Prepare for Malware
Malware Analysis Professional (MAP) is an online, self-paced training course that teaches students the knowledge and skills needed to examine malware in order to understand its mechanics and purpose. MAP provides a holistic approach to studying malware. You will also learn more about reverse engineering and add a further skill to your repertoire, allowing you to examine a product to understand its design or how it was built.
Learn by Doing
MAP is a self-paced course that comes with 36 labs, so you can develop your knowledge and test your skills through hands-on dissection and analysis of malware. The reverse engineering section of MAP includes 10 downloadable, offline labs (executables) that provide practical reverse engineering experience. This content also comes with videos providing step-by-step instructions and a detailed explanation of each technique.
The Course at a Glance
- Realistic malware samples built to prepare you for real-world cases
- Analyse real-world examples: ransomware, botnets, RATs and more
- Learn about the IA-32 CPU architecture
- An entire module devoted to x64-bit assembly
- Practical demonstration and an in-depth look at the TLS method
- Understand how malware uses Windows APIs to carry out its malicious activity
- Understand and bypass anti-reversing techniques
- Perform full manual unpacking of packed executables
- Debug samples using different debuggers
- Learn different methods for locating important algorithms
Course Material
- Over 8 hours of HQ video training material
- Over 1800 interactive slides across 21 modules
- 36 hands-on malware analysis and reverse engineering labs with lab guides of over 800 slides
Course Delivery
- Self-paced / HTML5, PDF, MP4
- Offline access available
- Access from PC, tablet and smartphone
Curriculum
- Section: MALWARE ANALYSIS
Module 1: Introduction to Malware Analysis
Module 01 is a foundational introduction to malware, the different types of malware, what they are and how to analyse them. This module also covers the malware analysis techniques used to analyse malware and why we need different methods and techniques. Finally, the module covers most of the tools that can be used to obtain evidence, including malware itself.
Module 2: Static Analysis Techniques
This module presents the basic static methods used to identify malware and make an initial assessment. It covers different file types, different hash types and how they can help, extracting strings and using them as starting points in your analysis, and when and why you might consider using an online scanner or sandbox. The module also takes an in-depth look at the Portable Executable (PE) file format, how to analyse its structure and how to understand all the key values within it. Finally, this module explains how all of this information can be used to build an indicator of compromise (IOC) and to find malware samples on other systems using YARA.
Module 3: Assembly Crash Course
Because most systems in use today are 64-bit, this module serves as a crash course in x64 assembly language. What distinguishes x64 from x86, and why malware analysts need to be capable of analysing 64-bit code and even writing some x64 assembly, are addressed in this module.
Module 4: Behavioural Analysis
This module begins by explaining Windows processes, threads and the various objects available to a process. Malware is executed here in order to understand its behaviour and how it affects the victim’s system. The module demonstrates the different injection methods used by malware and how they achieve persistence on systems, so that they can return or establish a foothold on the victim’s system or network. The module also covers the different tools used to analyse malware, whether EXE or DLL, and how to use them effectively. Finally, the module explains how to use a sandbox to automate your dynamic analysis and obtain faster results that can support further investigation.
Module 5: Debugging and Disassembly Techniques
This module covers two of the most advanced malware analysis methods: debugging and disassembly. Why these methods are needed and when to use them, their advantages and disadvantages, and which tools are available are all core concepts addressed in this module. Different debugging methods, breakpoints and controls, and how to use them to run and analyse a malware sample, are covered. Finally, this module covers disassembly and reverse engineering in more detail, focusing on recognising common malware characteristics at the Windows API level.
Module 6: Obfuscation Techniques
One of the goals malware developers pursue is to prevent their code from being analysed, and they will use many different methods and techniques to achieve it. This module covers the most common obfuscation techniques used by malware developers, including encoding (Base64, XOR and so on) alongside anti-debugging and anti-reverse-engineering practices. The module addresses in detail what packing is and how to apply different unpacking techniques to different malware samples. Finally, the module covers shellcode (primarily 64-bit shellcode) and how to locate, debug and analyse it.
Section: REVERSE ENGINEERING
Module 1: Essential Theory – Part 1
The first three modules aim to cover all the necessary theory and the concepts on which the practical part of this course is based. We will begin with a short explanation of what reverse engineering is and why someone might need it, and continue with more technical concepts. Across these first three sections we will discuss the fundamentals behind the Intel IA-32 CPU architecture (x86), the stack, the heap and exceptions, the Windows APIs together with some Windows internals, and the most common reversing tools used with them.
Module 2: Essential Theory – Part 2
Here we are in the second module dedicated to the theoretical knowledge required for this course. One thing to bear in mind is that the word “theoretical” does not mean you will not need it. In fact, the theory discussed in these first three modules covers all the fundamental knowledge and concepts you will need, not only for this course and its technical tasks but for the rest of your time as a reverser.
Module 3: Essential Theory – Part 3
The third module of this course aims to present some additional theoretical knowledge required for the remainder of the course. During this module we will touch briefly on the stack, and discuss handles, exceptions, some fundamental Windows Ring3 internal structures and the Windows APIs. Finally, we will go through the most common reversing tools in use today for software reverse engineering.
Module 4: VA / RVA / OFFSET and the PE File Format
In this module we will look at some fundamentals concerning virtual addresses, relative virtual addresses, offsets and the Portable Executable file format that defines the basic structure of all Windows executables.
Module 5: String References and Basic Patching
This module is dedicated to string references as well as basic memory and file patching. We demonstrate the use of data strings to locate the algorithm we are interested in, and then reverse its logic. Finally, we explain how to calculate the offset of a byte inside the physical file knowing its virtual address in memory.
Module 6: Exploring the Stack
This module focuses on exploring the data we can obtain from the stack in order to trace an algorithm — a crucial technique when we need to encrypt and decrypt data on the fly.