{
  "Event": {
    "analysis": "2",
    "date": "2017-10-18",
    "extends_uuid": "",
    "info": "OSINT - Goodbye Cerber? Hello Magniber Ransomware!",
    "publish_timestamp": "1523865222",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1523865207",
    "uuid": "5ad059f5-b418-43bc-a901-7c4a950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#2b4d00",
        "local": false,
        "name": "malware_classification:malware-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#00223b",
        "local": false,
        "name": "osint:source-type=\"blog-post\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Magniber Ransomware\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1523862920",
        "to_ids": false,
        "type": "link",
        "uuid": "5ad05a06-0f9c-4d18-8d45-7ebd950d210f",
        "value": "https://www.bleepingcomputer.com/news/security/goodbye-cerber-hello-magniber-ransomware/",
        "Tag": [
          {
            "colour": "#00223b",
            "local": false,
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1523862920",
        "to_ids": false,
        "type": "comment",
        "uuid": "5ad05b4f-4c78-4381-975d-7ebe950d210f",
        "value": "Magniber is a new ransomware being distributed by the Magnitude Exploit Kit that appears to be the successor to the Cerber Ransomware. While many aspects of the Magniber Ransomware are different than Cerber, the payment system and the files it encrypts are very similar.",
        "Tag": [
          {
            "colour": "#00223b",
            "local": false,
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1523605052",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5ad05e3c-6574-49c4-a873-7310950d210f",
        "value": "2e6f9a48d854add9f895a3737fa5fcc9d38d082466765e550cca2dc47a10618e"
      },
      {
        "category": "Network activity",
        "comment": "Payment Site",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1523862920",
        "to_ids": true,
        "type": "domain",
        "uuid": "5ad061ac-07c0-46fe-baed-7c4a950d210f",
        "value": "ofotqrmsrdc6c3rz.onion"
      },
      {
        "category": "Network activity",
        "comment": "C2 - pattern",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1523862921",
        "to_ids": false,
        "type": "domain",
        "uuid": "5ad061ee-72fc-47c4-b09f-730a950d210f",
        "value": "bankme.date"
      },
      {
        "category": "Network activity",
        "comment": "C2 - pattern",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1523862921",
        "to_ids": false,
        "type": "domain",
        "uuid": "5ad061ee-82b0-4abc-a13e-730a950d210f",
        "value": "jobsnot.services"
      },
      {
        "category": "Network activity",
        "comment": "C2 - pattern",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1523862922",
        "to_ids": false,
        "type": "domain",
        "uuid": "5ad061ee-932c-4887-8e64-730a950d210f",
        "value": "carefit.agency"
      },
      {
        "category": "Network activity",
        "comment": "C2 - pattern",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1523862922",
        "to_ids": false,
        "type": "domain",
        "uuid": "5ad061ee-87ec-4ebe-8564-730a950d210f",
        "value": "hotdisk.world"
      }
    ],
    "Object": [
      {
        "comment": "c2",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523608381",
        "uuid": "5ad06b3d-20b8-4ff8-8190-7d03950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523609258",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06b3d-4230-48f8-9bd8-7d03950d210f",
            "value": "hostname"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523608381",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06b3d-0c10-442f-b760-7d03950d210f",
            "value": "[victim_id].bankme.date"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523608382",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06b3e-3bb8-4dae-949e-7d03950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "c2",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523608923",
        "uuid": "5ad06d5b-4948-403b-84e5-71e2950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523608924",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06d5c-7f48-450b-a85f-71e2950d210f",
            "value": "hostname"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523608924",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06d5c-50c0-418e-8aaa-71e2950d210f",
            "value": "[victim_id].jobsnot.services"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523608924",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06d5c-e4c0-41af-84d8-71e2950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "c2",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523609010",
        "uuid": "5ad06db2-b1f8-4643-8dc4-71e2950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523609010",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06db2-aea4-4927-b6f3-71e2950d210f",
            "value": "hostname"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523609011",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06db3-0498-4e9a-97cd-71e2950d210f",
            "value": "[victim_id].carefit.agency"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523609011",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06db3-8f90-4577-bcfc-71e2950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "c2",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523609131",
        "uuid": "5ad06e2b-d768-4900-bdaf-7105950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523609132",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06e2c-329c-4cfa-8e7e-7105950d210f",
            "value": "hostname"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523609132",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06e2c-6bb4-481c-9cc9-7105950d210f",
            "value": "[victim_id].hotdisk.world"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523609132",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad06e2c-4ce4-4a24-bf1e-7105950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523610687",
        "uuid": "5ad0743f-291c-4371-a8b7-a2c7950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523610687",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad0743f-bf28-435c-a5ed-a2c7950d210f",
            "value": "filename"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523610688",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07440-8f68-4879-99dc-a2c7950d210f",
            "value": "%Temp%\\[extension].exe"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523610688",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07440-8c70-4537-9272-a2c7950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523610717",
        "uuid": "5ad0745d-b16c-43e3-af6a-7103950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523610718",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad0745e-1340-4143-b76c-7103950d210f",
            "value": "filename"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523610718",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad0745e-676c-404a-9ee9-7103950d210f",
            "value": "%Temp%\\[victim_id].[extension]"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523610719",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad0745f-c71c-4fdb-8532-7103950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523610740",
        "uuid": "5ad07474-6b50-4622-a197-7ebd950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523610740",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07474-dd24-480f-bc42-7ebd950d210f",
            "value": "filename"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523610740",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07474-9e4c-40d7-a1c8-7ebd950d210f",
            "value": "READ_ME_FOR_DECRYPT_[victim_id]_.txt"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523610741",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07475-b838-4008-a1e9-7ebd950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "personal page",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523610847",
        "uuid": "5ad074df-efc0-4a3d-a21c-a35f950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523610847",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad074df-e2a8-4811-b5b9-a35f950d210f",
            "value": "url"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523610848",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad074e0-ecf8-4fa9-b0c5-a35f950d210f",
            "value": "http://[victim_id].ofotqrmsrdc6c3rz.onion/EP866p5M93wDS513"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523610848",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad074e0-9b60-4cf3-a5ad-a35f950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523610895",
        "uuid": "5ad0750f-5048-4873-a2c3-4a7e950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523610895",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad0750f-0d14-42a6-be72-499c950d210f",
            "value": "url"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523610896",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07510-4254-4007-8cde-4843950d210f",
            "value": "http://[victim_id].bankme.date/EP866p5M93wDS513"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523610896",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07510-de88-41dd-ab02-4b13950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523610940",
        "uuid": "5ad0753c-a3dc-48b9-9020-7ebd950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523610940",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad0753c-4cf0-4101-8d26-7ebd950d210f",
            "value": "url"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523610940",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad0753c-974c-4cda-bce8-7ebd950d210f",
            "value": "http://[victim_id].jobsnot.services/EP866p5M93wDS513"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523610941",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad0753d-fba4-4d17-b31e-7ebd950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523610983",
        "uuid": "5ad07567-af78-4892-86e8-4cb8950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523610984",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07568-782c-4ba4-8fac-49a5950d210f",
            "value": "url"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523610984",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07568-d274-478b-a229-4c67950d210f",
            "value": "http://[victim_id].carefit.agency/EP866p5M93wDS513"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523610985",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07569-c344-41d4-87d1-433f950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a regular expression (regex or regexp). The object can be linked via a relationship to other attributes or objects to describe how it can be represented as a regular expression.",
        "meta-category": "misc",
        "name": "regexp",
        "template_uuid": "ceffad66-71e5-4e20-9370-1b3fb694c648",
        "template_version": "3",
        "timestamp": "1523611009",
        "uuid": "5ad07581-3b9c-4e94-b6eb-7323950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1523611009",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07581-bfc0-42c0-9b04-7323950d210f",
            "value": "url"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "regexp",
            "timestamp": "1523611010",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07582-d124-456a-9d89-7323950d210f",
            "value": "http://[victim_id].hotdisk.world/EP866p5M93wDS513"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "regexp-type",
            "timestamp": "1523611010",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad07582-aef8-4138-aced-7323950d210f",
            "value": "PCRE"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "7",
        "timestamp": "1523862925",
        "uuid": "54409a9c-5223-45fe-a1ef-961fbf04376e",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "54409a9c-5223-45fe-a1ef-961fbf04376e",
            "referenced_uuid": "13173e52-49f5-4574-8a1e-405f28c276d9",
            "relationship_type": "analysed-with",
            "timestamp": "1523862925",
            "uuid": "5ad44d8d-1570-45e5-bb63-44e602de0b81"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1523862922",
            "to_ids": true,
            "type": "md5",
            "uuid": "5ad44d8a-771c-4c91-b38a-4a5b02de0b81",
            "value": "59ef984c16a5c1723d9958fbeb1b7450"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1523862923",
            "to_ids": true,
            "type": "sha1",
            "uuid": "5ad44d8b-6898-4c69-88ef-4b2302de0b81",
            "value": "a7bcd0188e3fd0f16226ab44477a04662a5c5450"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1523862923",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5ad44d8b-3d84-41b1-b89c-4a8f02de0b81",
            "value": "2e6f9a48d854add9f895a3737fa5fcc9d38d082466765e550cca2dc47a10618e"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "1",
        "timestamp": "1523862924",
        "uuid": "13173e52-49f5-4574-8a1e-405f28c276d9",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1523862924",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5ad44d8c-5588-4838-95c8-4dfe02de0b81",
            "value": "2018-03-26T17:29:48"
          },
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1523862924",
            "to_ids": false,
            "type": "link",
            "uuid": "5ad44d8c-a0e8-4a89-b42a-436b02de0b81",
            "value": "https://www.virustotal.com/file/2e6f9a48d854add9f895a3737fa5fcc9d38d082466765e550cca2dc47a10618e/analysis/1522085388/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1523862925",
            "to_ids": false,
            "type": "text",
            "uuid": "5ad44d8d-758c-4cdc-a4e9-453a02de0b81",
            "value": "56/66"
          }
        ]
      }
    ]
  }
}