Windows Forensics and Incident Recovery

File Binding

File binding is a method of binding one executable file to another, without affecting how either program performs. Executable binders are utilities that can bind two executables together in such a manner that both are launched when the primary file is launched. Such tools have been popularized with the release of network backdoor Trojans such as Back Orifice^[13]. One such tool is EliteWrap^[14]. EliteWrap is a CLI utility that allows the user to specify files to be packed and launched visibly or invisibly. The archive containing the EliteWrap executable includes a readme.txt file with explicit instructions and a test script file that can be easily modified for use. For example, the test script can be modified to bind Notepad and Solitaire ...