Malware Forensics - Investigating & Analyzing Malicious Code

692 Pages·2008·25.03 MB·English

In Memory of Our Fathers
James A. Aquilina
1940–2003
James Malin
1926–2002
Acknowledgements
James warmly thanks and honors trusted confidants, friends, and co-authors Cameron and Eoghan…what
a ride. For Obi Jolles and my loving family, who always support and cherish me, thank you, I love you,
you all mean the world to me. I am ever humbled by the tremendous talent of my LA staff and appreci-
ate the input of Stroz Friedberg colleagues Steve Kim, Jenny Martin, Beryl Howell, and Paul Luehr on
this project. I am grateful for the enduring loyalty and friendship of Ali Mayorkas, Alicia Villarreal, Jeff
Isaacs, Alka Sagar, and my other friends and colleagues at the U.S. Attorney’s Office in Los Angeles, from
whom I have learned so much. For FBI Cyber Squad Supervisor Ramyar Tabatabian, U.S. Marshal Adam
Torres, and all of the talented federal law enforcement agents I have come to know and work with, keep
fighting the good fight. To Curtis Rose, our dedicated and tireless technical editor, we could not have
pulled this off without you. And for my father, my rock, I miss you terribly.
Eoghan would primarily like to thank Cameron Malin for coming up with the idea for this book
and bringing it to fruition, and James Aquilina for his continued friendship. I am indebted to Cory
Altheide, Harlan Carvey and Aaron Walters for sharing their knowledge, responding to my questions
with such promptness and patience, and providing technical feedback on material in this book. I am
grateful to Curtis Rose for his thorough and insightful technical editing. Many thanks to Andy
Johnston and Thorsten Holz for sharing malware samples used to develop ideas and scenarios for this
book. Thanks also to Seth Leone, Terrance Maguire, Marissa McGann, Steve Mead, Anthony
Pangilinan, Ryan Pittman, Ryan Sommers, Gerasimos Stellatos, and my other friends from Stroz
Friedberg for their support of this project. Finally, my love to Gen and Roisin for enriching my
existence, and enabling the many late nights and weekend work that made this book possible.
Cameron would like to thank the following people for their support on this project: Eoghan and
James—I am grateful for having the opportunity and privilege of working with you both. Thank you
for your dedication and hard work on this project. My deepest gratitude to Curtis Rose for tackling
this Herculean task and making it look easy; your insightful and methodical technical editing is
greatly appreciated. Many thanks to the talented Special Agents of the FBI Cyber program in Los
Angeles and across the FBI for the honor of working and sharing ideas with you. Also, special thanks
to the folks in the FBI who made this project possible. To my mother, father and sister for inspiring
me to always pursue my goals and dreams and to never give up in the face of adversity. Although Dad
is no longer with us, his legacy and lessons are very much alive and well. To my grandmother, who
always stressed the important of education and faith. Finally, to my beautiful soul mate Adrienne; your
patience, support and sacrifice made this book possible. I love you.
iv
Authors
James M. Aquilina is an Executive Managing Director and Deputy General
Counsel of Stroz Friedberg, a technical services and consulting firm specializ-
ing in digital computer forensics; electronic data preservation, analysis, and
production; computer fraud and abuse response; and computer security.
Mr. Aquilina contributes to the management of the firm and the handling of
its legal affairs, in addition to having overall responsibility for the Los Angeles
office. He supervises numerous digital forensic and electronic discovery
assignments for government agencies, major law firms, and corporate manage-
ment and information systems departments in criminal, civil, regulatory and
internal corporate matters, including matters involving e-forgery, wiping, mass
deletion and other forms of spoliation, leaks of confidential information,
computer-enabled theft of trade secrets, and illegal electronic surveillance. He
has served as a neutral expert and has supervised the court-appointed forensic
examination of digital evidence. Mr. Aquilina also has led the development of
the firm’s online fraud and abuse practice, regularly consulting on the technical
and strategic aspects of initiatives to protect computer networks from spyware
and other invasive software, malware and malicious code, online fraud, and
other forms of illicit Internet activity. His deep knowledge of botnets, distrib-
uted denial of service attacks, and other automated cyber-intrusions enables
him to provide companies with advice and solutions to tackle incidents of
computer fraud and abuse and bolster their infrastructure protection.
Prior to joining Stroz Friedberg, Mr. Aquilina was an Assistant U.S.
Attorney in the Criminal Division of the U.S. Attorney’s Office for the
Central District of California, where he most recently served as a Computer
and Telecommunications Coordinator in the Cyber and Intellectual Property
Crimes Section. He also served as a member of the Los Angeles Electronic
Crimes Task Force and as chair of the Computer Intrusion Working
Group, an inter-agency cyber-crime response organization. As an Assistant,
Mr. Aquilina conducted and supervised investigations and prosecutions of
computer intrusions, extortionate denial of service attacks, computer and
Internet fraud, criminal copyright infringement, theft of trade secrets, and

other abuses involving the theft and use of personal identity. Among his
notable cyber cases, Mr. Aquilina brought the first U.S. prosecution of
malicious botnet activity for profit against a prolific member of the “botmaster
underground” who sold his armies of infected computers for the purpose of
launching attacks and spamming, and used his botnets to generate income
from the surreptitious installation of adware; tried to jury conviction the first
criminal copyright infringement case involving the use of digital camcording
equipment; supervised the government’s continuing prosecution of Operation
Cyberslam, an international intrusion investigation involving the use of hired
hackers to launch computer attacks against online business competitors; and
oversaw the collection and analysis of electronic evidence relating to the
prosecution of a local terrorist cell operating in Los Angeles.
During his tenure at the U.S. Attorney’s Office, Mr. Aquilina also served
in the Major Frauds and Terrorism/Organized Crime Sections where he
investigated and tried numerous complex cases, including a major corrup-
tion trial against an IRS Revenue Officer and public accountants; a fraud
prosecution against the French bank Credit Lyonnais in connection with the
rehabilitation and liquidation of the now defunct insurer Executive Life; and
an extortion and kidnapping trial against an Armenian organized crime ring.
In the wake of the September 11, 2001 attacks, Mr. Aquilina helped establish
and run the Legal Section of the FBI’s Emergency Operations Center.
Before public service, Mr. Aquilina was an associate at the law firm
Richards, Spears, Kibbe & Orbe in New York, where he focused on white
collar work in federal and state criminal and regulatory matters.
Mr. Aquilina served as a law clerk to the Honorable Irma E. Gonzalez,
U.S. District Judge, Southern District of California. He received his
B.A. magna cum laude from Georgetown University, and his J.D. from the
University of California, Berkeley, School of Law, where he was a Richard
Erskine Academic Fellow and served as an Articles Editor and Executive
Committee Member of the California Law Review.
He currently serves as an Honorary Council Member on cyber law issues
for the International Council of E-Commerce Consultants (EC-Council),
the organization that provides the CEH (Certified Ethical Hacker) and CHFI
(Certified Hacking Forensic Investigator) certifications to leading security
industry professionals worldwide.
i
Eoghan Casey Eoghan Casey is an Incident Response and Digital
Forensic Analyst, responding to security breaches and analyzing digital
evidence in a wide range of investigations, including network intrusions
with international scope. He has extensive experience using digital forensics
in response to security breaches to determine the origin, nature and extent
of computer intrusions, and has utilized forensic and security techniques to
secure compromised networks. He has performed hundreds of forensic
acquisitions and examinations, including e-mail and file servers, handheld
devices, backup tapes, database systems, and network logs.
Mr. Casey is a leading authority in his areas of expertise and has
written and lectured extensively both in the United States and abroad,
including at conferences sponsored by the Digital Forensics Research
Workshop, High Tech Crime Investigators Association, SEARCH,
SecureIT, and Infragard. He is the author of the widely used textbook
Digital Evidence and Computer Crime: Forensic Science, Computers and
the Internet (Academic Press, 2004). He is also editor of the Handbook
of Computer Crime Investigation, and coauthor of Investigating Child
Exploitation and Pornography. Mr. Casey is editor-in-chief of Elsevier’s
international journal of Digital Investigation, which publishes articles on
digital forensics and incident response on a quarterly basis.
As a Director of Digital Forensics and Investigations at Stroz Friedberg,
he co-managed the firm’s technical operations in the areas of computer
forensics, cyber-crime response, incident handling, and electronic discovery.
In addition, he maintained an active docket of cases himself, testified in
civil and criminal cases, and submitted expert reports and prepared trial
and grand jury exhibits for computer forensic and cyber-crime cases.
Mr. Casey also spearheaded Stroz Friedberg’s external and in-house forensic
training programs as Director of Training.
Before working at Stroz Friedberg, Mr. Casey assisted law enforcement
as a consultant in numerous criminal investigations involving on-line criminal
activity and digital evidence relevant to homicides, child exploitation and
other types of cases. As an Information Security Officer at Yale University,
from 1999 to 2002, and in subsequent consulting work, he has performed
vulnerability assessments, handled critical security breaches and policy
violations, deployed and maintained intrusion detection systems, firewalls
ii
and public key infrastructures, and developed policies, procedures, and
educational programs. Since 1996, Mr. Casey has offered on-line and in-person
training. Mr. Casey’s courses cover digital forensics, incident handling, and
intrusion investigation. Mr. Casey also served, from 1991 to 1995, as a Senior
Research Assistant and Satellite Operator at NASA’s Extreme UV Explorer
Satellite Project, where he wrote computer programs to automate routine
and safety-critical satellite operations procedures and created and maintained
a Sybase SQL database.
Mr. Casey holds a B.S. in Mechanical Engineering from the University
of California at Berkeley, and an M.A. in Educational Communication and
Technology from New York University.
Cameron H. Malin is Special Agent with the Federal Bureau of Investigation
assigned to a Cyber Crime squad in Los Angeles, California, where he is respon-
sible for the investigation of computer intrusion and malicious code matters.
Mr. Malin is a Certified Ethical Hacker (CEH) as designated by the
International Council of Electronic Commerce Consultants (EC-Council), a
Certified Information Systems Security Professional (CISSP), as designated
by the International Information Systems Security Certification Consortium
(“(ISC)2”), a GIAC certified Reverse Engineering Malware Professional
(GREM), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified
Incident Handler (GCIH), and GIAC Certified Forensics Analyst (GCFA),
as designated by the SANS Institute.
Mr. Malin currently sits on the Editorial Board of the International
Journal of Digital Evidence (IJDE) and is a Subject Matter Expert for the
Information Assurance Technology Analysis Center (IATAC).
Prior to working for the FBI, Mr. Malin was an Assistant State Attorney
(ASA) and Special Assistant United States Attorney (SAUSA) in Miami, Florida,
where he specialized in computer crime prosecutions. During his tenure as an
ASA, Mr. Malin was also an Assistant Professorial Lecturer in the Computer
Fraud Investigations Masters Program at George Washington University.
The techniques, tools, methods, views, and opinions explained by Cameron
Malin are personal to him, and do not represent those of the United States
Department of Justice, the Federal Bureau of Investigation, nor the government
of the United States of America. Neither the federal government nor any
federal agency endorses this book or its contents in any way.
iii
Technical Editor
Curtis W. Rose is the Founder and Managing Member of Curtis W. Rose &
Associates LLC, a specialized services company which provides Computer Forensics,
Expert Testimony, Litigation Support, and Computer Intrusion Response and Training
to commercial and government clients. Mr. Rose is an industry-recognized expert in
computer security with over twenty years experience in investigations, computer
forensics, technical and information security.
Mr. Rose was an author of Real Digital Forensics: Computer Security and Incident
Response, and was a contributing author or technical editor for many security books
including, Anti-Hacker Toolkit; Network Security: The Complete Reference; and Incident
Response: Investigating Computer Crime, 2nd Edition. He has also published white
papers on advanced forensic methods and techniques, to include Windows Live
Incident Response Volatile Data Collection: Non-Disruptive User & System Memory
Forensic Acquisition, March 2003.
ix
IInnttrroodduuccttiioonn
Over the past year, the number of programs developed for malicious and illegal purposes has grown
rapidly. The 2008 Symantec Internet Security Threat Report announced that there are over

one million computer viruses in circulation, most developed in the past 12 months.1 Other antivirus
vendors, including F-Secure, report a similarly dramatic increase in the number of viruses emerging

since 2007.2 In the past, malicious code has been categorized neatly (e.g., viruses, worms, or Trojan
Horses) based upon functionality and attack vector. Today, malware is often modular and multi-faceted;
instead of fitting squarely into a certain category, many malware specimens represent more of a
“blended-threat,” with diverse functionality and varied means of propagation.i Much of this malware
has been developed to support increasingly organized, professional computer criminals.
Indeed, criminals are making extensive use of malware to control computers and steal personal,
confidential, or otherwise proprietary information for profit. A widespread attack in April 2008

exploited a new SQL injection vulnerability to insert a script “nihaorr1.com/1.js” into the database.3
When individuals accessed an infected Web site, the “1.js” script redirected their browsers to www.
nihaorr1.com and attempted to install a password stealing program via various known vulnerabili-
ties in Web browsers.
Furthermore, foreign governments are funding teams of highly skilled hackers to develop customized
malware to support industrial and military espionage.4
The increasing use of malware to commit and conceal crimes is compelling more digital investigators
to make use of malware analysis techniques and tools that were previously the domain of antivirus
vendors and security researchers.
1 See http://news.bbc.co.uk/2/hi/technology/7340315.stm.
2 See http://news.zdnet.com/2100-1009_22-6222896.html.
3 See http://gopaultech.com/blog/2008/04/nihaorr1-sql-injection-attack/.; http://robnewby.blogspot.com/2008/04/
nihaorr1-attack-explained.html; http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080424
4 See “The New E-spionage Threat,” available at http://www.businessweek.com/magazine/content/08_16/b4080032218430.htm ;
“China accused of hacking into heart of Merkel administration,”av ailable at http://www.timesonline.co.uk/tol/news/world/europe/
article2332130.ece.
xxiii
xxiv Introduction
This book is designed to help digital investigators identify malware on a computer system, pull
malware apart to uncover its functionality and purpose, and determine the havoc malware wreaked
on a subject system. Practical case scenarios are used throughout the text to demonstrate techniques
and associated tools. Furthermore, to bring malware analysis into the realm of forensic discipline, this
book provides methodologies and discusses legal considerations that will enable digital investigators to
perform their work in a reliable, repeatable, defensible, and thoroughly documented manner.
Investigative And
Forensic Methodologies
When malware is discovered on a system, there are many decisions that must be made and actions
that must be taken, often under severe time pressure. To help digital investigators achieve a successful
outcome, this book provides an overall methodology for dealing with such incidents, breaking
investigations involving malware into five phases:
■ Phase 1: Forensic preservation and examination of volatile data (Chapters 1 and 2)
■ Phase 2: Examination of memory (Chapter 3)
■ Phase 3: Forensic Analysis: Examination of hard drives (Chapters 4 and 5)
■ Phase 4: Static analysis of malware (Chapters 7 and 8)
■ Phase 5: Dynamic analysis of malware (Chapters 9 and 10)
Within each of these phases, formalized methodologies and goals are emphasized to help digital
investigators reconstruct a vivid picture of events surrounding a malware infection and gain a detailed
understanding of the malware itself. However, the methodologies outlined in this book are not
intended as a check list to be followed blindly. Digital investigators must always apply critical thinking
to what they are observing, and interviewing the system owners and users often helps develop a more
complete picture of what occurred.
Furthermore, additional steps may be called for in some cases, depending on the context and
available data sources. When backup tapes of the compromised system are available, it might be
fruitful to compare them with the current state of the system and to assist in the recovery of the
system. Some organizations routinely collect information that can be useful to the investigation,
including centralized logs from antivirus agents, reports from system integrity checking tools like
Tripwire, and network level logs.
Whenever feasible, investigations involving malware should extend beyond a single compromised
computer, as malicious code is often placed on the computer via the network, and most modern
malware has network-related functionality. Discovering other sources of evidence, such as servers the
malware contacts to download components or instructions, can provide useful information about
how malware got on the computer and what it did once it was installed.
Network forensics can play a key role in malware incidents, but this extensive topic is beyond
the scope of this book. One of the author’s earlier works5 covers tools and techniques for collecting
5 Eoghan Casey, Digital Evidence and Computer Crime (Second Edition, 2004).
www.syngress.com
Introduction xxv
and utilizing various sources of evidence on a network that can be useful when investigating a
malware incident, including intrusion detection systems, NetFlow logs, and network traffic.
These logs can show use of specific exploits, malware connecting to external IP addresses, and the
names of files being stolen. Although potentially not available prior to discovery of a problem, logs
from network resources implemented during the investigation may capture meaningful evidence of
ongoing activities.
Finally, as digital investigators more and more are asked to conduct malware analysis for
investigative purposes that may lead to the victim’s pursuit of a civil or criminal remedy, ensuring
the reliability and validity of findings means compliance with an oft complicated legal and
regulatory landscape. Chapter 6, although not a substitute for obtaining counsel and sound legal
advice, explores legal and regulatory concerns, and discusses some of the requirements or limitations
that may govern the access, preservation, collection and movement of data and digital artifacts
uncovered during malware forensic investigations.
Forensic Soundness
The act of collecting data from a live system causes changes that a digital investigator will need to
explain with regards to their impact on the digital evidence. For instance, running tools like Helix
from a removable media device will alter volatile data when it is loaded into main memory, and will
generally create or modify files and Registry entries on the evidentiary system. Similarly, using
remote forensic tools necessarily establishes a network connection, executes instructions in memory,
and makes other alterations on the evidentiary system.
Purists argue that forensic acquisitions should not alter the original evidence source in any
way. However, traditional forensic disciplines such as DNA analysis show that the measure of forensic
soundness does not require the original to be left unaltered. When samples of biological material
are collected, the process generally scrapes or smears the original evidence. Forensic analysis of the
evidentiary sample alters the sample even more because DNA tests are destructive. Despite the
changes that occur during preservation and processing, these methods are considered forensically
sound and DNA evidence is regularly admitted as evidence.
Setting an absolute standard that dictates “preserve everything but change nothing” is not only
inconsistent with other forensic disciplines but dangerous in a legal context. Conforming to such a
standard may be impossible in some circumstances and, therefore, postulating this standard as the “best
practice” only opens digital evidence to criticisms that have no bearing on the issues under investiga-
tion. In fact, courts are starting to compel preservation of volatile computer data in some cases,
requiring digital investigators to preserve data on live systems. In Columbia Pictures Indus. v. Bunnell,6
for example, the court held that RAM on a Web server could contain relevant log data and was
therefore within the scope of discoverable information in the case.
One of the keys to forensic soundness is documentation. A solid case is built on supporting
documentation that reports where the evidence originated and how it was handled. From a forensic
standpoint, the acquisition process should change the original evidence as little as possible, and any
changes should be documented and assessed in the context of the final analytical results. Provided the
acquisition process preserves a complete and accurate representation of the original data, and its
authenticity and integrity can be validated, the analysis is generally considered forensically sound.
6 2007 U.S. Dist. LEXIS 46364 (C.D. Cal. June 19, 2007).
www.syngress.com