<xs:complexType name="HexBinaryObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The HexBinaryObjectPropertyType is a type (extended from BaseObjectPropertyType) representing the specification of a single Object property whose core value is of type HexBinary. This type will be assigned to any property of a CybOX object that should contain content of type HexBinary and enables the use of relevant metadata for the property.</xs:documentation>
    <xs:documentation>Properties that use this type can express multiple values by providing them using a delimiter-separated list. The default delimiter is '##comma##' (no quotes) but can be overridden through use of the delimiter field. Note that whitespace is preserved and so, when specifying a list of values, do not include a space following the delimiter in a list unless the first character of the next list item should, in fact, be a space.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" default="hexBinary">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the type of the value of the specified property. If a type different than the default is used, it MUST be specified here.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>

<stix:STIX_Package
  xmlns:stix="http://stix.mitre.org/stix-1"
  xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
  xmlns:cybox="http://cybox.mitre.org/cybox-2"
  xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
  xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:ihstix="http://www.qcert.org"
  xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
  xmlns:indicator="http://stix.mitre.org/Indicator-2"
  xmlns:xs="http://www.w3.org/2001/XMLSchema"
  xmlns:stixCommon="http://stix.mitre.org/common-1"
  xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
  xmlns:xlink="http://www.w3.org/1999/xlink"
  id="ihstix:Package-0c5ca78f-ae58-4d30-96b8-c056d62ac0b1" version="1.1.1">
  <stix:STIX_Header>
    <stix:Description>Email- link to malicious Powershell, malicious Alfa Web Shell developed since a long time </stix:Description>
  </stix:STIX_Header>
  <stix:Indicators>
    <stix:Indicator id="ihstix:indicator-c341725d-e11e-4908-806a-93fb80f2bacc" timestamp="2019-03-29T09:05:07.870837+00:00" xsi:type="indicator:IndicatorType">
      <indicator:Title>: hashes</indicator:Title>
      <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
      <indicator:Description/>
      <indicator:Observable id="ihstix:Observable-9df9c7d2-5cab-4bea-9451-467654028f01">
        <cybox:Object id="ihstix:IhFile-c56f3632-c762-4f20-b344-37ea24dd4a0b">
          <cybox:Properties xsi:type="FileObj:FileObjectType">
            <FileObj:File_Name condition="Equals"/>
            <FileObj:Hashes>
              <cyboxCommon:Hash>
                <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
                <cyboxCommon:Simple_Hash_Value condition="Equals">09ffd414668ee6cf12e30fad2f0799cb</cyboxCommon:Simple_Hash_Value>
              </cyboxCommon:Hash>
              <cyboxCommon:Hash>
                <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA256</cyboxCommon:Type>
                <cyboxCommon:Simple_Hash_Value condition="Equals"/>
              </cyboxCommon:Hash>
              <cyboxCommon:Hash>
                <cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">SHA1</cyboxCommon:Type>
                <cyboxCommon:Simple_Hash_Value condition="Equals"/>
              </cyboxCommon:Hash>
            </FileObj:Hashes>
          </cybox:Properties>
        </cybox:Object>
      </indicator:Observable>
      <indicator:Confidence timestamp="2019-03-29T09:05:07.871038+00:00">
        <stixCommon:Value>Low</stixCommon:Value>
      </indicator:Confidence>
    </stix:Indicator>
  </stix:Indicators>
</stix:STIX_Package>