CapTipper Report

CapTipper

PCAP File	Analysis Time	CapTipper Version	Traffic Time
/opt/Malware-Project/BigDataset/Scenarios/CTU-Malware-Capture-Botnet-161-1//2015-12-09_capture-win5.pcap	07/01/16 20:12:11	0.2 b10	04/05/74 06:55:04

www.msftncsi.com (195.113.232.89:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/ncsi.txt

text/plain

ncsi.txt

200 OK

TEXT

14.0 B

04/05/74 06:55:04

saecargomaritime.com (169.255.59.8:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/petroleum/gate.php

text/html

gate.php

200 OK

BINARY

20.0 B

10/11/77 02:20:11

Download
SHA256	4f205f495193970f6f3479f1cd9e5f2726c2c697b13020ac2274a0939eba6c7b
Referer
Magic	Inconclusive. Probably binary (BINARY)
Request	POST /petroleum/gate.php HTTP/1.0 Host: saecargomaritime.com Accept: / Accept-Encoding: identity, *;q=0 Accept-Language: en-US Content-Length: 179 Content-Type: application/octet-stream Connection: close Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
Response Header	HTTP/1.1 200 OK Date: Sat, 05 Dec 2015 12:27:28 GMT Server: Apache X-Powered-By: PHP/5.4.45 Connection: close Content-Type: text/html; charset=windows-1251
HEX Peek (128 B)	0000 00 00 00 00 8D 4C C8 15 F6 64 70 73 C7 56 51 35 .....L...dps.VQ5 0010 03 43 DD 26 .C.&