Windows Malware Analysis for Hedgehogs – Beginner Training
Learn what really matters by an actual analyst: malware reversing, clean vs malware, report writing, unpacking
Created by Karsten Hahn | 11 hours on-demand video course
This course teaches more than just reverse engineering because as a malware analyst you need a variety of other skills. You will learn how to classify samples into malware types, how to identify malware families and how to determine file verdicts like clean, malicious, potentially unwanted programs, junk, grayware, or corrupt. Additionally, you will learn how malware persists, how to identify malicious autostart entries and clean infected systems.
The course aims to dispel common myths such as “trojan in a detection name means the file is a trojan horse” or “antivirus detection names are a malware classification”.
As a malware analyst with experience working at an antivirus company since 2015, I have trained many beginners in the field. I understand the usual pitfalls and the concepts that you need to grasp to become proficient. I focus on building strong foundations that make you flexible in the face of new malware advancements, rather than providing shortcuts with step-by-step recipes.
I will teach you how to differentiate between different types of files, including installers, wrappers, packed files, non-packed files, hybrid, and native compiled files. You will learn which tools to apply in which situations and how to analyse samples efficiently. To do that I give you example approaches that work for most situations.
This course is ideal for you if you already have some IT background, such as hobby or professional programmers, computer enthusiasts, administrators, computer science students, or gamers with an interest in the inner workings of software or IT security.
What you’ll learn
- Triage and reverse engineering of potentially malicious samples
- Determine if a file is malicious, clean, potentially unwanted, grayware, corrupt or junk
- Write malware reports
- Know the common types of malware and how to identify them
- Know how and when to use a disassemblers, debuggers, meta data viewers
- Identify malware families
- Windows internals necessary for malware analysis, e.g., Windows registry
- Packer types, identification, basics of unpacking
- Analysis of native and .NET executables, installers, wrappers, scripts
- Basics of disinfection
Recommended Course