\documentclass[a4paper]{article}
\usepackage[latin9]{inputenc}
\usepackage{array}
\usepackage{url}
\usepackage{amstext}
\usepackage{graphicx}
\usepackage{amssymb}

\begin{document}

\title{Malware Capture Facility. Scenario CTU-Malware-Capture-Botnet-73}
\author{Sebastian Garcia. sebastian.garcia@agents.fel.cvut.cz}

\maketitle

\part*{General Information about the scenario}
\paragraph*{Infected Machines:}
\begin{itemize}
    \item Windows XP Name: WIN1, IP: (Label: Botnet-V1 in the files)
\end{itemize}

\paragraph*{Binary Used:}
 Infected by accessing the web site www.magnetikum.cz

\paragraph*{MD5:}
None

\paragraph*{Probable Name:}
Unknown

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\part*{Files}
Details about the files used in this scenario.



%%%%%%%%%%%%%%
\section{Pcap file: 2014-05-16\_capture-win15.pcap}

\subsection{Generic Info}
\begin{itemize}
    \item Number of packets:   5283 
    \item File size:           1107 kB
    \item Data size:           1023 kB
    \item Capture duration:    84211 seconds
    \item Start time:          Thu May 15 10:24:02 CEST 2014
    \item End time:            Fri May 16 09:48:48 CEST 2014
    \item Data byte rate:      12 bytes/s
    \item Data bit rate:       97 bits/s
    \item Average packet size: 193.70 bytes
    \item Average packet rate: 0 packets/sec
    \item Bidirectional flow size: 43KB 
    \item Amount of flows: 424 
\end{itemize}

\subsection{Related Files}
\begin{itemize}
    \item file.netflow.labeled
    \item file.png

    This file is a plot of the mayor features of this traffic during his whole life time.
    \item file.rrd

    This file is an RRD file containing all the mayor features of the traffic so you can plot it or analyze it.
    \item file.weblog

        This file contains the web logs of the capture extracted by the command:
    \item file.weblogng

        These are the web logs, but each field is separated by a |.
\end{itemize}


\subsection{Weblogs}
Description of the weblogs


\subsection{Graphs of the traffic with RRD}
\includegraphics[scale=0.1]{2014-05-16_capture-win15.png}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\part*{Timeline}
\emph{Thu May 15 10:24:02 CEST 2014}
win15 started


\emph{Thu May 15 10:27:50 CEST 2014}
infected with www.magnetikum.cz

It did not rebooted! and it access completely diferent websites!


\emph{Fri May 16 09:48:48 CEST 2014}
poweroff because it was doing nothing!

File 2014-05-16\_capture-win15.pcap


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\part*{Traffic Analysis}



\part*{Disclaimer}
These files were generated as part of the Malware Capture Facility Project in the CTU University, Prague, Czech Republic. The  goal of the project is to store long-lived real botnet traffic and to generate labeled netflows files. Any question feel free to contact us to sebastian.garcia@agents.fel.cvut.cz.

\textbf{You are free to use these files as long as you reference this project and the authors. See \url{http://mcfp.felk.cvut.cz}}

\end{document}



