diff --git a/extension-definition-specifications/malware-behavior-8e9/extension-definition--8e9e338f-c9ee-4d4f-8cac-85b4dcfdf3c1.json b/extension-definition-specifications/malware-behavior-8e9/extension-definition--8e9e338f-c9ee-4d4f-8cac-85b4dcfdf3c1.json
index cbabb6533c..1d38476e45 100644
--- a/extension-definition-specifications/malware-behavior-8e9/extension-definition--8e9e338f-c9ee-4d4f-8cac-85b4dcfdf3c1.json
+++ b/extension-definition-specifications/malware-behavior-8e9/extension-definition--8e9e338f-c9ee-4d4f-8cac-85b4dcfdf3c1.json
@@ -15,7 +15,7 @@
                     "properties": {
                         "extension-definition--8e9e338f-c9ee-4d4f-8cac-85b4dcfdf3c1": {
                             "type": "object",
-                            "$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix-common-objects/main/extension-definition-specifications/malware-behavior/malware-extension.json"
+                            "$ref": "https://raw.githubusercontent.com/oasis-open/cti-stix-common-objects/main/extension-definition-specifications/malware-behavior-8e9/malware-extension.json"
                         }
                     },
                     "required": ["extension-definition--8e9e338f-c9ee-4d4f-8cac-85b4dcfdf3c1"]