Windows malware: traces in the host

In the present world of information and interconnection, malware is a latent threat. Just speaking of “ill-intended software” gives a too broad definition: malware has evolved and taken different forms through the years. It is necessary to know and understand the traces that remain in a computer system after an infection. For years the information security community has focused on live analysis and response against these threats, so there is a huge opportunity to adapt and make post-mortem, host-based signatures. In this work, some features that may work as malware signatures for digital forensics experts are proposed.