Malware memory analysis for non-specialists : investigating publicly available memory images for Prolaco and SpyEye / by R. Carbone. : D68-6/155-2013E-PDF

This technical memorandum examines how an investigator can analyse an infected Windows memory dump. The author investigates how to carry out such an analysis using Volatility and other investigative tools, including data carving utilities and anti-virus scanners. Volatility is a popular and evolving open source-based memory analysis framework upon which the author has proposed a memory-specific methodology for aiding fellow novice memory analysts. The author examines how Volatility can be used to find evidence and indicators of infection. This technical memorandum is the second in a series concerning Windows malware-based memory analysis. This current work examines two memory images infected with Prolaco and SpyEye, respectively.

Lien permanent pour cette publication :
publications.gc.ca/pub?id=9.821332&sl=1

Renseignements sur la publication
Ministère/Organisme Canada. Defence R&D Canada.
Titre Malware memory analysis for non-specialists : investigating publicly available memory images for Prolaco and SpyEye / by R. Carbone.
Titre de la série Technical Memorandum ; 2013-155
Type de publication Série - Voir l'enregistrement principal
Langue [Anglais]
Format Électronique
Document électronique
Note(s) "October 2013."
Includes bibliographical references.
Information sur la publication [Ottawa] : Defence Research and Development Canada, c2013.
Auteur / Contributeur Carbone, Richard.
Description xiv, 102 p. : tables, graphs.
Numéro de catalogue
  • D68-6/155-2013E-PDF
Descripteurs Technical reports
Antivirus
Malware
Virus scanner
Demander des formats alternatifs
Pour demander une publication dans un format alternatif, remplissez le formulaire électronique des publications du gouvernement du Canada. Utilisez le champ du formulaire «question ou commentaire» pour spécifier la publication demandée.
Date de modification :