On http://malware-traffic-analysis.net/2015/01/18/, some http transactions that potentially carry malware are not complete. I can see from first bytes in the body that responses are flash or pdf, but the HTTP response is not complete.
For example, the Session from client 192.168.138.158 51678