CapTipper Report

PCAP File	Analysis Time	CapTipper Version	Traffic Time
/opt/Malware-Project/BigDataset/Scenarios/CTU-Malware-Capture-Botnet-234-1//capture_win13.pcap	03/25/17 20:31:57	0.2 b10	02/06/87 18:21:54

176.121.14.95 (176.121.14.95:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/checkupdate(2)

checkupdate(2)

TEXT

0.0 B

02/07/87 22:01:14

Download
SHA256	3a5e0393381c14e13e15d60023e72e0cd9a4a5f9d2a09486adde723c923b0f06
Referer	http://176.121.14.95/
Magic	Inconclusive. Probably text (TEXT)
Request	POST /checkupdate HTTP/1.1 Accept: / Accept-Language: en-us Referer: http://176.121.14.95/ x-requested-with: XMLHttpRequest Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Cache-Control: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: 176.121.14.95 Content-Length: 664 Connection: Keep-Alive
Response Header
Response Peek (128 B)	mOPhba=%93%05%DF%D1%9B%EB%9E%F5%1Dg%C74%5C%DC%EC%BD%27-%7F%A78%E0%0A%29%FE%D1%CCB2K%5B%F2x%0D%8B%18y%A5%0A%D5N%29%18l%5E&NHkDYq=...

/checkupdate(3)

checkupdate(3)

TEXT

0.0 B

05/31/87 11:58:53

Download
SHA256	d70fb081e40637733957275b3feab1bf8847e7d0b4cd0fa084a9487ebb969a14
Referer	http://176.121.14.95/
Magic	Inconclusive. Probably text (TEXT)
Request	POST /checkupdate HTTP/1.1 Accept: / Accept-Language: en-us Referer: http://176.121.14.95/ x-requested-with: XMLHttpRequest Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Cache-Control: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: 176.121.14.95 Content-Length: 1131 Connection: Keep-Alive
Response Header
Response Peek (128 B)	piJvMlpA=%80U%AB%D2%E6%2A7CXG%9B%24%11%5C%85AQ%25%B5%05%F0%8Af%28%97%CB%90%F8%A1%1B%C8%EB%C9%86l%2CU&UoNWRh=%EA%B5%2BO%094%E9XD%...

/checkupdate(4)

checkupdate(4)

TEXT

0.0 B

01/29/88 01:24:02

Download
SHA256	3a5e0393381c14e13e15d60023e72e0cd9a4a5f9d2a09486adde723c923b0f06
Referer	http://176.121.14.95/
Magic	Inconclusive. Probably text (TEXT)
Request	POST /checkupdate HTTP/1.1 Accept: / Accept-Language: en-us Referer: http://176.121.14.95/ x-requested-with: XMLHttpRequest Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Cache-Control: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: 176.121.14.95 Content-Length: 664 Connection: Keep-Alive
Response Header
Response Peek (128 B)	mOPhba=%93%05%DF%D1%9B%EB%9E%F5%1Dg%C74%5C%DC%EC%BD%27-%7F%A78%E0%0A%29%FE%D1%CCB2K%5B%F2x%0D%8B%18y%A5%0A%D5N%29%18l%5E&NHkDYq=...

/checkupdate(5)

checkupdate(5)

TEXT

0.0 B

05/19/88 17:40:42

Download
SHA256	d70fb081e40637733957275b3feab1bf8847e7d0b4cd0fa084a9487ebb969a14
Referer	http://176.121.14.95/
Magic	Inconclusive. Probably text (TEXT)
Request	POST /checkupdate HTTP/1.1 Accept: / Accept-Language: en-us Referer: http://176.121.14.95/ x-requested-with: XMLHttpRequest Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Cache-Control: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: 176.121.14.95 Content-Length: 1131 Connection: Keep-Alive
Response Header
Response Peek (128 B)	piJvMlpA=%80U%AB%D2%E6%2A7CXG%9B%24%11%5C%85AQ%25%B5%05%F0%8Af%28%97%CB%90%F8%A1%1B%C8%EB%C9%86l%2CU&UoNWRh=%EA%B5%2BO%094%E9XD%...

IP	192.168.1.123
MAC	08:00:27:7e:74:80
USER-AGENT	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)