Course
Malware Analysis Foundations
Safe, repeatable malware triage — lab containment, static indicators, sandboxes that lie, unpacking, YARA, behavioral analysis, and IOCs an incident response team can actually act on.
Reviews
Enrolled members can rate this course.
No reviews yet.
Safe Triage
Containing samples, reading a file before it ever runs, and getting honest answers out of sandboxes.
- 01The Lab: Detonating Without Burning Down the HouseLab safety is about containing signal as much as code. Host-only networks, fake internet, snapshots, and the sample-handling habits that keep you out of the incident timeline.22mOpen
- 02Static Triage: The First Ten MinutesHashes that matter, file identity, strings done properly, and reading imports and capa output to decide what a file can do before anything executes.25mOpen
- 03Sandboxes: Useful LiarsWhat a sandbox verdict really means, when uploading a sample is a leak, how to make samples actually detonate, and the evasion tricks that produce clean reports for dirty files.22mOpen
Peeling the Layers
Recognizing packers, letting the malware unpack itself into your hands, and writing YARA that survives the next build.
- 01Packers, Crypters, and Reading EntropyRecognize a wrapped binary in a minute — section layout, entropy, and import shape — and know why the stub is not the malware.22mOpen
- 02Unpacking: Let the Malware Do the WorkThe effort ladder from upx -d to debugger breakpoints on memory APIs, catching payloads with pe-sieve, and how to know the dump is actually the payload.28mOpen
- 03YARA Rules That Don't Page Anyone at 3 a.m.Choosing strings that are actually unique, conditions that anchor scope, wildcarding byte patterns to survive rebuilds, and the testing that earns an IR team's trust.28mOpen
Behavior to Response
Watching malware live, pulling its configuration, and handing IR indicators they can act on at 2 a.m.
- 01Behavioral Analysis: Watching It LiveInstrument before you detonate, cut Procmon noise, read the process tree as a story, and hunt the persistence locations that matter — then diff against a clean baseline.26mOpen
- 02Network Behavior and Config ExtractionReading lab pcaps without fooling yourself, where malware hides its configuration, cracking simple encodings, and why an extractor beats a one-off decode.26mOpen
- 03Writing IOCs an IR Team Can Actually UseThe pyramid of pain, indicators with role, confidence, and expiry, what to leave out, behavior detections as Sigma, and the handoff that gets acted on at 2 a.m.25mOpen