MAL600 - Advanced Malware Analysis

Class Overview

MAL600 - Advanced Malware Analysis is an advance course that builds upon our previous malware course and exposes students to the theoretical knowledge and hands-on techniques to reverse engineer malware that was designed to thwart the most common reverse engineering techniques. In Advanced Malware Analysis, students will learn how to identify and analyze the presence of advanced packers, polymorphic malware, encrypted malware, and malicious code armored with anti-debugging and anti-reverse engineering techniques. Students gain a high-level understanding of complex malware analysis techniques and spend a significant amount of time solving hands-on challenges throughout the course.

This course is for malware analysts, or aspiring analysts, who have already taken CyberStronger’s MAL400 (Fundamentals of Malware Analysis) and MAL500 (Reverse Engineering Malware) courses. Those who have encountered malware analysis as part of incident response, research, or secure development and want to improve upon their knowledge and skills may also find this course beneficial. Students should have intermediate malware analysis skills, the ability to read and understand moderately complex high-level language code constructs in assembly, familiarity with Windows API, networking, and scripting, and finally, experience with IDA Pro, Olly, Immunity, or another similar application.

Class Outline

• Malware-Focused Network Signatures
• Anti-Disassembly
• Anti-Debugging
• Anti-VM Techniques
• Unpacking
• Shellcode Analysis
• C++ Analysis
• 64-bit Malware