Malware Analysis

Take malware apart to learn what it does and how to stop it, from first principles to expert techniques.

Malware analysis is the foundation of effective cyber security. You cannot defend against what you do not understand. This course teaches your team to take malicious software apart, see exactly what it does and turn that knowledge into detection.

Who it is for

Anyone who works with malware, from analysts taking their first look at a suspicious file to experienced reverse engineers. We teach from novice to expert level, so a course can start at the foundations or go straight to advanced techniques.

Format

1 to 5 days, on-site or online, for up to 10 people. The course is à la carte, so choose the modules below.

No prerequisites for the foundation modules. The analysis and advanced modules assume the foundations or equivalent experience.

Foundation modules

  • Building a virtual machine for safe malware analysis
  • What you need to know about Windows for malware analysis
  • What you need to know about POSIX operating systems for malware analysis
  • Interpreters, bytecode and machine code
  • An introduction to Intel x86 assembly

Analysis modules

  • Analyzing malicious documents and the other files phishing usually delivers, and extracting their payloads and indicators
  • How Windows installers work and how to spot malicious behavior in them
  • Malware written in .NET
  • Script-based malware, in languages such as Python, PowerShell and AutoIt
  • Reversing malware at the assembly level, with static and dynamic analysis
  • Unpacking malware from custom packers and crypters
  • Writing YARA rules based on malware behavior rather than strings alone

Advanced modules

  • Linux shellcode analysis
  • Windows shellcode analysis
  • Advanced anti-analysis and anti-detection techniques
  • Analyzing nation-state supply chain attacks
  • Analyzing malware that runs in a custom virtual machine

What you will be able to do

  • Set up a safe environment and handle live malware without risk
  • Work out what a malicious file does and how it got in
  • Extract payloads and indicators of compromise to share with your team
  • Write detection rules that keep working when the malware changes

Pricing

  • Priced per team
  • From £1,750 a day for up to 4 people
  • From £2,750 a day for up to 10 people1
  • Prices exclude VAT
  • See pricing for every option

  1. Discounts: 15% off for businesses based on the Isle of Man and 10% off for retainer clients, up to 25% combined. Micro businesses with 4 or fewer employees get heavily discounted pricing, so contact us for details. See the terms. ↩︎