{
  "date": "2019-05-02",
  "affected": "10.0.0.227",
  "family": "Hawkeye keylogger",
  "outcome": "missed",
  "reviewed_story": "The published case identifies Hawkeye stealing information from Adriana Breaux’s workstation (10.0.0.227, BREAUX-WIN7-PC). FTP uploads carry credential data, keystrokes and screenshots to files.000webhost[.]com. The native report identifies the host and port-21 sessions but fails to interpret the FTP transfer behavior that explains the incident.",
  "matched": "Correct workstation/account and external port-21 connections.",
  "gaps": "Misses FTP-based theft and Hawkeye. “Decrypted stream coverage” is misleading: this workflow did not decrypt TLS payloads.",
  "caution": "The PDF lists 154.14.* hosting IPs; packets show 145.14.144.10, 145.14.145.4 and 145.14.145.99. Hosting and IP-check services are not inherently malicious.",
  "hashes": [],
  "case_number": 11,
  "name": "BeguileSoft",
  "analysis_id": "d4027bcf-0ef6-4e3c-a68a-68dfe35adb33",
  "capture_sha256": "41c9c4db17a58581eed3fc7f0bbebfe93c68034e2457afe131503c1a9eafac56",
  "summary_id": "investigation-summary:0808d9fa-3047-47fe-89f5-25072e6b0b60",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/05/02/2019-05-02-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:56.195676+00:00",
    "zip_sha256": "e99c961d17a39cdddd6d3916cff8a2c2bde83bb8ab4107cbb286163a0b7ec1e9",
    "pdf_sha256": "737f753e22420cd2f4baac8e5f4a508fb4b97e81a200824c1440e1a581c220f4",
    "archive_member": "2019-05-02-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/05/02/page2.html",
  "reference_hash_checks": [],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}