
Learn to analyze malware, source samples, perform static and dynamic analysis, and explore reverse engineering and creating your own malware for hands-on skills.
Download the strings tool from Microsoft, review its documentation, download the strings binary, and unzip the file to begin malware analysis.
Download PE Studio by locating it via a Google search, opening the first result, navigating to binaries, downloading the PE Studio zip, and extracting the file.
Learn how to download Process Monitor from Microsoft via the first Microsoft link, review the documentation, and unzip the downloaded zip file for malware analysis.
This lecture introduces the concept of a fake DNS server for malware analysis and demonstrates obtaining and handling a simulated network component.
Learn to download ida from the official site, choose the freeware or demo version, pick the correct Windows, Linux, or Mac binary, and complete the setup.
This lecture surveys sources for malware samples, including dasmywork.eu, the zoo, Virus Total, and virus share, and outlines access to download for analysis.
Perform static malware analysis by examining strings, Windows API calls, and the PE header. Use VirusTotal, hash checks, and URL or IP indicators to flag threats without running the sample.
Virus total is a Google-run web service that analyzes uploaded malware, allows searching by hash, and provides details on imports, sections, signatures, and network communication to guide analysis.
Learn how the strings tool extracts ASCII strings from a binary to reveal clues about malware, including Windows API calls, hard-coded paths, and potential key logging behavior.
PEstudio guides static malware analysis on binaries, using VirusTotal data and Windows API calls. Identify indicators such as packed sections, registry edits, clipboard activity, and HTTP communications.
Master dynamic malware analysis by running malware to observe behavior, monitor processes, registry and file system changes, use automated sandboxes, and analyze network traffic and memory dumps with Volatility.
Use process monitor to analyze a binary, observe runtime actions, filter by process name, include or exclude entries, and monitor registry and file operations for startup persistence.
Take a registry snapshot before you run malware, then take a second snapshot and compare them to detect changes in registry hives, run keys, and persistence.
Analyze how a fake DNS server captures malware destinations by running a fake DNS binary and observing the domains it contacts; identify them with VirusTotal and consider blacklisting.
Explore reverse engineering a basic key logger by mapping virtual key codes in a Windows API function, iterating keys with while and for loops, and understanding code flow via IDA.
Malware is everywhere and the industry is desperate for people who can track the hackers. In this course, you will learn about the various types and categories of malware, their symptoms, and how they work. As an incident responder, it is imperative that you are able to properly dissect malware
In this course, you will learn how to perform the basics of dynamic malware analysis, a tried and true method of understanding what an unknown binary (malware) is doing on an infected system. You will learn the tools, tactics and techniques malware analysis use in there every day job. At the end of the course I will walk you through creating your own piece of malware. The saying goes "it takes a thief to catch a thief".
So, if you have ever wondered how to better understand malware, this is the course for you!