Table Of ContentMalware Forensics Field
Guide for Windows Systems
Digital Forensics Field Guides
Cameron H. Malin
Eoghan Casey
James M. Aquilina
Curtis W. Rose
Technical Editor
Acquiring Editor: Cris Katsaropoulos
Project Manager: Paul Gottehrer
Designer: Alisa Andreola
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
© 2012 Elsevier, Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by
any means, electronic or mechanical, including photocopying, recording, or any
information storage and retrieval system, without permission in writing from the
publisher. Details on how to seek permission, further information about the
Publisher’s permissions policies and our arrangements with organizations such as
the Copyright Clearance Center and the Copyright Licensing Agency, can be
found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under
copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new
research and experience broaden our understanding, changes in research methods
or professional practices, may become necessary. Practitioners and researchers
must always rely on their own experience and knowledge in evaluating and using
any information or methods described herein. In using such information or
methods they should be mindful of their own safety and the safety of others,
including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors,
contributors, or editors, assume any liability for any injury and/or damage to
contributors, or editors, assume any liability for any injury and/or damage to
persons or property as a matter of products liability, negligence or otherwise, or
from any use or operation of any methods, products, instructions, or ideas
contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Application submitted
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
ISBN: 978-1-59749-472-4
For information on all Syngress publications visit our website at
http://store.elsevier.com
Printed in the United States of America
12 13 14 15 16 10 9 8 7 6 5 4 3 2 1
Typeset by: diacriTech, Chennai, India
For our moms, who taught us determination, patience,
creativity, and to live passionately.
Acknowledgments
Cameron would like to thank a number of people for their
guidance, support, and ideas on this book—without them it
would not have happened. James and Eoghan I appreciate your
willingness to keep an open mind and embrace the format and
structure of this book; it was a rewarding challenge. I’m proud to
work with you both.
Thanks to the Syngress crew for your patience and
understanding of our vision: Steve Elliot, Angelina Ward, Laura
Colantoni, Matthew Cater, Paul Gottehrer, Chris
Katsaropoulos, and David Bevans.
Not to be forgotten are the some terrific researchers,
developers, and forensic practitioners who assisted and
supported this book: Mila Parkour
(contagiodump.blogspot.com), Ero Carera and Christian
Blichmann (Zynamics), Matthew Shannon (F-Response), Maria
Lucas (HBGary), Thorsten Holz (Assistant Professor at Ruhr-
University Bochum; http://honeyblog.org/), Tark (ccso.com), and
Danny Quist (offensivecomputing.net).
For your friendship, camaraderie, and day-to-day hi-jinks,
For your friendship, camaraderie, and day-to-day hi-jinks,
“Team Cyber” of the Los Angeles Cyber Division—you are a
fantastic crew and I miss you. Jason, Ramyar, and Bryan—my
friends and confidants—thank you for everything, we had a good
run.
My sister Alecia—your determination and focus are an
inspiration to me. “No lying on the couch!”
Finally, to my lovely wife Adrienne, I am so lucky to have
you in my life—thanks for being a “team” with me—I love you.
Bentley and Barkley—thanks for being Daddy’s little “writing
buddies.”
Special Thanks to the Technical
Editor
Malware Forensics Field Guide for Windows Systems was
reviewed by a digital forensic expert who is a fantastic author in
his own right. My sincerest thanks to Curtis W. Rose for your
tenacity and attention to detail—we’re lucky to work with you.
About the Authors
Cameron H. Malin is a Supervisory Special Agent with the
Federal Bureau of Investigation assigned to a Cyber Crime
squad in Los Angeles, California, where he is responsible for the
investigation of computer intrusion and malicious code matters.
In 2010, Mr. Malin was a recipient of the Attorney General’s
Award for Distinguished Service for his role as a Case Agent in
Operation Phish Phry.
Mr. Malin is the Chapter L ead for the Southern California
Chapter of the Honeynet Project, an international non-profit
organization dedicated to improving the security of the Internet
through research, analysis, and information regarding computer
and network security threats. Mr. Malin currently sits on the
Editorial Board of the International Journal of Digital
Evidence (IJDE) and is a Subject Matter Expert for the
Information Assurance Technology Analysis Center (IATAC)
and Weapon Systems Technology and Information Analysis
Center (WSTIAC).
Mr. Malin is a Certified Ethical Hacker (C|EH) and
Certified Network Defense Architect (C|NDA) as designated by
Certified Network Defense Architect (C|NDA) as designated by
the International Council of Electronic Commerce Consultants
(EC-Council) and a Certified Information Systems Security
Professional (CISSP), as designated by the International
Information Systems Security Certification Consortium
2®
((ISC) ).
Prior to working for the FBI, Mr. Malin was an Assistant
State Attorney (ASA) and Special Assistant United States
Attorney (SAUSA) in Miami, Florida, where he specialized in
computer crime prosecutions. During his tenure as an ASA, Mr.
Malin was also an Assistant Professorial Lecturer in the
Computer Fraud Investigations Masters Program at George
Washington University.
The techniques, tools, methods, views, and opinions
explained by Cameron Malin are personal to him, and do not
represent those of the United States Department of Justice, the
Federal Bureau of Investigation, or the government of the United
States of America. Neither the Federal government nor any
Federal agency endorses this book or its contents in any way.
Eoghan Casey is founding partner of cmdLabs, author of
the foundational book Digital Evidence and Computer Crime,
and coauthor of Malware Forensics: Investigating and
Analyzing Malicious Code. For over a decade he has
dedicated himself to advancing the practice of incident handling
and digital forensics. He helps client organizations handle security
breaches and analyzes digital evidence in a wide range of
investigations, including network intrusions with international
scope. He works at the Department of Defense Cyber Crime
