{
  "date": "2019-12-03",
  "affected": "10.18.20.97",
  "family": "Ursnif",
  "outcome": "missed",
  "reviewed_story": "The publisher identifies Ursnif activity on JUANITA-WORK-PC (10.18.20.97), used by momia.juanita. Webmail activity precedes the infection, but email delivery is a hypothesis rather than proof. AdversaryGraph finds the correct identity yet summarises routine directory traffic, failing to explain the suspicious part of the capture.",
  "matched": "Correct workstation, IP and account.",
  "gaps": "Misses the incident and family; overgeneralises normal directory activity into a lack-of-compromise finding.",
  "caution": "Banking and webmail domains are context, not malicious IOCs. The family in the answer is supported by associated IDS alerts that were not model input.",
  "hashes": [],
  "case_number": 6,
  "name": "Icemaiden",
  "analysis_id": "fa0da8be-03fb-404d-a526-6c99c6b4f000",
  "capture_sha256": "01da378585edbbc7d97e9cd91418a50cc506468d615ff0002b7f4bc34e0cbe0a",
  "summary_id": "investigation-summary:642e8b54-ddd2-4167-9588-4c9eeb609cf2",
  "native_summary_saved": true,
  "affected_ip_in_short_report": true,
  "affected_reference_boundary": "explicitly stated in reference text",
  "reference_source": {
    "url": "https://www.malware-traffic-analysis.net/2019/12/03/2019-12-03-traffic-analysis-exercise-answers.pdf.zip",
    "retrieved_at": "2026-09-22T19:42:44.530559+00:00",
    "zip_sha256": "631efa8bdaae2990f29bfdcf9c1292bc2c2d32b6a7185069a352e2326274cc8c",
    "pdf_sha256": "af3a62bea323747f15256e72030f48e2c794c12f5ebf85e40af6339c6d5ca1da",
    "archive_member": "2019-12-03-traffic-analysis-exercise-answers.pdf",
    "scope": "Official reference answers, evaluation-only; never supplied to platform or report model."
  },
  "reference_answer_page": "https://www.malware-traffic-analysis.net/2019/12/03/page2.html",
  "reference_hash_checks": [],
  "native_ioc_reviews": [],
  "scope": "Post-freeze reviewer comparison, never supplied to report-writing model. Reference may use alerts, email and endpoint artifacts absent from PCAP-only input."
}