Malware Analysis & Reverse Engineering
Delivery: classroom // Duration: 5 days
This course gives participants an in-depth practical understanding and methodology for current malware analysis and reverse engineering. The course is one of the rare opportunities to participate in a hands-on training held by Kaspersky´s acknowledged expert analysts performing such analysis on a day to day basis unearthing some of the most advanced cyber threats around today.
Learning Objectives
-
This course provides all the necessary information about the modern malware and anti-malware landscape. Participants will learn about current malware functioning and how it infects companies’ IT infrastructures through their weakest points, exploiting these weaknesses after infection. Students will also learn all the main methods and malware analysts’ routines.
-
Strong anti-malware theory is combined with surface analysis. To operate effectively as analysts, students need to understand what lies behind the tools and techniques.
Course Content
-
Malware Analysis & Reverse Engineering goals and techniques
-
Windows internals, executable files, x86 assembler
-
Basic static analysis techniques (strings extracting, import analysis, PE entry points at a glance, automatic unpacking, etc.)
-
Basic dynamic analysis techniques (debugging, monitoring tools, traffic interception, etc.)
-
.NET, Visual Basic, Win64 files analysis
-
Script and non-PE analysis techniques (Batch files; Autoit; Python; Jscript; VBS)
-
Build a secure environment for malware analysis: deploy sandbox and all necessary tools
-
Understand principles of Windows program execution
-
Unpack, debug and analyze malicious object, identify its functions
-
Detect malicious sites through script malware analysis
-
Conduct express malware analysis.
Throughout the course there are a multitude on practical, hands-on exercises.
Target Audience
The training is suitable for IT-related professionals looking to acquire practical skills in malware analysis.
Pre-requisite for Course Registration
-
Participants should have basic knowledge of information security and/or IT security
-
Some programming experience is critical
-
Due to the many real life practical tasks, technical prerequisites for this training include a PC for each student
-
Virtual machines will be provided with the following free tools installed: IDA, Immunity debugger, OllyDdg, WireShark, Sysinternals tools, Fiddler proxy, dumpers, PE analyzers and other utilities for static and dynamic analysis
-
LAN and internet is provided in the class room
-
Participants have to bring their own laptop with current VMWare Workstation Pro and admin rights