
"type": "size-in-bytes",
|
|
"object_relation": "size-in-bytes",
|
|
"value": "8192",
|
|
"category": "Other",
|
|
"uuid": "b0a0607b-0f9c-4442-9b61-bf940e11d278"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "pe-section"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7b622deb-1c41-4317-a123-2eaeb8b29793",
|
|
"created": "2018-06-17T12:33:01.000Z",
|
|
"modified": "2018-06-17T12:33:01.000Z",
|
|
"relationship_type": "contains",
|
|
"source_ref": "x-misp-object--331a2fb4-3f10-45ca-89c9-60cf96c9205f",
|
|
"target_ref": "x-misp-object--2c6f9016-4377-447f-84df-ddc4c2d59f35"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--bb31a47e-429c-43c3-8c04-6103ed1cc6de",
|
|
"created": "2018-06-17T12:33:02.000Z",
|
|
"modified": "2018-06-17T12:33:02.000Z",
|
|
"relationship_type": "contained-within",
|
|
"source_ref": "x-misp-object--2c6f9016-4377-447f-84df-ddc4c2d59f35",
|
|
"target_ref": "x-misp-object--331a2fb4-3f10-45ca-89c9-60cf96c9205f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c4dbacbd-e03e-4e67-a5f7-494b7ccce961",
|
|
"created": "2018-06-17T12:33:02.000Z",
|
|
"modified": "2018-06-17T12:33:02.000Z",
|
|
"relationship_type": "contains",
|
|
"source_ref": "x-misp-object--bd2613b3-ef57-4c37-9e55-26e51493ba3a",
|
|
"target_ref": "x-misp-object--16c183f2-2c3f-4304-ad99-9e19c2323ee0"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1facf535-531f-462f-bd04-7945eb1dccab",
|
|
"created": "2018-06-17T12:33:03.000Z",
|
|
"modified": "2018-06-17T12:33:03.000Z",
|
|
"relationship_type": "contained-within",
|
|
"source_ref": "x-misp-object--16c183f2-2c3f-4304-ad99-9e19c2323ee0",
|
|
"target_ref": "x-misp-object--bd2613b3-ef57-4c37-9e55-26e51493ba3a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--49ff7b04-791c-4e57-b676-be98222ae2b8",
|
|
"created": "2018-06-17T12:33:04.000Z",
|
|
"modified": "2018-06-17T12:33:04.000Z",
|
|
"relationship_type": "contains",
|
|
"source_ref": "indicator--1dd9ce3a-5709-4b5b-9dd2-12d9bf32e1d0",
|
|
"target_ref": "indicator--c2593c36-69f5-4c43-9fcc-b335d606d569"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2c1506d8-ed51-4502-b62c-6e9d9ceba718",
|
|
"created": "2018-06-17T12:33:05.000Z",
|
|
"modified": "2018-06-17T12:33:05.000Z",
|
|
"relationship_type": "contained-within",
|
|
"source_ref": "indicator--c2593c36-69f5-4c43-9fcc-b335d606d569",
|
|
"target_ref": "indicator--1dd9ce3a-5709-4b5b-9dd2-12d9bf32e1d0"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9e1da164-6a5a-4621-bbb7-ae0cf2afca17",
|
|
"created": "2018-06-17T12:33:05.000Z",
|
|
"modified": "2018-06-17T12:33:05.000Z",
|
|
"relationship_type": "contains",
|
|
"source_ref": "indicator--35046b12-4171-4598-ab66-f6c536f03862",
|
|
"target_ref": "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f3f7b81d-15a4-4d59-8dd8-8728c04bfa85",
|
|
"created": "2018-06-17T12:33:06.000Z",
|
|
"modified": "2018-06-17T12:33:06.000Z",
|
|
"relationship_type": "contained-within",
|
|
"source_ref": "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f",
|
|
"target_ref": "indicator--35046b12-4171-4598-ab66-f6c536f03862"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--883da042-b6d4-47a8-a490-c41de8a9c2dc",
|
|
"created": "2018-06-17T12:40:50.000Z",
|
|
"modified": "2018-06-17T12:40:50.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--36c77c19-8523-4fc0-b1c7-a37fc417137f",
|
|
"target_ref": "x-misp-object--450c3377-2c9b-4b69-8381-f51dfe41f149"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--843e7d19-3683-4fdf-954d-3ec5cdfb0634",
|
|
"created": "2018-06-17T12:33:06.000Z",
|
|
"modified": "2018-06-17T12:33:06.000Z",
|
|
"relationship_type": "contains",
|
|
"source_ref": "indicator--a84b8d9c-0175-411b-8b89-fc0ac709df56",
|
|
"target_ref": "indicator--f94d3e39-27ea-4214-bb44-c25505dc2326"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--3a3cc2eb-a5bb-433b-a0ed-25f3f387da24",
|
|
"created": "2018-06-17T12:33:06.000Z",
|
|
"modified": "2018-06-17T12:33:06.000Z",
|
|
"relationship_type": "contained-within",
|
|
"source_ref": "indicator--f94d3e39-27ea-4214-bb44-c25505dc2326",
|
|
"target_ref": "indicator--a84b8d9c-0175-411b-8b89-fc0ac709df56"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |