Windows Malware Analysis for Hedgehogs - Beginner Training

Unlock the Secrets of Malware Analysis: A Comprehensive Guide

This course goes beyond basic reverse engineering to equip you with the essential skills of a professional malware analyst. You'll master crucial techniques for malware classification, accurately identifying malware families, and determining reliable file verdicts – distinguishing between clean files, malicious software, potentially unwanted programs (PUPs), junk files, grayware, and corrupted data.

Learn how malware persists on compromised systems, how to pinpoint malicious autostart entries, and effectively clean infected systems. We'll debunk common misconceptions, such as the false assumption that "trojan" in a detection name guarantees a trojan horse, or that antivirus detection names equate to definitive malware classification.

Taught by an experienced malware analyst with a decade of experience at an antivirus company (since 2015), this course focuses on building a strong, adaptable foundation. We prioritize practical skills over rote memorization, preparing you to tackle new malware advancements with confidence. You'll gain proficiency in differentiating between various file types: installers, wrappers, packed files, non-packed files, hybrid files, and native compiled files. Discover the right tools for malware analysis in different scenarios and learn how to analyze samples efficiently using proven approaches.

Ideal for individuals with an existing IT background – including programmers, computer enthusiasts, system administrators, computer science students, and security-minded gamers – this course provides a deep dive into the inner workings of software and IT security. If you're new to the field, a foundational understanding of programming is recommended. (See course requirements for details.)

Tools You'll Master (All Free!)

• Ghidra64
• 64dbg
• VirtualBox
• SysInternals Suite
• Portex Analyzer (CLI & GUI)
• VirusTotal (Free Tier)
• Speakeasy by Mandiant
• API Monitor
• CyberChef
• EXIFTool
• Meld
• VBinDiff
• AnalyzePESig
• DnSpy
• C# Online Compiler
• programwiz
• TriD
• Detect-it-Easy
• ReNamer
• 7zip
• Notepad++
• HxD
• Malpedia
• lnk_parser

Requirements

A solid understanding of at least one programming language (Python, C, C++, Java, or C#) is essential. Programming concepts are fundamental to reverse engineering. While a specific language isn't critical, familiarity with programming logic is. If you're not comfortable with programming, consider learning C first – its low-level nature complements x86 assembly language well.

You should also be able to read x86 assembly (writing is not required). Understanding assembly is crucial for comprehending a significant portion of the course material. Learning assembly alongside the course is highly recommended.

We'll analyze samples utilizing these execution environments:

• x86, x64 assembly
• .NET
• Batch
• PowerShell
• Nullsoft scripts

While familiarity with all these environments isn't necessary (as new languages emerge constantly), you'll learn how to leverage documentation and resources for each. We'll demonstrate effective techniques for using documentation, such as for PowerShell.

Out of Scope

Due to the breadth of malware analysis, certain topics will not be covered in depth, as they warrant dedicated courses:

• In-depth assembly language instruction
• General programming principles
• Computer architecture fundamentals
• URL and website analysis
• Network analysis
• Mobile malware analysis
• IoT malware analysis