{
  "date": "2019-08-20",
  "affected": "10.8.20.101",
  "family": "Ursnif / Gozi, then Trickbot",
  "outcome": "withheld",
  "reviewed_story": "The published investigation identifies Ursnif followed by Trickbot on Reginald Chandler’s TAMPA-OFFICE-PC (10.8.20.101). Initial delivery, encrypted follow-up transfers and later executable modules form a multi-stage infection. Some .rar-looking responses contain encrypted data, not recoverable plaintext executables. The platform has packet evidence, but no validated native short summary was saved.",
  "matched": "Not scored as a native summary success: report writing was withheld.",
  "gaps": "No saved incident story, family explanation or short IOC action list.",
  "caution": "A final provider retry was blocked pending explicit consent for the exact metadata transfer. The reference-based paragraph here is not a substituted platform result.",
  "hashes": [],
  "case_number": 8,
  "name": "Badbundt",
  "analysis_id": "1c2e6d58-c62a-4009-939b-3aa82de281a2",
  "capture_sha256": "500da44cbb442f282549a28815bec1dc55e6c0120286c532c43f8dd4a8c5d94d",
  "summary_id": null,
  "native_summary_saved": false,
  "affected_ip_in_short_report": false,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/08/20/2019-08-20-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:53.504376+00:00",
    "zip_sha256": "a917b99c664e616b5b49c339a0aa939f020d3209e8227ec65bf36595af86af75",
    "pdf_sha256": "feb0ff25a273ea5f25d6828cbca1affdf1eedbf9930e8c178c2ed8188678847d",
    "archive_member": "2019-08-20-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/08/20/page2.html",
  "reference_hash_checks": [],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}