{
  "Event": {
    "analysis": "1",
    "date": "2026-06-25",
    "extends_uuid": "",
    "info": "[Threat Intel] SharpPanda Strike Again",
    "protected": false,
    "publish_timestamp": "1782558468",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782558468",
    "uuid": "c43ea1a9-5308-43d7-a187-048d2b65e20b",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"SharpPanda\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#dd2e44",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#15ccfd",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Malaysia\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"Windows\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782538798",
        "to_ids": false,
        "type": "link",
        "uuid": "397044f7-78a2-45d1-9c2e-873a519299fe",
        "value": "https://research.pelagos-intel.com/sharppanda-strike-again"
      },
      {
        "category": "Payload delivery",
        "comment": "ZIP No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782546589",
        "to_ids": true,
        "type": "sha256",
        "uuid": "3caabd8a-08a4-46ba-b4b2-7a2172c1383e",
        "value": "92fd13374bbc2d0741cb0b78d6a5f979796380ad03f3dc59b7ad633b45668e14",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "ZIP No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782546590",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0d2d496d-7c86-4f87-9bae-7af5bd16d34a",
        "value": "c373b6ae57c53449d0442c6aaf307c36ccc4a3e37960b60be6ce29c0573bc1fb",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Stage 1 No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782546591",
        "to_ids": true,
        "type": "sha256",
        "uuid": "1681a787-c712-4ba5-bbb6-9b1ed931bfe7",
        "value": "47976166cdf4ceb36c4743423b85559ebc2a591389c5cf031ab50a9583d97d0d",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Stage 1 No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782546592",
        "to_ids": true,
        "type": "sha256",
        "uuid": "263dd67a-4a36-4840-8642-0cf73625a6f8",
        "value": "002ea3f1a773fd33f134d25fe43f46bd367567b3db4e513c5003a6017d41c18f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Stage 1",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782538956",
        "to_ids": true,
        "type": "imphash",
        "uuid": "6d75d8d1-4c32-4f53-951b-fbe4fe4a7fce",
        "value": "1278c9087e79a4e3e1a7906c444089ba"
      },
      {
        "category": "Payload delivery",
        "comment": "Stage 2 No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782546593",
        "to_ids": true,
        "type": "sha256",
        "uuid": "62adeb36-ac30-4ec4-9955-afe4026b9d94",
        "value": "28622bd3709e022939060827bcbf629a8cf0620ca0bef439667b5b0fe248a8a8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Stage 2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782538956",
        "to_ids": true,
        "type": "imphash",
        "uuid": "d1fba79c-5173-4937-9292-280c6efc362b",
        "value": "fe4475afb41128861be6f49922be87ce"
      },
      {
        "category": "Payload delivery",
        "comment": "Resource No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782546595",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e0ce556c-d8c5-4c6c-840a-5a79be11ce03",
        "value": "bedb6e6466ab92e48741a6f3f1d5471e49403d69fe295170097a76fe79efe8cd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Resource No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782546596",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4a9f05c0-c795-4248-b903-194735228497",
        "value": "54cbd4e83aff8cf3c1531a5603753469450c380f792ebfeb926b4dd978b44d44",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Shortcut No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782546597",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0c1a3a53-3eb2-434f-95f6-6d282d63c9f7",
        "value": "9055a6eee0533329c6740314d3e939434c68a8e85cf710afc9b8dfab7d0334bc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782550390",
        "uuid": "ab07265a-b210-4880-a310-afdfd46da747",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Document",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782550390",
            "to_ids": true,
            "type": "md5",
            "uuid": "1e3b71b8-7b44-46bf-8efe-dd4c4572d36c",
            "value": "cb161e2b9508e93f1b3113d3d8087dc2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Document",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546582",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e64d09dd-4bf6-43f0-b022-bdfb562b29b1",
            "value": "366008135fd560d107639a70f0e9a48b5df50ff6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Document",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546582",
            "to_ids": true,
            "type": "sha256",
            "uuid": "72bc5e44-5371-43bf-b893-52b890ddc660",
            "value": "88b99d98a8faf1ec974e9bcd3da4d69f236cff8a89d1b77124ecca92ef1f08b7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782541683",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e62d62ce-bab0-4ca0-85f1-2fefffc80afd",
            "value": "6144:AC+DX15rDHHeK9UK8N9YFeqGSMPZzn8fFZqpMe/qXovUmRrrvBr8oMLEvfOKQ3T:AC+ZR+88vzqSzR7Ue/vBnaD"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782541683",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "34e77701-fadc-43dd-9629-85abb89c1649",
            "value": "1245184"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782541683",
            "to_ids": true,
            "type": "vhash",
            "uuid": "55229896-9ed1-46c4-9a87-5ff917bfc4e9",
            "value": "529faef926369dd9e8a15e8304457a88"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782541683",
            "to_ids": true,
            "type": "filename",
            "uuid": "707d5649-d1eb-4053-9661-20dbe0e46119",
            "value": "2026-05-20 Malaysia Policy Brief Trump China Visit.doc"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  20/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782541683",
            "to_ids": false,
            "type": "text",
            "uuid": "3f97feb1-377b-40be-8328-8f24103ce875",
            "value": "Document\r\nType Description: MS Word Document\nMicrosoft: Trojan:O97M/Malgent!MSR\nVT Total Detection:35/61\nFirst Submission:2026-05-22T01:26:42.000000+00:00\nLast Submission:2026-05-22T01:26:42.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782550411",
        "uuid": "f101874c-2c45-4b78-a94f-d53928d28711",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Document",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782550411",
            "to_ids": true,
            "type": "md5",
            "uuid": "5791089c-5072-44ab-8bd9-9b4672815d78",
            "value": "3927ec252d2b00bd2d9d8550c529ae4f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Document",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546583",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d8aed7d5-0c8b-40a5-a828-77cd7fec07c3",
            "value": "a3afea82e94966a4f53e8bc8f7a3455196a90702",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Document",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546583",
            "to_ids": true,
            "type": "sha256",
            "uuid": "276f3ac8-1b9e-4e1c-9e8d-b5a001dd22b1",
            "value": "a630fddb44585d0875945789636d40c4005c4a09b98fb99a9cc2a9bb6afdf7e4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782541705",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "ce916f22-9902-49b9-a173-e46135e143c3",
            "value": "3072:V5JC4H7V8CCkNNTVV4VRzXu4yQtd0cfoZW1e4vIpegbQd3OtR/LVDbfoWxx:V3FH7Ik8RzXfyw0dkGcW7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782541705",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d591eb9b-2a9b-466f-87bb-b7eaf443de53",
            "value": "966144"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782541705",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b02658bc-553c-45c2-82eb-66a9792df90c",
            "value": "c75c5e5ac02371f331701aa595711ea5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782541705",
            "to_ids": true,
            "type": "filename",
            "uuid": "55629757-a358-45e1-98f7-97a106d31dc5",
            "value": "Projet d'accord de coop\u00e9ration \u00e9cologique.doc"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  16/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782541705",
            "to_ids": false,
            "type": "text",
            "uuid": "0b436ca6-acf9-4626-952a-d1f6e8b92346",
            "value": "Document\r\nType Description: MS Word Document\nMicrosoft: None\nVT Total Detection:33/62\nFirst Submission:2026-06-10T07:26:49.000000+00:00\nLast Submission:2026-06-10T07:26:49.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782550432",
        "uuid": "0f186015-c66b-4813-9e03-563c2def9ebf",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Stage 2",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782550432",
            "to_ids": true,
            "type": "md5",
            "uuid": "946ec822-c6f3-46f4-ad52-92495ef06714",
            "value": "a63496ff570d2f75ae3f211780976eaa",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Stage 2",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546585",
            "to_ids": true,
            "type": "sha1",
            "uuid": "da669de8-b2ad-4adf-9efa-801ca5f8f7f4",
            "value": "57ce76b070aa9cccfba8f02597a96d6785f9cd70",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Stage 2",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546585",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b75871f6-2af5-40ed-bbed-bd3a8a71a944",
            "value": "d0133c84975f8ab9ad2c20e3bee51ebfc8f51a1b2b56c4c6bd724ae945684800",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782541769",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "8da2f98d-e3eb-48b7-b8a2-c84fd6e97c67",
            "value": "6144:uaGqxQK2DkjgmQItnDQacnqK98wMzPRv1Zvqe80PHbpW5Q8T/XpieBxnPTgOYmvY:rGqi3DksmQItQacnqK98wMj51Zvqe80P"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782541769",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "95f8898c-f8a2-4b93-b225-264a466aed0a",
            "value": "348672"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782541769",
            "to_ids": true,
            "type": "vhash",
            "uuid": "b84c4c8d-a397-428a-87d5-2bfdbe2dfba4",
            "value": "135056655d15156068z56hz23z2ez5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782541769",
            "to_ids": true,
            "type": "filename",
            "uuid": "5fc14735-74cc-48da-b626-7bc105ad6fcf",
            "value": "ggg_stage3.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  16/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782541769",
            "to_ids": false,
            "type": "text",
            "uuid": "29f34137-c948-493c-856d-2f687eabb59e",
            "value": "Stage 2\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:39/71\nFirst Submission:2026-06-01T08:22:21.000000+00:00\nLast Submission:2026-06-04T09:11:59.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782550453",
        "uuid": "9fa542dc-eb72-43e4-a601-a2c79edca12f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Macro module",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782550453",
            "to_ids": true,
            "type": "md5",
            "uuid": "dd505960-03b6-43d9-b49d-b6f8a119e5aa",
            "value": "6615feda87063553f7239c2865e4fbf3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Macro module",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546586",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a62a1120-2502-4a95-96f9-7f2cdd815260",
            "value": "9d59cf82e44486ba3770e84426a4fcb7c28794b4",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Macro module",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546586",
            "to_ids": true,
            "type": "sha256",
            "uuid": "fc6b41fb-d59c-4938-b728-81c9fc28a4f9",
            "value": "764e3582ea592c47f32f231e298137007f7ca9c1d2abac604d137cc55d1f90cd",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#270095",
                "local": false,
                "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782541876",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "683e6efe-ee54-4411-8363-bc072bd9e3e9",
            "value": "192:lf8/9k+2rwda/Sy1QzhdWPflslpNsSzkwPycb631Lqv4h:lx"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782541876",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "25b92a61-eca2-4d32-b0e3-52482178122b",
            "value": "15393"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782541876",
            "to_ids": true,
            "type": "vhash",
            "uuid": "fdbe9073-f24b-4473-b534-9510b6dddf91",
            "value": "e370e95c3083a890e0ed7a23571aba45"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782541876",
            "to_ids": true,
            "type": "filename",
            "uuid": "358508d8-5b66-41c2-8ee2-95509df65f7c",
            "value": "ThisDocument.cls"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  06/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782541876",
            "to_ids": false,
            "type": "text",
            "uuid": "da7ed65c-c944-4666-a29a-566c30c05018",
            "value": "Macro module\r\nType Description: VBA\nMicrosoft: None\nVT Total Detection:4/62\nFirst Submission:2026-05-22T01:27:00.000000+00:00\nLast Submission:2026-05-22T01:27:00.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782550474",
        "uuid": "dad912cf-8b6b-415b-ae92-c6348a62671f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Macro module",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782550474",
            "to_ids": true,
            "type": "md5",
            "uuid": "621d5218-a292-4d37-9840-a1db974788d8",
            "value": "642bd3c02e79d5953b0119a7d60903e2",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Macro module",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782546588",
            "to_ids": true,
            "type": "sha1",
            "uuid": "c96e702c-b18a-4d3f-a4a7-dc00c5969e77",
            "value": "fe1cd563dd397e1b94bd6c1fce03a513c16e37b6",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Macro module",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782546588",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9331f9f9-3f3c-4f80-8171-322fec8e2f02",
            "value": "305f1cfdef08286f4200be0555b750bf5b23fb5582a4bb4d5e25e8ba6047d298",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782541898",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1258f00f-5bbe-44ef-b9b8-66cbf847fbcf",
            "value": "192:lfI/9k+2rwda/Sy1QzhdWPflslpNsSzkwPycb631Lqv4E:lQ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782541898",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "274e6b5b-fa04-4b45-817d-70e817ad0b8b",
            "value": "15399"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782541898",
            "to_ids": true,
            "type": "vhash",
            "uuid": "af0922c9-bd67-497a-a1ca-834e66e3f5f3",
            "value": "e370e95c3083a890e0ed7a23571aba45"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782541898",
            "to_ids": true,
            "type": "filename",
            "uuid": "13571c18-9e62-4c0b-9d43-53af4a8e0154",
            "value": "ThisDocument.cls"
          },
          {
            "category": "Other",
            "comment": "Checked: 27/06/2026\nLast-scan\t:  16/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782541898",
            "to_ids": false,
            "type": "text",
            "uuid": "b176e558-ca39-4076-964c-ef8cb681e677",
            "value": "Macro module\r\nType Description: VBA\nMicrosoft: None\nVT Total Detection:6/61\nFirst Submission:2026-06-10T07:27:45.000000+00:00\nLast Submission:2026-06-10T07:27:45.000000+00:00"
          }
        ]
      }
    ]
  }
}