Email and Malware Fundamentals

What it is

Email and malware are two of the most common sources of evidence. Email shows who communicated, when and from where, and its headers can reveal the real path of a message. Malware is the tool of many attacks, and investigators must know what it is made of and how it spreads.

How it works

Components involved in email communication

Protocols: SMTP sends and relays mail (port 25 between servers, 587 for client submission). POP3 (port 110) downloads mail to the client. IMAP (port 143) keeps mail on the server and lets clients synchronize.

How email communication works

1. The user writes a message in the MUA and sends it to the outgoing server by SMTP.
2. The outgoing MTA looks up the MX record of the recipient's domain.
3. The message is relayed, possibly through several MTAs, to the recipient's server.
4. The MDA stores it in the recipient's mailbox.
5. The recipient's MUA retrieves it by POP3 or IMAP, or through a web interface.

Each server that handles the message adds a line to its header, which is why the header is the main source of forensic evidence.

Parts of an email message

A message has a header and a body, plus attachments.

SPF checks whether the sending server is allowed for the domain. DKIM verifies a digital signature on the message. DMARC sets the policy based on those two. A failed check on a message that claims to come from a bank is a sign of possible spoofing, although forwarding can also break SPF.

Malware and its components

Malware is software designed to harm, steal, spy or gain unauthorized control. Its common components are:

• Payload: the harmful action.
• Dropper and downloader: a dropper carries the malware inside it, while a downloader fetches it from a remote server.
• Crypter and packer: hide the code from detection.
• Exploit: code that takes advantage of a vulnerability.
• Obfuscation: makes code hard to read.
• Command and control (C2): channel used to control the infected host.
• Persistence mechanism: keeps the malware after a reboot.

Common techniques used to distribute malware across the web

• Malicious email attachments and links (phishing).
• Drive by downloads from compromised or malicious sites.
• Malvertising, which places malicious advertisements on legitimate sites.
• Search engine poisoning, which pushes malicious pages up the results.
• Fake software updates and cracked software.
• Social media links and fake apps.
• Infected removable media and supply chain compromise.

Types of malware and their characteristics

Coordination and management in addressing malware

Dealing with malware needs a plan and teamwork: detection, isolating infected hosts, collecting evidence (memory and samples) before cleaning, analysis, removal, recovery and communication. Roles are shared among the SOC, incident responders, IT operations, legal and management. Indicators found in one case are shared with the team and, when appropriate, with outside partners so that other systems are checked.

A worked example

A recipient gets a message that shows "From: accounts@bank.example". The header shows a Return-Path at a different domain, a Received line from an unrelated server at the bottom, and an Authentication-Results line with SPF fail.

The message is very likely spoofed. The investigator preserves the original message in its native format with full headers, traces the first Received line and records the attached file hash for malware analysis.

How the exam asks about this

• "In which direction should the Received headers be read to trace the origin?" → From the bottom up.
• "Which agent places incoming mail into the user's mailbox?" → The mail delivery agent.
• "Which malware spreads by itself without a host file?" → A worm.