{
  "date": "2018-11-07",
  "affected": "10.22.15.119",
  "family": "Ursnif / Gozi",
  "outcome": "withheld",
  "reviewed_story": "The published case identifies Ursnif/Gozi delivery to Carlos Danger’s DANGER-WIN-PC (10.22.15.119). An executable served through shumbildac[.]com is 439,808 bytes and has an answer-listed SHA-256. Ordinary university browsing in the same capture is unrelated. The native platform has retained packet evidence but no validated short narrative.",
  "matched": "Not counted as a native-summary success. Payload extraction is evaluated independently.",
  "gaps": "No saved concise story or action list.",
  "caution": "A withheld report means report writing failed, not that the capture is clean. The final provider retry was blocked pending exact-transfer consent.",
  "hashes": [
    "97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71"
  ],
  "case_number": 17,
  "name": "Turkey and Defence",
  "analysis_id": "bf107971-6797-4f93-9ffc-1301c6363bd9",
  "capture_sha256": "79f9a39e2cb38303a7f2e8363d984f727347537a87473679d9c081e79cde527f",
  "summary_id": null,
  "native_summary_saved": false,
  "affected_ip_in_short_report": false,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2018/11/07/2018-11-07-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:43:05.995852+00:00",
    "zip_sha256": "1ec4af6be153f2e4102114ea5750be4e4bcc9c0d00194d7f37c7f05642e65afc",
    "pdf_sha256": "76ddd4b190e14b1d21c5e57443c1d8b4295080aca95e07d9d9c864bea4b20141",
    "archive_member": "2018-11-07-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2018/11/07/page2.html",
  "reference_hash_checks": [
    {
      "sha256": "97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-00bacaef7d553f0b0ecce2ab",
      "size_bytes": 439808,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://shumbildac.com/WES/fatog.php?l=ngul5.xap",
          "client_ip": "10.22.15.119",
          "server_ip": "46.29.160.132",
          "tcp_stream": 51,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 1247,
          "response_frame": 1690
        }
      ],
      "present_in_short_claim_text": false,
      "in_short_ioc_list": false
    }
  ],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}