{
    "type": "bundle",
    "id": "bundle--970ee535-98ea-4ff0-9dc5-54258b092cac",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
            "created": "2023-03-08T14:44:38.241293Z",
            "modified": "2023-03-08T14:44:38.241418Z",
            "name": "S2W",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f50d2dc4-ec4e-4c36-ba9e-0ff7d9ff488b",
            "hashes": {
                "SHA-256": "bf134495142d704f9009a7d325fb9546db407971ade224e3718a84254e9ff03e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4671861f-8467-4cef-905e-9a9d0530c019",
            "hashes": {
                "SHA-256": "18e92e57568ad5aad4635c932782ee1c44add6c0718e5c794f6e66a70f78a984"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5e636a69-6695-47af-95e8-a4be0833c4e0",
            "hashes": {
                "SHA-256": "28e2221b90e9ef4c8e38593efd383dc218686fc38398bcf0a55c673420a63119"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5675b891-e800-4f4d-a658-3c9d2af10cdc",
            "hashes": {
                "SHA-256": "ae1721ce930929dfb060371cd0012aa38f29d2aac1dac761ec1d6302a46fa2fe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b54d7b72-da10-4ac3-8838-e4064176567f",
            "hashes": {
                "SHA-256": "0c84233ca90e5be15f6cdafa43d84207590b3fe522a01e20807915d3af715e9c"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--d8a84cb8-c7b7-4d54-9308-383c7bab4cd2",
            "value": "http://change.pi-usdt.o-r.kr"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--4ff263b4-324d-429f-907d-a2fd1ceabdd9",
            "value": "http://hange.pi-usdt.o-r.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--806e27ff-bb8f-4aaf-94e9-cc69c9cde0e2",
            "value": "change.pi-usdt.o-r.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--53dfa257-5d52-4239-9162-1fe3ef0ddcc8",
            "value": "hange.pi-usdt.o-r.kr"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a76e244d-8ba5-42ab-9013-977102bb26ed",
            "value": "204.12.253.10"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--20923ce7-7922-59da-b9d6-748211c2c540",
            "created": "2026-06-24T21:08:28.445304Z",
            "modified": "2026-06-24T21:08:28.445304Z",
            "name": "puNK-004"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--4aa9d50a-d7d4-481d-a452-031d9d26251d",
            "created_by_ref": "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
            "created": "2026-06-24T21:08:28.467815Z",
            "modified": "2026-06-24T21:08:28.467815Z",
            "name": "Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer",
            "published": "2025-03-13T00:00:00Z",
            "object_refs": [
                "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
                "file--f50d2dc4-ec4e-4c36-ba9e-0ff7d9ff488b",
                "file--4671861f-8467-4cef-905e-9a9d0530c019",
                "file--5e636a69-6695-47af-95e8-a4be0833c4e0",
                "file--5675b891-e800-4f4d-a658-3c9d2af10cdc",
                "file--b54d7b72-da10-4ac3-8838-e4064176567f",
                "url--d8a84cb8-c7b7-4d54-9308-383c7bab4cd2",
                "url--4ff263b4-324d-429f-907d-a2fd1ceabdd9",
                "domain-name--806e27ff-bb8f-4aaf-94e9-cc69c9cde0e2",
                "domain-name--53dfa257-5d52-4239-9162-1fe3ef0ddcc8",
                "ipv4-addr--a76e244d-8ba5-42ab-9013-977102bb26ed",
                "threat-actor--20923ce7-7922-59da-b9d6-748211c2c540"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://s2w.medium.com/detailed-analysis-of-docswap-malware-disguised-as-security-document-viewer-218a728c36ff"
                }
            ]
        }
    ]
}