{
  "date": "2019-01-28",
  "affected": "172.17.8.109",
  "family": "Dridex",
  "outcome": "partial",
  "reviewed_story": "Margaret Dunn’s DUNN-WINDOWS-PC (172.17.8.109) downloaded actiV.bin from 91.121.30[.]169:8000. The recovered executable hash matches the publisher’s sample; the reference’s associated IDS alerts support Dridex. The native report correctly explains the download and identity but leaves the malware family and subsequent incident unresolved.",
  "matched": "Correct victim, user, executable URL and exact SHA-256.",
  "gaps": "No Dridex identification or concise actionable payload indicator.",
  "caution": "One paragraph in the PDF says 91.121.30.159, but another caption and the packets identify .169. The native .169 is not an error.",
  "hashes": [
    "9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08"
  ],
  "case_number": 15,
  "name": "TimberShade",
  "analysis_id": "f4c6d05d-a600-4616-9c66-c96965645a65",
  "capture_sha256": "2fc08b2bcdd1be009dab7cea877464e6ce9f93c65bc3e45b1583266e164408db",
  "summary_id": "investigation-summary:6e58f2e4-e195-4862-b38f-78dd19f603f4",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/01/28/2019-01-28-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:43:00.304155+00:00",
    "zip_sha256": "34e3e659d5ec077a5b567aaf2b27f248dda159c3f3fe64283af582320a70d7d9",
    "pdf_sha256": "523c0c464afc4d6b4f84a042c30d70858f22d9699a7be05e4ce6250aeeabffc4",
    "archive_member": "2019-01-28-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/01/28/page2.html",
  "reference_hash_checks": [
    {
      "sha256": "9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-1e590e8c147fc278865188d5",
      "size_bytes": 155648,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://91.121.30.169:8000/91msE95B/actiV.bin",
          "client_ip": "172.17.8.109",
          "server_ip": "91.121.30.169",
          "tcp_stream": 50,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 802,
          "response_frame": 983
        }
      ],
      "present_in_short_claim_text": true,
      "in_short_ioc_list": false
    }
  ],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}