Expert Malware Analysis and Reverse Engineering

Name: Expert Malware Analysis and Reverse Engineering
Rating: 3.7 (1212 reviews)

Beginner to Expert series on Malware analysis and reverse engineering concepts.

Created byAbhinav singh

Last updated 5/2020

English

What you'll learn

Understand cyber kill chain and how it applies to a malware attack life cycle.
Perform Static as well as dynamic analysis of complex malwares and payloads.
Analyze various file formats like Doc, PDF, Java, Flash etc. to uncover the hidden codes within them.
Understand Assembly language basics and how it can be applied to manually read the reverse engineered codes of malware.
Deep understanding of various tools and techniques involving reverse engineering and static malware analysis.

Course content

4 sections • 36 lectures • 4h 4m total length

Introduction to Expert Malware Analysis and Reverse Engineering1:59
Explore malware analysis and reverse engineering by examining malicious file formats such as PDFs and PowerPoint presentations and reverse engineering binaries to uncover payloads, weaponize, deliver, exploit, persist, exfiltrate, spearphishing.
Detailed Course Overview6:42
Explore the five-step cyber kill chain in malware analysis and reverse engineering, from weaponization and delivery to exploitation, persistence, and exfiltration, aligning with attacker mindset and defense strategies.
System Requirements for the course4:52
Identify hardware and software needs for course, including 2–3 GHz CPUs, 8–16 GB RAM, 100 GB storage, Windows guest OS, VMware or VirtualBox, and tools like IDA Pro and Wireshark.
Setting up your malware testing lab3:52
Set up a separate virtual environment to isolate malware analysis, centralize tools and samples, and prevent host antivirus interference, using Windows 7 or 10 with VMware or VirtualBox.
Setting up the tools in your malware lab3:32
Set up your malware testing lab by installing flare vm from github using powershell on Windows, and assemble pdf, office tools, hex editors, disassemblers, and debuggers.
Introduction to REMnux3:37
Discover Remnux, a linux toolkit for reverse engineering and analyzing malware, packaged as a ready-to-run distro with Docker containers and a handy cheat-sheet.
Introduction to Cyber Kill Chain7:05
Explore cyber kill-chain model and its seven intrusion stages—reconnaissance, weaponization, delivery, exploitation, installation, command and control, and action on objectives—and how defenders apply the 7 D's to detect and respond.

Understanding Recon and Weaponization stages6:45
Examine the reconnaissance and weaponization phases of the cyber kill chain, comparing passive OSINT gathering with active port scanning and fingerprinting, and show how attackers craft weaponized delivery via email.
Spearphishing Emails as Delivery Mechanisms5:52
Explore spearphishing emails as a targeted delivery mechanism in the delivery and exploitation phase, contrasting with generic phishing and highlighting detection via sender details, headers, links, and attachments.
Analyzing Spearphishing emails and its headers7:18
Understanding Sender Policy Framework Protocol for Email Spam detection2:11
Validate that the sending domain is authorized to use the sending IP to detect spoofing and mark emails as spam with the Sender Policy Framework.
Understanding Microsoft Office File Format Structure6:46
Explore Microsoft Office file formats, from OLE compound files to Open XML, and learn how macros and VBA reside in streams and storage, inspecting docx and xlsx as zip archives.
Analyzing Malicious Office File Using Oledump - Part 14:34
Analyze malicious document files with oledump and oletools to reveal embedded macros or scripts in doc, ppt, and xls. View hex representations and prepare a cross-platform malware analysis environment.
Analyzing Malicious Office File Using Oledump - Part 27:29
Analyze malicious office documents with oledump to reveal macro scripts, decode vba, and identify delivery and exploitation phases and the malware payload.
Analyzing malicious OLE Files using Oletools - Part 14:21
Explore oletools for analyzing ole file formats, install on Linux or Windows, and use sub tools like oleid, olemeta, oledir, olemap, and olevba.
Analyzing malicious OLE Files using Oletools - Part 26:11
Analyze malicious ole files with oletools, using oleid to detect format and macros, and olemeta, oledir, and olemap to extract meta data and map internal structure.
Analyzing malicious OLE Files using Oletools - Part 34:14
Learn to analyze malicious ole files with olevba from the oletools suite, extract vba macros, and use mraptor to heuristically assess suspicion and identify indicators of compromise.
Understanding PDF file structure - Part 16:49
Understand the pdf structure—header, body, cross-reference, trailer—and how dictionaries, streams, objects, and scripting elements are parsed by a reader.
Understanding PDF file structure - Part 22:38
Understand the complete pdf file structure, from header and objects to the cross-reference table, trailer, and end of file. Verify parsing with a hex editor to map object locations.
Analyzing Malicious PDF files - Part 15:56
Learn to analyze malicious pdf files using pdfid for static metadata and pdf-parser for dynamic parsing, identifying javascript, open action, xfa, uri, and embedded files.
Analyzing Malicious PDF files - Part 26:07
Use a pdf parser to inspect pdf objects and streams in malicious pdf files. Trace javascript execution and references to launch actions like command.exe and desktop template.pdf.
Analyzing Malicious PDF file using PDF Stream Dumper5:32

Packet capture and analysis - Introduction8:18
Learn how packet capture replicates network traffic to aid malware analysis and incident response, using hardware or software capture, promiscuous mode, and tools like tcpdump and wireshark.
Introduction to Wireshark and packet captures8:53
Learn how Wireshark, a free network packet and protocol analyzer, captures traffic, creates pcaps, and uses color-coded headers and filters to analyze protocols.
Working with Wireshark Display filters8:10
Wireshark Packet capture and filter Demo7:16
Demonstrate using Wireshark to capture live traffic, view DNS and HTTP requests, and apply display filters to analyze TCP handshakes, headers, and IP-based traffic.
Analyzing Exploit kits Through Wireshark - Part 16:55
Explore how exploit kits deliver malware through compromised sites and ads via redirects, enumerate browser plugins, and identify related traffic in pcaps with http filter tips.
Analyzing Exploit kits Through Wireshark - Part 27:58
Analyze exploit kit traffic in Wireshark by filtering http requests and responses from a specific IP, following TCP streams, and identifying html, xml, or flash payloads as the exploit unfolds.
Analyzing Exploit kit traffic in Pcap Demo10:06
Inspect a suspicious pcap with exploit kit traffic in wireshark, applying filters to trace landing pages, iframe injections, and flash exploits, and examine post requests to the command-and-control server.

Understanding the structure of Portable Executable files - Part 111:52
Portable executable files are the executable files for the windows operating system. This file format is the most critical portion of malware analysis as it is the actual executable code which is responsible for performing the infection behaviours and perform command and control operation. In this section, we are going to cover in detail about how we can analyze this file format and reverse engineer it using static and dynamic techniques.
Portable Executable File format analysis - Part 211:39
This lecture talks about advance details about the structure of PE files and how to parse it using common security tools like CFF explorer and 010 editor.
What happens when you run a Program10:14
This lecture tries to answer a simple question > What happens when a file is executed? What operations are performed by the operating system to launch the operation? This lecture tries to briefly answer this question. This is an important concept to understand as it lays the foundational work of understanding the behaviours of malware execution onto the windows operating system.
understanding Compilation process for Reverse Engineering6:51
Understand the compilation process from preprocessing to linking, turning high-level code into an executable by expanding macros, generating assembly, producing machine code, and linking the final exe.
understanding Compilation process for Reverse Engineering - Part 2 (Demo)8:12
Explore how source code compiles to object files and executables via compiler and linker, then how decompilers reverse this process to analyze malware from exe to assembly.
Static malware analysis tools9:00
This lecture covers some of the useful tools for quick static analysis of PE files
Analyzing Ransomware through static analysis tools14:42
Learn to use PPEE and PE Studio to inspect ransomware binaries, determine packed status, extract strings and ransom notes, and assess threats with Virus Total and MITRE techniques.

Requirements

Basics of Assembly language, Computer Applications and introductory idea of how malwares work.

Description

Malware analysis is a critical skill in the information security community. This course is logically designed to help you leap through the complicated steps of static and dynamic malware analysis in an easy and proactive way. After this course, you will be able to understand the core skills required in malware incident response investigations and analysis of Advance persistent threats. The course will guide you trough the basic requirements and necessary skillsets required in order to take your knowledge to the next level.

Some of the key take a-ways from this course are:

Over 4 hours of content purely focused on key skills required for effective analysis of web threats.
Fully interactive and community driven course.
Static and Dynamic malware analysis and its various steps.
File format analysis of standard formats like PDF, Flash, Word, Excel etc.
Understanding the Cyber kill chain and how it applies to malware attack life cycle.
Deep understanding of relevant tools that can help in uncovering complex malware traits.
Basics of Reverse Engineering and how we can analyze advance malware behavior using it.
Incidence response and report generation skills for information security professionals.

You can post your queries and doubts in the course and I will be more than happy to help you in your learning curve.

Who this course is for:

Beginners, security engineers/analyst, malware enthusiasts and advance security researchers.

Expert Malware Analysis and Reverse Engineering

What you'll learn

Explore related topics

Course content

Course Introduction & Overview of Cyber Kill chain7 lectures • 32min

Getting started with analyzing malicious Files15 lectures • 1hr 23min

Network Based analysis and forensics7 lectures • 58min

Prtable Executable File analysis & Reverse Engineering7 lectures • 1hr 13min

Requirements

Description

Who this course is for: