{
  "date": "2018-10-31",
  "affected": "10.100.9.107",
  "family": "Trickbot",
  "outcome": "withheld",
  "reviewed_story": "The reference identifies Trickbot on Ichabod Crane’s HEADLESS-PC (10.100.9.107). The relevant executable transfer is 46.173.214[.]185/startr.ack around 15:34 UTC, after ordinary startup traffic. Its recoverable hash is listed in the answer. The platform’s final report-writing state is withheld; this explanation is reference-assisted, not native output.",
  "matched": "No saved native short summary; original evidence remains available.",
  "gaps": "No saved incident explanation or short IOC list.",
  "caution": "The beginning of the capture is not the beginning of malicious activity. Final retry awaits exact-transfer consent.",
  "hashes": [
    "396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c"
  ],
  "case_number": 18,
  "name": "Happy Halloween",
  "analysis_id": "403cf219-db40-48ee-8a71-311000d90bfa",
  "capture_sha256": "54d43f7c2f95afeebd61eb9ba9b247561a4e10267d515038b7569efdc3fb79fd",
  "summary_id": null,
  "native_summary_saved": false,
  "affected_ip_in_short_report": false,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2018/10/31/2018-10-31-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:43:08.815829+00:00",
    "zip_sha256": "ec9316c6ed959f4a39c74caa8bea107dabb86a678334dc9f7f8e4c12c52ea656",
    "pdf_sha256": "b7040e935fae95a6d9cee91459ca9e9b1fd4967576ad6009b6451eeeda3bfe85",
    "archive_member": "2018-10-31-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2018/10/31/page2.html",
  "reference_hash_checks": [
    {
      "sha256": "396223eeec49493a52dd9d8ba5348a332bf064483a358db79d8bb8d22e6eb62c",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-446a68e90c43f0b3182a498e",
      "size_bytes": 318464,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://46.173.214.185/startr.ack",
          "client_ip": "10.100.9.107",
          "server_ip": "46.173.214.185",
          "tcp_stream": 44,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 679,
          "response_frame": 966
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    }
  ],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}