Malware Characterization w/ MAEC + Observation - Container

example.json

{
    "type": "package",
    "spec_version": "stix-2.0",
    "observations": [{
        "type": "observation",
        "id": "observation--1",
        "spec_version": "stix-2.0",
        "created_at": "2016-03-21T01:01:01Z",
        "observed_at": "2016-03-21T01:01:01Z",
        "objects": [{
            "id": "object--1",
            "type": "file-object",
            "hashes": {"md5": "C37D819D0C4C16865E9519478897D5D4"}
        }]
    }],
    "ttps": [{
        "id": "malware--1",
        "type": "malware",
        "maec": {
            "spec_version": "maec-5.0",
            "malware_subjects": [{
                "id": "subject--1",
                "type": "malware-subject",
                "instance_object_ref": "maec-object--1"
            }],
            "objects": [
                {
                    "id": "maec-object--1",
                    "type": "file-object",
                    "hashes": {"md5": "C37D819D0C4C16865E9519478897D5D4"}
                },
                {
                    "id": "maec-object--2",
                    "type": "file-object",
                    "hashes": {"md5": "B4D33B0C7306351B9ED96578465C5579"}
                }
            ],
            "actions": [{
                "id": "action--1",
                "type": "malware-action",
                "name": "create file",
                "associated_objects": [{
                    "object_ref": "maec-object--2",
                    "assocation_type": "output"
                }]
            }]
        }
    }]
}