{
  "date": "2019-11-12",
  "affected": "10.11.11.203",
  "family": null,
  "outcome": "partial",
  "reviewed_story": "Candice Tucker’s Windows host (10.11.11.203, TUCKER-WIN7-PC) downloaded a Windows executable from acjabogados[.]com/40group.tiff. The recovered hash matches the publisher’s sample. Subsequent TCP attempts targeted 5.188.108[.]58 and 138.201.6[.]195 without a response. These are attempted connections, not proof of a successful command-and-control session.",
  "matched": "Correct victim, identity, disguised payload URL and SHA-256.",
  "gaps": "Omits the subsequent connection attempts. The exact payload is not included in the short IOC list; the new extension-mismatch rule does not yet cover .tiff.",
  "caution": "The answer does not establish a specific malware family. Its historical VirusTotal ratio is not a current result from this run.",
  "hashes": [
    "8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635"
  ],
  "case_number": 7,
  "name": "Okay-Boomer",
  "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
  "capture_sha256": "1c607e6b1245a2ee781551fb8a9c629763f848410c3756f28d80615c55fc22d1",
  "summary_id": "investigation-summary:241f2780-d4c1-4048-8bdd-09d4fb6c15f8",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/11/12/2019-11-12-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:52.523929+00:00",
    "zip_sha256": "659ca5b6cdbef25bbfca934c5e675e551551cd30c0bc5214f4d94c295eb87dc6",
    "pdf_sha256": "ae0f11b0c72975a39f594ef7e796576a8fc5052cf5be2b07d529a445f2e33080",
    "archive_member": "2019-11-12-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/11/12/page2.html",
  "reference_hash_checks": [
    {
      "sha256": "8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635",
      "present_in_original_artifacts": true,
      "artifact_id": "artifact-86b99b01439d20dbcedf6528",
      "size_bytes": 389120,
      "completeness": "matches-declared-content-length",
      "transfer_bindings": [
        {
          "url": "http://acjabogados.com/40group.tiff",
          "client_ip": "10.11.11.203",
          "server_ip": "188.95.248.71",
          "tcp_stream": 264,
          "match_basis": "exact-sha256-of-decoded-http-response-body",
          "status_code": "200",
          "completeness": "matches-declared-content-length",
          "request_frame": 11415,
          "response_frame": 11979
        }
      ],
      "present_in_short_claim_text": true,
      "in_short_ioc_list": false
    }
  ],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}