{
    "type": "bundle",
    "id": "bundle--REPLACE-WITH-UUID",
    "objects": [
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:GREEN",
            "definition": {
                "tlp": "green"
            }
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--REPLACE-WITH-UUID",
            "created": "REPLACE-WITH-TIMESTAMP",
            "modified": "REPLACE-WITH-TIMESTAMP",
            "name": "REPLACE-malware-name",
            "description": "REPLACE with malware description",
            "malware_types": ["trojan"],
            "is_family": true,
            "object_marking_refs": [
                "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--REPLACE-WITH-UUID",
            "created": "REPLACE-WITH-TIMESTAMP",
            "modified": "REPLACE-WITH-TIMESTAMP",
            "name": "REPLACE - File hash indicator",
            "description": "SHA-256 hash of malware sample",
            "indicator_types": ["malicious-activity"],
            "pattern": "[file:hashes.'SHA-256' = 'REPLACE-WITH-HASH']",
            "pattern_type": "stix",
            "valid_from": "REPLACE-WITH-TIMESTAMP",
            "object_marking_refs": [
                "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--REPLACE-WITH-UUID-2",
            "created": "REPLACE-WITH-TIMESTAMP",
            "modified": "REPLACE-WITH-TIMESTAMP",
            "name": "REPLACE - Network indicator",
            "description": "C2 domain indicator",
            "indicator_types": ["malicious-activity"],
            "pattern": "[domain-name:value = 'REPLACE-WITH-DOMAIN']",
            "pattern_type": "stix",
            "valid_from": "REPLACE-WITH-TIMESTAMP",
            "object_marking_refs": [
                "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--REPLACE-WITH-UUID",
            "created": "REPLACE-WITH-TIMESTAMP",
            "modified": "REPLACE-WITH-TIMESTAMP",
            "name": "REPLACE-technique-name",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "TXXXX",
                    "url": "https://attack.mitre.org/techniques/TXXXX"
                }
            ],
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-attack",
                    "phase_name": "REPLACE-tactic-name"
                }
            ],
            "object_marking_refs": [
                "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--REPLACE-WITH-UUID",
            "created": "REPLACE-WITH-TIMESTAMP",
            "modified": "REPLACE-WITH-TIMESTAMP",
            "relationship_type": "indicates",
            "source_ref": "indicator--REPLACE-WITH-INDICATOR-UUID",
            "target_ref": "malware--REPLACE-WITH-MALWARE-UUID",
            "object_marking_refs": [
                "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--REPLACE-WITH-UUID-2",
            "created": "REPLACE-WITH-TIMESTAMP",
            "modified": "REPLACE-WITH-TIMESTAMP",
            "relationship_type": "uses",
            "source_ref": "malware--REPLACE-WITH-MALWARE-UUID",
            "target_ref": "attack-pattern--REPLACE-WITH-AP-UUID",
            "object_marking_refs": [
                "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
            ]
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--REPLACE-WITH-UUID",
            "created": "REPLACE-WITH-TIMESTAMP",
            "modified": "REPLACE-WITH-TIMESTAMP",
            "name": "REPLACE - Malware Analysis Report",
            "description": "REPLACE with report summary",
            "report_types": ["malware"],
            "published": "REPLACE-WITH-TIMESTAMP",
            "object_refs": [
                "malware--REPLACE-WITH-MALWARE-UUID",
                "indicator--REPLACE-WITH-INDICATOR-UUID",
                "indicator--REPLACE-WITH-INDICATOR-UUID-2",
                "attack-pattern--REPLACE-WITH-AP-UUID",
                "relationship--REPLACE-WITH-REL-UUID",
                "relationship--REPLACE-WITH-REL-UUID-2"
            ],
            "object_marking_refs": [
                "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
            ]
        }
    ]
}