{
  "date": "2018-12-18",
  "affected": "172.16.3.133",
  "family": "Emotet and IcedID / Bokbot",
  "outcome": "partial",
  "reviewed_story": "Among several devices, the publisher identifies 172.16.3.133 as the workstation showing Emotet and IcedID activity. The native report selects the same host and connects it with executable and document downloads. It does not identify the malware chain; its wording about possible macros is a hypothesis, not extracted macro evidence.",
  "matched": "Correct affected workstation and relevant transfer focus.",
  "gaps": "No Emotet/IcedID interpretation; the source’s wider device inventory is outside this short incident-report objective.",
  "caution": "This case reaches the raw fallback stream limit, so extracted evidence is not exhaustive. OLE format alone does not prove a malicious macro.",
  "hashes": [],
  "case_number": 16,
  "name": "Eggnog Soup",
  "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
  "capture_sha256": "d35d186bb34fe0bf6a2e8787ebd71f44ec3ed0b90b3bbc890a97bad8823d92b8",
  "summary_id": "investigation-summary:dc26ff68-c6d3-4f90-92b1-6c06d9cd5b6f",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2018/12/18/2018-12-18-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:43:03.582896+00:00",
    "zip_sha256": "69ba9d06c148a599a18e37c577084b77e1bd2619975ac2cea69597a3b3099215",
    "pdf_sha256": "1b99080ca70499d34ddd6ff4a3be280122afd3f33eb52c17a8b66fe8f457f7a6",
    "archive_member": "2018-12-18-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2018/12/18/page2.html",
  "reference_hash_checks": [],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}