CapTipper Report

CapTipper

Analysis Info

PCAP File	Analysis Time	CapTipper Version	Traffic Time
/opt/Malware-Project/Dataset/Botnet-Capture/beingAnalyzedAndPublished/CTU-Malware-Capture-Botnet-25/2014-02-07_capture-win3.pcap	06/01/15 15:22:45	0.2 b10	05/11/72 04:59:33

Flow View

Client Details

IP	10.0.2.103
MAC	08:00:27:3d:00:32
USER-AGENT	Microsoft NCSI

Conversations

www.msftncsi.com (2.16.216.153:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/ncsi.txt

text/plain

ncsi.txt

200 OK

TEXT

14.0 B

05/11/72 04:59:33

www.google.com (173.194.39.148:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

text/html

1.html

302 Found

HTML

258.0 B

02/27/77 16:44:34

Download
SHA256	48945bedf8074af928d9bfddc7e90fad46b079ddd2941e019fec793b01cb5de2
Referer
Magic	HyperText Markup Language (HTML)
Request	GET / HTTP/1.1 Accept: / Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.google.com Connection: Close
Response Header	HTTP/1.1 302 Found Location: http://www.google.cz/?gws_rd=cr&ei=7lrvUoy8EIbHswbkoYC4BA Cache-Control: private Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=10398eebe8a65aa6:FF=0:TM=1391418094:LM=1391418094:S=B_6JXGTd01JdWupq; expires=Wed, 03-Feb-2016 09:01:34 GMT; path=/; domain=.google.com Set-Cookie: NID=67=bwFZNJqF1K_MZ25uaf5N-jBzHhlczyF8ciGkEaQOUc5peNW3y4aqsiDU2GmZaDc8rCohwZo57Xcmf_nOHIOqiW3SmA2gNElWhu1gMXa-6DviX4RwRzNELBC9ZHy2m054; expires=Tue, 05-Aug-2014 09:01:34 GMT; path=/; domain=.google.com; HttpOnly P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Date: Mon, 03 Feb 2014 09:01:34 GMT Server: gws Content-Length: 258 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Alternate-Protocol: 80:quic Connection: close
Response Peek (128 B)	<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Mov...

www.google.cz (173.194.39.152:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/?gws_rd=cr&ei=7lrvUoy8EIbHswbkoYC4BA

text/html

2.html

302 Found

HTML

259.0 B

03/01/77 08:41:33

Download
SHA256	590f00bb12833082a4d66835324485badc49c8d31724528e45849fed8a2d373c
Referer
Magic	HyperText Markup Language (HTML)
Request	GET /?gws_rd=cr&ei=7lrvUoy8EIbHswbkoYC4BA HTTP/1.1 Accept: / Host: www.google.cz Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Connection: Close
Response Header	HTTP/1.1 302 Found Location: https://www.google.cz/?gws_rd=cr&ei=7lrvUoy8EIbHswbkoYC4BA Cache-Control: private Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=bb095e05822cff56:FF=0:TM=1391418094:LM=1391418094:S=6Cu8cKd17CAq9X1_; expires=Wed, 03-Feb-2016 09:01:34 GMT; path=/; domain=.google.cz Set-Cookie: NID=67=D9owfdZyORxowtCX6_7cnbFvnUKvqe84Ankn5OGQcCFAcD1Io3jIj7vKRlduHLdK6hxUgXND78LZf1iJAAae3h92cny6YlMrYLF9MDuKajbwVF3pKcOR7D_fdxv8ygmX; expires=Tue, 05-Aug-2014 09:01:34 GMT; path=/; domain=.google.cz; HttpOnly P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Date: Mon, 03 Feb 2014 09:01:34 GMT Server: gws Content-Length: 259 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Alternate-Protocol: 80:quic Connection: close
Response Peek (128 B)	<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Mov...

/?gws_rd=cr&ei=g2zvUvudGoKFtAbiqIGYBg

text/html

8.html

302 Found

HTML

259.0 B

10/18/19 18:09:14

Download
SHA256	888694c7c05ac4ab24944736714d5d4c812af972df9d18bf666a013599bb5c1e
Referer
Magic	HyperText Markup Language (HTML)
Request	GET /?gws_rd=cr&ei=g2zvUvudGoKFtAbiqIGYBg HTTP/1.1 Accept: / Host: www.google.cz Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Connection: Close
Response Header	HTTP/1.1 302 Found Location: https://www.google.cz/?gws_rd=cr&ei=g2zvUvudGoKFtAbiqIGYBg Cache-Control: private Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=e6d371022888a4f2:FF=0:TM=1391422595:LM=1391422595:S=n6IHm9MaDG6d5bi1; expires=Wed, 03-Feb-2016 10:16:35 GMT; path=/; domain=.google.cz Set-Cookie: NID=67=WozKlgDwpWXHv3UXXvMhkXSU9Krf8vsgqdfRcGG9BP085oHYt_0vrtNAPdDvGfaWSob6eBGsrtjAKc2kh8Oy1meN4r2nb3ig0wkvcCKZTAJzF7LKcTcRb4tFxipdUww2; expires=Tue, 05-Aug-2014 10:16:35 GMT; path=/; domain=.google.cz; HttpOnly P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Date: Mon, 03 Feb 2014 10:16:35 GMT Server: gws Content-Length: 259 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Alternate-Protocol: 80:quic Connection: close
Response Peek (128 B)	<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Mov...

pcqampjtctmbtobzleivojvzr.info (69.195.129.70:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/(2)

text/plain

(2)

200 OK

0.0 B

12/03/00 21:51:37

/(4)

text/plain

(4)

200 OK

0.0 B

05/21/71 07:09:40

bexhlzkjobugdeukxpknztytl.info (166.78.144.80:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/(3)

text/html

(3)

200 OK

0.0 B

11/13/11 02:08:34

/(5)

text/html

(5)

200 OK

0.0 B

04/27/82 00:18:40

www.google.cz (173.194.39.159:80)

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

/?gws_rd=cr&ei=uGPvUvDqCMnTtAbT-YFg

text/html

5.html

302 Found

HTML

257.0 B

06/15/48 15:35:29

Download
SHA256	8c32e3ba234977df221ec18bb0075731b28996c8b30fa5c6a50d92de60e78487
Referer
Magic	HyperText Markup Language (HTML)
Request	GET /?gws_rd=cr&ei=uGPvUvDqCMnTtAbT-YFg HTTP/1.1 Accept: / Host: www.google.cz Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Connection: Close
Response Header	HTTP/1.1 302 Found Location: https://www.google.cz/?gws_rd=cr&ei=uGPvUvDqCMnTtAbT-YFg Cache-Control: private Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=26bd0b907529c448:FF=0:TM=1391420344:LM=1391420344:S=2nGJS5RQtEr54dXg; expires=Wed, 03-Feb-2016 09:39:04 GMT; path=/; domain=.google.cz Set-Cookie: NID=67=EurnkXTYJvj9lBdE4oeuHObSVqGp1ASEr9KnoIYhn7MzHHZeXtVu5taRK6SKDVEP49-odkLVKcK51Ffu-3CjupgG2_t3hPrjLb3XAWL2ICHxTF3e9wwJvVUXsJjNY6sn; expires=Tue, 05-Aug-2014 09:39:04 GMT; path=/; domain=.google.cz; HttpOnly P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Date: Mon, 03 Feb 2014 09:39:04 GMT Server: gws Content-Length: 257 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Alternate-Protocol: 80:quic Connection: close
Response Peek (128 B)	<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Mov...