Malware Presence Confirmation

PCAP traffic Analysis

Introduction

In today’s digital world, cyber threats such as malware have become increasingly sophisticated and difficult to detect. Malware often operates silently within a system, communicating with external servers and performing malicious activities without the user’s knowledge. Detecting such threats requires careful analysis of network traffic and communication patterns.

This blog focuses on identifying malware presence using PCAP traffic analysis. By analyzing captured packets using Wireshark, suspicious communication patterns and malicious behaviors are detected effectively.

Through this structured analysis, multiple indicators of malicious activity are identified, including encoded data transmission, repeated DNS queries, and automated communication patterns. These findings collectively confirm the presence of malware within the captured network traffic.

Objectives

• Understanding the structure and contents of network packets within a PCAP file
• Identifying abnormal communication patterns such as repeated requests, unusual domains, and unexpected protocols
• Detecting potential command-and-control (C2) communication between an infected host and external servers
• Analyzing protocol behavior including HTTP, DNS, TCP, and UDP interactions
• Extracting indicators of compromise (IoCs) such as suspicious IP addresses and domains

PCAP Source

https://www.malware-traffic-analysis.net/2025/06/13/2025-06-13-traffic-analysis-exercise.pcap.zip

🔐 Note: This PCAP file is password protected.
Password: infected_20250613

Architecture

Procedure

Step 1: Download the PCAP file

Step 2: Open the pcap in Wireshark

Step 3: Apply filters to look for suspicious traffic

Step 4: Look for domains that appear near Cloudfare.com

Step 5: Pivot on Suspicious domain on urlscan.io and check if it is there in pcap

Step 6: Track down victim host and use chrome cache view to confirm traffic

Inferences (Proof of Malware Presence)

1. Suspicious DNS queries to unknown domains

Multiple DNS queries were observed targeting uncommon and non-human readable domains. These domains do not match typical browsing behavior. Such patterns indicate possible malware attempting to contact command-and-control servers.

2. Repeated communication with a single external IP

The infected system repeatedly communicated with a specific external IP address. This behavior suggests beaconing activity. It is commonly seen in malware maintaining persistent connection with attacker servers.

3. High frequency DNS requests in short intervals

A burst of DNS queries was detected within a very short time span. This is unusual for normal users. It indicates automated scripts or malware generating traffic.

4. Presence of suspicious HTTP requests

HTTP requests contained unusual URLs and parameters. These requests did not resemble standard browsing activity. Such behavior often indicates data exfiltration or malware callbacks.

5. Suspicious HTTP POST request with binary payload

A HTTP POST request was observed with the content type set to application/octet-stream, indicating transmission of raw binary data. This type of communication is not typical in normal browsing and is commonly associated with malware activity.

The request URI appears random and lacks meaningful structure, suggesting obfuscation techniques used by malicious programs. Such behavior is often seen in command-and-control (C2) communication to evade detection.

Additionally, the large content length indicates possible data exfiltration or payload transfer. This strongly supports the presence of malware within the captured network traffic.

6. TCP stream shows encoded or obfuscated data

The TCP stream revealed unreadable or encoded payloads. This indicates encryption or obfuscation. Malware commonly hides communication content this way.

7. Asymmetric traffic pattern indicating possible data exfiltration

The traffic shows a significant imbalance between outgoing and incoming data. The system appears to send more data than it receives.

Normal browsing behavior usually involves downloading more data than uploading. This reversed pattern suggests potential data exfiltration.

Such asymmetry is a strong indicator of malicious data transmission from the infected system.

8. Repeated failed connection attempts

Several connection attempts failed repeatedly. This indicates the system trying to reach unavailable servers. It is typical of malware trying multiple C2 servers.

9. DNS responses with multiple IP mappings

Some domains resolved to multiple IP addresses. This behavior is often associated with fast-flux networks. Malware uses this technique to avoid blocking.

10. Sudden spikes in network traffic (IO Graph)

The IO graph displayed sharp spikes in traffic volume. This indicates bursts of activity. Such spikes are typical during malware communication or data transfer.

11. Presence of suspicious domain patterns

Domains appeared random or algorithmically generated. These are known as DGA (Domain Generation Algorithm) domains. Malware uses them to dynamically connect to servers.

12. Absence of user-triggered events in network activity

The network traffic does not show any correlation with user-driven actions such as browsing or file downloads. Instead, communication appears continuous and independent of user activity.

This indicates that the traffic is generated by background processes rather than direct user interaction.

Such behavior is characteristic of malware operating silently within the system.

13. Frequent small packets indicating beaconing

Small packets were sent at regular intervals. This is characteristic of beaconing behavior. Malware uses this to check connectivity with servers.

14. Unusual session durations

Some sessions were extremely short or excessively long. This inconsistency is abnormal. It suggests automated processes rather than human activity.

15. Suspicious TLS/SSL handshake patterns

Encrypted sessions showed irregular handshake patterns. This indicates non-standard implementations. Malware often uses custom encryption methods.

16. Communication with known malicious IP ranges

Some IPs matched suspicious or unknown geographic regions. These are often flagged in threat intelligence. Malware typically communicates with such servers.

17. DNS tunneling behavior suspected

DNS queries contained unusually long strings. This may indicate tunneling. Malware uses DNS to bypass firewall restrictions.

18. Inconsistent protocol usage observed through DCERPC traffic

Upon applying a TCP filter, the traffic revealed the presence of DCERPC (Distributed Computing Environment / Remote Procedure Call) protocol. This is unusual, as typical user-generated traffic primarily involves HTTP, HTTPS, or DNS protocols.

DCERPC is generally associated with Windows internal services such as remote procedure calls and Active Directory operations, and is not commonly observed in standard browsing scenarios.

The presence of such protocol activity in this context indicates non-standard communication behavior, possibly suggesting system-level interactions or lateral movement attempts, which are commonly associated with malware activity.

19. Multiple connections to same domain in quick succession

The system repeatedly contacted the same domain rapidly. This suggests automated scripts. It is typical in malware communication loops.

20. Repeated DNS queries observed over UDP communication

The UDP stream reveals repeated DNS queries for the domain www.truglomedspa.com. The same query appears multiple times within a short interval, indicating a lack of caching behavior.

In normal systems, DNS responses are cached to avoid repeated queries. The absence of caching suggests that the traffic is generated by an automated process rather than a human user.

Such repetitive DNS communication is a common indicator of malware activity, particularly in cases involving beaconing or command-and-control communication.

Effects of Malware

Data theft

Malware can secretly access sensitive information such as passwords, personal files, and system data. This data is then transmitted to remote attackers without user consent. It leads to serious privacy and security risks. Users may lose control over their confidential information.

System slowdown

Malware often runs hidden processes in the background that consume CPU and memory resources. This reduces overall system performance and makes the device slow and unresponsive. Even basic tasks may take longer to execute. In severe cases, the system may frequently freeze or crash.

Unauthorized access

Some malware creates backdoors in the system, allowing attackers to gain remote access. This means the attacker can control the system without the user’s permission. It can lead to installation of more malicious tools. The system becomes completely compromised.

Network congestion

Malware may generate continuous or abnormal network traffic in the background. This increases bandwidth usage and causes network slowdown. It can affect other devices connected to the same network. Legitimate network services may become unstable.

Spread to other devices

Some malware is self-replicating and can spread across connected systems. It may use shared networks, USB devices, or vulnerabilities to infect other machines. This leads to wider infection across an organization. Containment becomes more difficult over time.

New Findings

1. Detection of Domain Generation Algorithm (DGA) behavior

Certain domains appeared randomly generated and lacked meaningful structure. This indicates the use of DGA by malware to evade detection. Such domains are dynamically generated and frequently changed.

2. Evidence of stealthy beaconing intervals

The time gap between repeated requests followed a consistent pattern. This suggests controlled beaconing behavior. It indicates that the malware is programmed to communicate periodically with its server.

3. Possible encrypted payload delivery

Analysis of TCP streams revealed encoded or encrypted data segments. This suggests payload delivery or command exchange. Malware commonly uses encryption to avoid detection.

4. Identification of potential fallback servers

Multiple domains and IPs were contacted sequentially. This indicates fallback mechanisms in case primary servers fail. Such redundancy is a strong indicator of advanced malware design.

The Use of AI Tools

Understanding Concepts Faster

I used AI tools to quickly understand complex topics related to malware analysis and network traffic. It helped me break down difficult concepts into simple explanations, saving a lot of time during research.

Generating Structured Content

AI assisted me in organizing my blog into proper sections such as introduction, effects, and analysis. It helped maintain a clear flow and professional structure throughout the report.

Improving Technical Writing

AI helped refine my technical writing by improving grammar, clarity, and sentence formation. It made my content more readable and suitable for academic submission.

Assistance in Wireshark Analysis

AI guided me in understanding how to filter and analyze PCAP files in Wireshark. It helped identify suspicious patterns like unusual UDP traffic and external IP communication.

Debugging and Code Support

AI was used to fix HTML/CSS issues in my blog structure. It helped ensure proper layout alignment, styling consistency, and responsive design improvements.

Enhancing Presentation Quality

AI helped me improve the overall presentation of my project by suggesting better formatting, headings, and visualization ideas for screenshots and explanations.

Time Efficiency

By using AI tools, I was able to complete research, documentation, and formatting in significantly less time. This allowed me to focus more on analysis rather than manual writing work.

Conclusion

The analysis of the captured PCAP file using Wireshark clearly indicates the presence of suspicious and abnormal network activities that are consistent with malware behavior. Through detailed inspection of packet flows, it was observed that the infected system was communicating with external and unknown IP addresses using unusual traffic patterns, especially over UDP protocol.

These findings suggest possible malicious actions such as data exfiltration, unauthorized communication, and background command-and-control (C2) activity. The continuous and irregular packet exchanges highlight that the system is not operating under normal conditions and may be compromised by malware.

Furthermore, the analysis demonstrates how malware can remain hidden within network traffic while still affecting system performance, security, and privacy. It also shows the importance of using tools like Wireshark for packet-level inspection to detect threats that may not be visible through traditional system monitoring methods.

In conclusion, this study successfully identifies potential malware infection patterns through network traffic analysis. It emphasizes the critical need for continuous network monitoring and proper cybersecurity practices to prevent such threats in real-world environments.

References & Links

YouTube Video

My project demonstration / explanation video:

Watch YouTube Video

GitHub Repository

Source code and project files:

View GitHub Repository

Malware Traffic Analysis Reference

PCAP dataset and malware traffic study reference used for analysis:

View Malware Traffic Analysis Dataset

Acknowledgement

I would like to express my sincere gratitude to the School of Computer Science and Engineering (SCOPE), Vellore Institute of Technology, Chennai, for offering comprehensive theory and laboratory courses in Computer Networks during the Winter Semester 2025–2026, designed in alignment with industry standards.

I am especially thankful to my faculty member, Dr. T. Subbulakshmi, for providing me with the opportunity to work on this data analysis assignment and for her invaluable guidance and support throughout the course. This project has greatly contributed to enhancing my practical understanding of network protocols, cybersecurity concepts, and real-world malware behavior.

I would also like to acknowledge Gerald Combs, recipient of the ACM Software System Award (2018), for developing Wireshark, an exceptional tool that played a crucial role in network traffic analysis. My appreciation also extends to Bradley Duncan for his insightful blogs on malware analysis, which served as valuable learning resources and guidance for this project.

I am grateful to my peers for their constructive suggestions and engaging discussions, as well as to my friends for their support during the completion of this assignment. I would also like to extend my heartfelt thanks to my family for their constant encouragement and unwavering support.

Finally, I acknowledge the use of AI-assisted tools, which contributed to structuring the analysis effectively and improving clarity in interpreting complex network data.

Contributor Details

Author

Mr. Lavish Jha
II Year B.Tech. CSE Student
School of Computer Science and Engineering (SCOPE)
Vellore Institute of Technology, Chennai

Date Published:

12 April 2026