CapTipper Report

CapTipper

Analysis Info

PCAP File	Analysis Time	CapTipper Version	Traffic Time
/opt/Malware-Project/BigDataset/Scenarios/CTU-Malware-Capture-Botnet-233-1//capture_win1.pcap	03/25/17 20:32:02	0.2 b10	06/05/79 20:36:33

Flow View

Client Details

IP	192.168.1.110
MAC	08:00:27:7c:99:f8

Conversations

f02783mat0i5r1t.cc (192.42.116.41:80)

ID

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

0

/for193gd63891mat/

text/html

0.html

502 Bad Gateway

HTML

269.0 B

06/05/79 20:36:33

Download
SHA256	58f251ec2ccaaed8fe3f0d223ad9fec1e6a077b5de392cbf049b91e69c7ad142
Referer
Magic	HyperText Markup Language (HTML)
Request	POST /for193gd63891mat/ HTTP/1.0 Host: f02783mat0i5r1t.cc Content-Length: 157
Response Header	HTTP/1.1 502 Bad Gateway Content-Length: 269 Content-Type: text/html Connection: close Server: netlib 0.17
Response Peek (128 B)	<html> <head> <title>502 Bad Gateway</title> </head> <body>ProtocolException...

piwxvumpyptp.com (208.100.26.234:80)

ID

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

1

/for193gd63891mat/(2)

text/html

(2)

404 Not Found

HTML

177.0 B

06/11/79 23:32:20

piwxvumpyptp.net (23.253.126.58:80)

ID

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

2

/for193gd63891mat/(3)

(3)

404 Not Found

0.0 B

07/08/79 04:15:07

piwxvumpyptp.in (216.218.185.162:80)

ID

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

3

/for193gd63891mat/(4)

(4)

BINARY

0.0 B

07/18/79 06:13:28

Download
SHA256	5dbc0e87830c9b212a245c757e05db91b8063a8401b877ad7795211db9737051
Referer
Magic	Inconclusive. Probably binary (BINARY)
Request	POST /for193gd63891mat/ HTTP/1.0 Host: piwxvumpyptp.in Content-Length: 157
Response Header
HEX Peek (128 B)	0000 14 3B 61 4B 18 3E 61 4B 02 69 75 0B 12 3A 60 50 .;aK.>aK.iu..:`P 0010 52 74 33 06 55 6F 61 4B 00 80 00 00 00 14 E9 A1 Rt3.UoaK........ 0020 83 00 F6 1E 8F A1 6E 52 8B B9 08 FC 77 0A E8 2E ......nR....w... 0030 9F 54 9D 16 19 8B B4 60 2D FF BA 1C 98 1D 24 F7 .T.....`-.....$. 0040 AC 21 A6 29 A3 DF 59 07 B8 24 8B A5 50 85 D5 A0 .!.)..Y..$..P... 0050 25 A7 F8 4B 6C 17 B3 FA 17 CC 78 BD 7D E5 D6 94 %..Kl.....x.}... 0060 8B 3B D0 34 AF 4E 32 8A 0C D5 86 C7 24 C5 23 97 .;.4.N2.....$.#. 0070 00 3D 86 9B 37 D1 08 D5 0D 67 34 D2 04 F5 4E 6C .=..7....g4...Nl