[
  {
    "id": 2903596,
    "indicator": "6785e29698444243677300db6a0c519909ae9e620d575e76d9be4862b33ed490",
    "type": "FileHash-SHA256",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 11667508,
    "indicator": "91acb0d56771af0196e34ac95194b3d0bf3200bc5f6208caf3a91286958876f9",
    "type": "FileHash-SHA256",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12032999,
    "indicator": "ef783cc3c4e1e0649b4629f3396cff4c0e0e0e67c07cacb8a9ae7c0cfa16bf0c",
    "type": "FileHash-SHA256",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 11619218,
    "indicator": "wmdmediacodecs.com",
    "type": "domain",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033000,
    "indicator": "tnsc.webredirect.org",
    "type": "hostname",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033001,
    "indicator": "006bdb19b6936329bffd4054e270dc6a",
    "type": "FileHash-MD5",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033002,
    "indicator": "15660631e31c1172ba5a299a90938c02",
    "type": "FileHash-MD5",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 2903600,
    "indicator": "2abe3cc4bff46455a945d56c27e9fb45",
    "type": "FileHash-MD5",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033003,
    "indicator": "e091425d23b8db6082b40d25e938f871",
    "type": "FileHash-MD5",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 11667961,
    "indicator": "f8e92d8b5488ea76c40601c8f1a08790",
    "type": "FileHash-MD5",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 2903603,
    "indicator": "138.201.44.30",
    "type": "IPv4",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033004,
    "indicator": "185.106.122.113",
    "type": "IPv4",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 2903602,
    "indicator": "84.200.2.12",
    "type": "IPv4",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033005,
    "indicator": "CVE-2017-0261",
    "type": "CVE",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033006,
    "indicator": "CVE-2017-0001",
    "type": "CVE",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033007,
    "indicator": "CVE-2017-0263",
    "type": "CVE",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033008,
    "indicator": "CVE-2017-0262",
    "type": "CVE",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12033009,
    "indicator": "CVE-2017-7255",
    "type": "CVE",
    "created": "2017-05-09T17:42:53",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 11667963,
    "indicator": "18b7dd3917231d7bae93c11f915e9702aa5d1bbb",
    "type": "FileHash-SHA1",
    "created": "2017-05-09T18:55:46",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12034557,
    "indicator": "6a90e0b5ec9970a9f443a7d52eee4c16f17fcc70",
    "type": "FileHash-SHA1",
    "created": "2017-05-09T18:55:46",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12034558,
    "indicator": "d072d9f81390c14ffc5f3b7ae066ba3999f80fee",
    "type": "FileHash-SHA1",
    "created": "2017-05-09T18:55:46",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 11667972,
    "indicator": "d5235d136cfcadbef431eea7253d80bde414db9d",
    "type": "FileHash-SHA1",
    "created": "2017-05-09T18:55:46",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12034559,
    "indicator": "e338d49c270baf64363879e5eecb8fa6bdde8ad9",
    "type": "FileHash-SHA1",
    "created": "2017-05-09T18:55:46",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 12034567,
    "indicator": "flPGdvyhPykxGvhDOAZnU",
    "type": "Mutex",
    "created": "2017-05-09T18:56:06",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 28679669,
    "indicator": "90a8520f63cd025dda3e99992f068f10a6f49cf1",
    "type": "YARA",
    "created": "2017-07-21T22:04:30",
    "content": "rule warning_EPS_xor_exec {   \n       meta:   \n           is_exploit = false   \n           is_warning = true   \n           is_feature = true   \n           rank = 5   \n           revision = \"1\"   \n           date = \"May 11 2017\"   \n           author = \"@tylabs\"   \n   \trelease = \"lite\"   \n           copyright = \"QuickSand.io (c) Copyright 2017. All rights reserved.\"   \n           tlp = \"green\"   \n           sigtype = \"cryptam_exploit\"   \n           desc = \"EPS obfuscation using xor and exec\"   \n       strings:   \n   \t$h1 = \"%!PS-Adobe-\" nocase   \n           $s1 = \"mod get xor put\"   \n   \t$s2 = \"exec quit\"   \n      \n       condition:   \n   \t$h1 at 0 and all of ($s*)   \n       }",
    "title": "warning_EPS_xor_exec",
    "description": "",
    "expiration": null,
    "is_active": 1
  }
]