Recursive Archive File Characterization - TLO

example.json

{
    "type": "package",
    "spec_version": "stix-2.0",
    "objects": [
        {
            "id": "file-object--1",
            "type": "file-object",
            "hashes": {"md5": "C37D819D0C4C16865E9519478897D5D4"},
            "extended-properties": {"archive": {"file_count": 1}}
        },
        {
            "id": "file-object--2",
            "type": "file-object",
            "hashes": {"md5": "B4D33B0C7306351B9ED96578465C5579"},
            "extended-properties": {"archive": {"file_count": 1}}
        },
        {
            "id": "file-object--3",
            "type": "file-object",
            "hashes": {"md5": "B4D33B0C7306351B9ED96578465C5579"}
        }
    ],
    "relationships": [
        {
            "type": "object-relationship",
            "id": "object-relationship--1",
            "spec_version": "cybox-3.0",
            "source_ref": "file-object--1",
            "target_ref": "file-object--2",
            "kind_of_relationship": "contains"
        },
        {
            "type": "object-relationship",
            "id": "object-relationship--1",
            "spec_version": "cybox-3.0",
            "source_ref": "file-object--2",
            "target_ref": "file-object--3",
            "kind_of_relationship": "contains"
        }
    ],
    "observations": [{
        "type": "observation",
        "id": "observation--4",
        "spec_version": "stix-2.0",
        "created_at": "2016-03-21T01:01:01Z",
        "observed_at": "2016-03-21T01:01:01Z",
        "object_ref": "file-object--1"
    }]
}