Unlock the Secrets of Malware Analysis

In this comprehensive course, you'll gain the expertise to analyze real malware samples from triage to full reverse engineering, preparing you for the GIAC GREM exam and real-world malware analysis engagements.

Course Highlights

• Complete Methodology: Learn the entire malware analysis process, from PE file format to dynamic analysis and debugging.
• Toolset Mastery: Get hands-on experience with industry-leading tools, including IDA Pro, Ghidra, x64dbg, ScyllaHide, and more.
• Hands-on Training: Perform real-world malware analysis exercises, including RAT behavioral analysis, IOC reporting, and threat intelligence.
• GIAC GREM Exam Preparation: Prepare for the GIAC GREM certification with exam-style questions and practice scenarios.

Course Modules

• PE File Format: Understand the structure of PE files, including the DOS header, Optional Header, section table, and Import Address Table.
• Assembly and Disassembly: Learn x86 and x64 assembly, calling conventions, stack mechanics, XOR decryption loops, and API ROR-13.
• Static Analysis: Master FLIRT signatures, encrypted string table decryption, API hash resolution, crypto identification, and config extraction workflows.
• Dynamic Analysis: Learn the correct tool startup order, ProcMon filter strategy, Process Hacker RWX memory detection, and Regshot diff interpretation.
• Debugging: Cover all four breakpoint types in x64dbg, ScyllaHide anti-debug bypass, OEP capture from WindowsCrypto and BCrypt APIs, and logging breakpoints for automated injection tracing.
• Windows Internals: Understand the structure at exact offsets, the VAD tree, and six process injection techniques with full API sequences.
• Anti-Analysis: Learn contredicates, VM-based obfuscation with Themida techniques, ETW tampering, and fileless malware execution.
• Script and Document Malware: Analyze VBA and ViperMonkey, Excel 4.0 XLM macros, .NET malware with de4dot and dnSpy, Python/PyInstaller extraction, and PDF analysis.
• Network Analysis: Use Wireshark display filters for malware traffic, JA3 and JA3S fingerprinting, DGA detection, DNS tunneling, and Suricata rule writing.
• Memory Forensics: Master the full Volatility 3 plugin suite, including pslist vs psscan, ldrmodules, modscan, windows.ssdt, and artifact extraction.
• Malware Recognition: Learn recognition fingerprints for 20+ malware families, including Emotet, TrickBot, LockBitT, and more, with complete MITRE ATT&CK mapping.

Tools Covered

• IDA Pro
• Ghidra
• x64dbg
• ScyllaHide
• Scylla
• Pestudio
• CFF Explorer
• Detect-It-Eacker
• ProcMon
• Regshot
• FakeNet-NG
• Wireshark
• API Monitor
• PE-Sieve
• HollowsHunter
• Volatility 3
• dnSpy
• de4dot
• olevba
• ViperMonkey
• Mimikatz

Enroll now and become a master malware analyst, ready to take on real-world challenges and prepare for the GIAC GREM certification.