Skip to content
Reverse Engineering

> learning path

Learn Malware Analysis

A structured path from how a binary works to automated analysis. Every lesson ends with a safe lab built on programs you compile yourself.

Start the path →
0 / 56 completed

  1. Module 01 · 4 lessons · ~120 min

    Foundations

    Why we reverse malware, how to do it safely, and what a binary actually is — from source code to a running process.

    1. 1.1What Is Malware Analysis?Why defenders reverse engineer malicious binaries, what questions analysis answers, and how triage, static and dynamic analysis fit together.
    2. 1.2Building a Safe Analysis LabSet up isolated Windows and Linux analysis VMs with simulated networking, snapshots and safe sample-handling habits before touching any malware.
    3. 1.3From Source Code to BinaryFollow a C program through preprocessing, compilation, assembly and linking, and learn what symbols, relocations and debug info leave behind.
    4. 1.4How a Binary Is Loaded and RunWhat happens between double-clicking an executable and main(): process creation, memory mapping, the loader, imports, ASLR, CRT startup and TLS callbacks.

  2. Module 02 · 5 lessons · ~195 min

    Binary Formats

    The PE format in depth — headers, sections, imports, exports and resources — plus the ELF essentials for Linux malware.

    1. 2.1PE Headers: DOS, NT and Optional HeaderWalk the headers at the start of every Windows executable, byte by byte, and learn which fields analysts trust, which they doubt and which malware abuses.
    2. 2.2PE Sections and Memory LayoutHow the section table maps a PE file into memory, how to convert RVAs to file offsets, and which section anomalies betray packers and loaders.
    3. 2.3Imports, Exports and the IATHow PE files declare the API functions they use and provide, how the loader fills the IAT, and how malware hides its imports from you.
    4. 2.4Resources, Overlays and Other Hiding PlacesWhere PE files carry data outside their code: the resource tree, version info, overlays, Authenticode signatures, and the .NET and TLS directories.
    5. 2.5ELF for Malware AnalystsThe ELF essentials for Linux malware: headers, sections versus segments, dynamic linking, and why stripped, static and header-less binaries still run.

  3. Module 03 · 6 lessons · ~250 min

    Static Triage

    Answering the first questions about a sample in minutes, without running it — and turning what you find into detections.

    1. 3.1Identifying and Hashing FilesIdentify a file by its magic bytes rather than its name, then fingerprint it with cryptographic, import, fuzzy and Rich header hashes.
    2. 3.2Strings and Obfuscated StringsExtract ASCII and UTF-16 strings, separate indicators from runtime noise, and recover stack, XOR and decoded strings with FLOSS and CyberChef.
    3. 3.3Reading Capabilities from ImportsTurn a PE import table into a capability hypothesis: group APIs by behaviour, spot suspicious combinations, and use capa to confirm with code evidence.
    4. 3.4Detecting Packers and EntropyRecognise packed and encrypted executables with entropy, section anomalies, import tables and signatures — and avoid the classic false positives.
    5. 3.5Writing Your First YARA RulesTurn triage findings into YARA rules: strings, hex patterns, the pe and math modules, performance, and testing against goodware and variants.
    6. 3.6Writing a Triage ReportTurn static triage into a report people can act on: verdict and confidence, ATT&CK-mapped capabilities, defanged IOCs, detections and next steps.

  4. Module 04 · 5 lessons · ~245 min

    Disassembly & Code Analysis

    How disassemblers recover code, how to read compiler output, and how control-flow and data-flow analysis guide you.

    1. 4.1Linear vs Recursive DisassemblyHow disassemblers decide which bytes are code, why linear sweep and recursive descent fail in different ways, and how to build a tiny recursive disassembler.
    2. 4.2Functions and Control-Flow GraphsSplit code into basic blocks, read the CFG shapes of ifs, loops and switches, find x64 Windows function boundaries, and build a CFG with Capstone.
    3. 4.3Recognising Compiler IdiomsMap optimised x86-64 compiler output back to C: frames, magic-number division, branchless code, loops, jump tables, structs and vtables.
    4. 4.4Decompilers and Their LimitsHow decompilers turn machine code into C-like pseudocode, where that output misleads you, and how to repair it with types, names and signatures.
    5. 4.5Cross-References and Data FlowUse cross-references to pivot from strings and imports to the code that uses them, trace values backwards, and restore xrefs lost to indirect calls.

  5. Module 05 · 5 lessons · ~200 min

    Windows Internals for Analysts

    The Windows concepts malware leans on — the API and native API, processes, threads, DLLs, mutexes, services, the registry and the user/kernel boundary.

    1. 5.1The Windows API for AnalystsRead the Win32 API the way a malware author uses it — layers, naming conventions, handles and the calling convention — to predict capability from imports alone.
    2. 5.2Processes, Threads and DLLsWhat processes, threads and DLLs look like to an observer — PEB, TEB, tokens, handles, process trees and module lists — and how to read them as evidence.
    3. 5.3The Registry, Services and Scheduled TasksHow to read the Windows registry, services and scheduled tasks during triage and incident response, live and offline, and review autostart entries.
    4. 5.4Mutexes, Events and Inter-Process CommunicationNamed mutexes, events, sections and pipes as host evidence: where they live, how to observe and extract them, and how to turn them into detections.
    5. 5.5User Mode, Kernel Mode and the Native APIThe ring boundary, ntdll's syscall stubs and WOW64 translation — why malware that talks to the native API bypasses user-mode hooks, and where EDR telemetry now watches instead.

  6. Module 06 · 5 lessons · ~220 min

    Dynamic Analysis

    Running samples under observation — behavioural monitoring, network simulation, debugging, API tracing and memory dumping.

    1. 6.1Behavioural MonitoringRun a sample through a repeatable detonation routine with Process Monitor, Sysmon, registry diffs and Autoruns, then turn what you see into host IOCs.
    2. 6.2Simulating and Capturing Network TrafficKeep a sample's traffic inside the lab with INetSim and FakeNet-NG, capture it, and read DNS, HTTP, beacon timing and TLS fingerprints as network IOCs.
    3. 6.3Debugging Malware with x64dbgHow debuggers stop and step a process, how to drive x64dbg around a sample, and the analyst loop: break on an API, read its arguments, flip a branch.
    4. 6.4Tracing API and System CallsRecord a sample's API and system calls instead of stepping through them, cut the noise, read the trace as behaviour, and know where tracing goes blind.
    5. 6.5Dumping Memory and Extracting PayloadsCapture process and system memory, find the region that holds the real payload, and turn a memory-layout PE back into a file your tools can parse.

  7. Module 07 · 6 lessons · ~280 min

    Malware Behaviours

    What malware actually does and how each behaviour looks in code and telemetry — persistence, command and control, credential theft, injection and stealth.

    1. 7.1Loaders, Droppers and DownloadersHow malware actually arrives and starts running — living-off-the-land delivery, embedded payloads and in-memory loaders — and how to detect each from telemetry.
    2. 7.2Persistence MechanismsRecognise persistence in a sample, detect it in Sysmon and Windows event logs, and remove every foothold in the right order during incident response.
    3. 7.3Command and ControlFind C2 in network logs through beacon timing, DNS anomalies and TLS pivots, recover it from samples, and contain it without losing the evidence.
    4. 7.4Credential Theft and KeyloggingRecognise info-stealers, LSASS access and keyloggers in samples and telemetry, verify the controls that stop them, and scope the accounts exposed.
    5. 7.5Understanding Process InjectionThe process injection families, the memory and telemetry artefacts each one leaves, and how cross-view tools like pe-sieve and Volatility prove one occurred.
    6. 7.6Hooking and User-Mode RootkitsFind inline, IAT and export hooks by comparing memory with disk, tell security-product hooks from rootkits, and prove hiding with cross-view checks.

  8. Module 08 · 5 lessons · ~255 min

    Encoding, Crypto & Signatures

    Recognising encodings and cryptography, extracting configurations, and turning what you decode into network and host signatures.

    1. 8.1Recognising XOR, Base64 and Custom EncodingsSpot XOR, rolling-key and custom Base64 encodings in data and in code, recover their keys with key-length tests and known plaintext, and decode them.
    2. 8.2Identifying Cryptographic AlgorithmsTell encryption from encoding, identify AES, RC4, ChaCha20, TEA, hashes and CRC32 from constants, loops and imports, then locate the key and IV to report.
    3. 8.3Scripting String DecryptionRecover hundreds of encrypted strings at once by finding the decrypt routine, recovering each call's arguments statically, and scripting the algorithm.
    4. 8.4Extracting Malware ConfigurationsTurn a sample's embedded configuration into normalised JSON with a locate-decode-parse-output extractor, and share the results responsibly.
    5. 8.5Writing Network SignaturesTurn a sample's network code and captured traffic into Suricata rules that target durable protocol structure, then test them against pcaps.

  9. Module 09 · 6 lessons · ~285 min

    Evasion & Unpacking

    Defeating the tricks that waste analysts' time — anti-disassembly, anti-debugging, sandbox detection and packing — by patching, hooking and unpacking.

    1. 9.1Anti-DisassemblyRecognising the tricks that make a disassembler lie — constant-condition jumps, overlapping instructions, rogue bytes — and repairing the listing.
    2. 9.2Anti-DebuggingThe families of debugger detection — API calls, PEB and heap flags, timing and hardware checks — how to spot each in a sample and get past it.
    3. 9.3Anti-VM and Sandbox EvasionThe families of virtualisation and sandbox detection — CPUID, registry artefacts, resource fingerprints and behavioural signals — how to spot each in a sample and get past it.
    4. 9.4Patching Binaries to Defeat ChecksUse patching as an analysis tool: flip a jump, NOP a check or force a return so a sample reveals what it hides, in memory or on the file.
    5. 9.5How Packers WorkWhat a packer's unpacking stub does step by step — decompress, rebuild imports, relocate, jump to the OEP — and what it means for unpacking.
    6. 9.6Manual Unpacking to the OEPFind the OEP with breakpoint tricks, dump the process, and rebuild a destroyed or hashed IAT into a binary that loads and runs like the original.

  10. Module 10 · 4 lessons · ~180 min

    Beyond the EXE

    Malware that is not a native executable — shellcode, .NET assemblies, scripts and malicious documents — and the tools each one needs.

    1. 10.1Shellcode AnalysisHow to recognise raw shellcode without headers, follow its get-PC and API-resolution idioms, and disassemble, emulate and extract IOCs from it safely.
    2. 10.2Analysing .NET MalwareHow to recognise a .NET assembly, read its metadata and IL, pick the right decompiler, and get past obfuscators and in-memory stages.
    3. 10.3PowerShell, JavaScript and VBScript MalwareDeobfuscate malicious PowerShell, JavaScript and VBScript without running them: neutralise eval sinks, decode layers, read script logs, extract IOCs.
    4. 10.4Malicious Documents and ArchivesTriage malicious Office files, RTF, PDF, archives, disk images and LNK shortcuts without opening them, and pull out the next stage and its IOCs.

  11. Module 11 · 5 lessons · ~255 min

    Automated & Advanced Analysis

    Letting tools do the heavy lifting — instrumentation, emulation, taint analysis, symbolic execution and analysis pipelines.

    1. 11.1Dynamic Binary InstrumentationHow DBI engines like Pin, DynamoRIO, Frida and TinyInst inject analysis code into a running sample to log API calls, map coverage and catch unpacking.
    2. 11.2Emulating Code with Unicorn and SpeakeasyWhy analysts emulate instead of run, CPU vs OS-level emulators, and how to call a sample's own decryption routine with stubbed APIs.
    3. 11.3Dynamic Taint AnalysisHow taint tracking follows data from sources to sinks, the design choices that cause over- and under-tainting, and how analysts use it on malware.
    4. 11.4Symbolic Execution with angrHow symbolic execution explores every path through a routine at once with an SMT solver, why that alone does not scale, and how angr finds the input that satisfies a specific check.
    5. 11.5Building an Analysis PipelineTurn manual triage into a repeatable pipeline: deduplication, file-type routing, static enrichment, scoring, safe isolation and reproducible reports.