FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
This popular malware analysis course has helped forensic investigators, incident responders, security engineers and IT administrators acquire practical skills for examining malicious programs that target and infect Windows systems. Knowing how to understand capabilities of malware is critical to the organization's ability to derive threat intelligence, so they can respond to information security incidents and fortify defenses. The course builds a strong foundation for analyzing malicious software using a variety of system and network monitoring utilities, a disassembler, a debugger and other tools useful for turning malware inside-out.
The course begins by covering fundamental aspects of malware analysis. You will learn how to set up an inexpensive and flexible laboratory for understanding the inner-workings of malicious software and will understand how to use the lab for uncovering characteristics of real-world malware samples. Then you will learn to examine the specimens' behavioral patterns and code. The course continues by discussing essential x86 assembly language concepts. You will examine malicious code to understand its key components and execution flow. Additionally, you will learn to identify common malware characteristics by looking at suspicious Windows API patterns employed by bots, rootkits, keyloggers, downloaders and other types of malware.
TURN MALWARE INSIDE-OUT
You will also learn how to analyze malicious documents that take the form of Microsoft Office and Adobe PDF files. Such documents act as a common infection vector and may need to be examined when dealing with large-scale infections as well as targeted attacks. The course also explores memory forensics approaches to examining malicious software, especially useful if it exhibits rootkit characteristics.
The course culminates with a series of capture-the-flag style challenges, designed to reinforce the techniques learned in class and to provide additional opportunities for learning practical, hands-on malware analysis skills in a fun setting.
Hands-on workshop exercises are a critical aspect of this course and allow you to apply malware analysis techniques by examining malware in a lab that you control. When performing the exercises, you will study the supplied specimens' behavioral patterns and examine key portions of their code. To support these activities, you will receive pre-built Windows and Linux virtual machines that include tools for examining and interacting with malware.
FOR610.1: Malware Analysis Fundamentals
Section one lays the groundwork for malware analysis by presenting the key tools and techniques useful for examining malicious programs. You will learn how to save time by exploring Windows malware in two phases. Behavioral analysis focuses on the program's interactions with its environment, such as the registry, the network and the file system. Code analysis focuses on the specimen's code and makes use of a disassembler and a debugger tools such as IDA Pro and OllyDbg. You will learn how to set up a flexible laboratory to perform such analysis in a controlled manner, and set up such a lab on your laptop using the supplied windows and Linux (REMnux) virtual machines. You will then learn how to use the key analysis tools by examining a malware sample in your lab - with guidance and explanations from the instructor - to reinforce the concepts discussed throughout the day.
CPE/CMU Credits: 6
- Assembling a toolkit for effective malware analysis
- Examining static properties of suspicious programs
- Performing behavioral analysis of malicious Windows executables
- Performing static and dynamic code analysis of malicious Windows executables
- Contributing insights to the organization's larger incident response effort
FOR610.2: Malicious Code Analysis
Section two focuses on examining malicious Windows executables at the assembly level. You will discover approaches for studying inner-workings of a specimen by looking at it through a disassembler and, at times, with the help of a debugger. The section begins with an overview of key code reversing concepts and presents a primer on essential x86 Intel assembly concepts, such as instructions, function calls, variables and jumps. You will also learn how to examine common assembly constructs, such as functions, loops and conditional statements. The remaining part of the section discusses how malware implements common characteristics, such as keylogging and DLL injection, at the assembly level. You will learn how to recognize such characteristics in suspicious Windows executable files.
CPE/CMU Credits: 6
- Core concepts for analyzing malware at the code level
- x86 Intel assembly language primer for malware analysts
- Identifying key x86 assembly logic structures with a disassembler
- Patterns of common malware characteristics at the Windows API level (DLL injection, function hooking, keylogging, communicating over HTTP, etc.)
FOR610.3: In-Depth Malware Analysis
Section three builds upon the approaches to behavioral and code analysis, introduced earlier in the course, exploring techniques for uncovering additional aspects of malicious programs' functionality. You will learn about packers and the techniques that may help analysts bypass their defenses. Additionally, you will understand how to redirect network traffic in the lab to better interact with malware to understand its capabilities. You will also learn how to examine malicious websites and deobfuscate browser scripts, which often play a pivotal role in malware attacks.
CPE/CMU Credits: 6
- Recognizing packed malware
- Automated malware unpacking tools and approaches
- Manual unpacking of using OllyDbg, process dumping tools and imports-rebuilding utilities
- Intercepting network connections in the malware lab
- Interacting with malicious websites to examine their nature
- Deobfuscating browser scripts using debuggers and runtime interpreters
FOR610.4: Self-Defending Malware
Section four focuses on the techniques malware authors commonly employ to protect malicious software from being examined, often with the help of packers. You will learn how to recognize and bypass anti-analysis measures, such as tool detection, string obfuscation, unusual jumps, breakpoint detection and so on. It'll be a lot of fun! We will also discuss the role that shellcode plays in the context of malware analysis and will learn how to examine this this aspect of attacks. As with the other topics covered throughout the course, you will be able to experiment with such techniques during hands-on exercises.
CPE/CMU Credits: 6
- Bypassing anti-analysis defenses
- Recovering concealed malicious code and data
- Unpacking more sophisticated packers to locate the Original Entry Point (OEP)
- Identifying and disabling methods employed by malware to detect analysts' tools
- Analyzing shellcode to assist with the examination of malicious documents and other artifacts
FOR610.5: Malicious Documents and Memory Forensics
Section five starts by exploring common patterns of assembly instructions often used to gain initial access to the victim's computer. Next, we will learn how to analyze malicious Microsoft Office documents, covering tools such as OfficeMalScanner and explore steps for analyzing malicious PDF documents with practical tools and techniques. Another major topic covered in this section is the reversing of malicious Windows executables using memory forensics techniques. We will explore this topic with the help of tools such the Volatility Framework and associated plug-ins. The discussion of memory forensics will bring us deeper into the world of user and kernel-mode rootkits and allow us to use context of the infection to analyze malware more efficiently.
CPE/CMU Credits: 6
- Analyzing malicious Microsoft Office (Word, Excel, PowerPoint) documents
- Analyzing malicious Adobe PDF documents
- Analyzing memory to assess malware characteristics and reconstruct infection artifacts
- Using memory forensics to analyze rootkit infections
FOR610.6: Malware Reverse-Engineering Tournament
Section six assigns students to the role of a malware reverse engineer, working as a member of an incident response and malware analysis team. Students are presented with a variety of hands-on challenges involving real-world malware in the context of a fun tournament. These challenges further student's ability to respond to typical malware reversing tasks in an instructor-led lab environment and offer additional learning opportunities. Moreover, the challenges are designed to reinforce skills covered in the first five sections of the course, making use of the hugely popular SANS NetWars tournament platform. By applying the techniques learned earlier in the course, students solidify their knowledge and can shore up skill areas where they feel they need additional practice.
CPE/CMU Credits: 6
- Behavioral Malware Analysis
- Dynamic Malware Analysis (using a debugger)
- Static Malware Analysis (using a disassembler)
- PDF Document Analysis
- Office Document Analysis
- Memory Analysis
The students who score the highest in the malware reverse-engineering challenge will be awarded the coveted SANS' Digital Forensics Lethal Forensicator coin. Game on!
Important! Bring your own system configured according to these directions!
A properly configured laptop is required to participate in this course. Prior to the start of class, you must install virtualization software and meet minimum hardware requirements as described below. If you do not carefully read and follow these instructions, you will leave the class unsatisfied, because you will not be able to participate in hands on-exercises that are essential to this course.
The following are minimal requirements for your laptop:
- Intel-compatible 2 GHz dual-core CPU (a faster processor is recommended)
- 8GB RAM (more memory is recommended)
- 60 GB of available disk space (more space is recommended)
- USB port 2.0 or higher
- Ethernet network interface card (NIC) or built-in Ethernet network port
Note that your laptop needs to have both wireless and wired network capabilities. You also should have the ability to have local administrative rights on the system you will be using during class.
In addition, you will need to have the ability to extract large compressed files. Unzip-type utilities built into the operating system might struggle with this. For this reason, please download and install the free 7zip tool.
The Need for VMware Virtualization
Please download and install VMware Workstation 10 or higher or VMware Fusion 6 or higher prior to class. If you do not own a licensed copy of VMware Workstation or Fusion, you can obtain a free 30-day trial copy from VMware. VMware will email you a time-limited serial number when you register for the trial at their web site. Please note that VMware Player is not sufficient for the class, because it does not support snapshot functionality, which we will want to use. Also, VirtualBox is not appropriate because of compatibility and troubleshooting problems you might encounter during class.
You will be asked to take multiple snapshots of virtual machines during the course. Experience has shown that students with limited free disk space are more likely to experience snapshot and other VMware performance problems. Please test your ability to run a virtual machine, create snapshot and restore a snapshot in a timely manner (creating a snapshot should take less than 2 minutes). Some disk encryption software interferes with VMware's ability to create snapshots in a timely fashion.
Using Your System for Malware Analysis
Hands-on exercises will involve operating with malicious code. Although VMware will provide you with reasonable isolation, we do not recommend using your day-to-day production system as your laboratory machine. We expect you to exercise due caution when handling malicious code.
Additional Tools You Will Receive
We will provide you with additional tools for completing hands-on exercises and include a pre-built Linux virtual machine (a version of REMnux). You will also receive a pre-built Windows virtual machine (REM Workstation) along with a corresponding license. Hardware requirements outlined above are meant to ensure that you have sufficient memory and disk space available to simultaneously run the virtual machines.
Review the following checklist when leaving for the training event to make sure that your laptop is prepared for the course:
- Your laptop meets hardware requirements outlined in this note, including an Ethernet card and sufficient processor, memory and disk space.
- VMware Workstation 10 or higher is installed.
- The VMware Workstation license will not expire before the class (if using a trial copy).
If you have additional questions about the laptop specifications, please contact email@example.com.
Who Should Attend
This course acts as a practical, concise onramp into the world of malware analysis. It is useful for both individuals looking to enter this exciting field, as well as for those who seek to formalize and expand their skills in this area. Attendees who found this course especially useful often had responsibilities in the areas of incident response, forensic investigation, information security and system administration. Course participants have included:
- Individuals who have dealt with incidents involving malware and desired like to learn how to understand key aspects of malicious programs.
- Technologists who have informally experimented with aspects of malware analysis prior to the course and were looking to formalize and expand their expertise in this area.
- Forensic investigators and IT practitioners looking to expand their skillsets and learn how to play a pivotal role in the incident response process.
The course begins by covering this topic from an introductory level and quickly progresses to discuss tools and techniques of intermediate complexity. Neither programming experience, nor the knowledge of assembly is required to benefit from the course. However, you should have a general idea about core programming concepts, such as variables, loops and functions. The course spends some time discussing essential aspects of x86 assembly language, allowing malware analysts to navigate through malicious executables using a debugger and a disassembler.
- Attendees should have a computer system that matches the stated laptop requirements. Some software needs to be installed before students come to class.
- Attendees should be familiar with using Windows and Linux operating environments and be able to Attendees general connectivity and setup issues.
- Students should be familiar with VMware Workstation and be able to create and configure virtual machines.
- Attendees are recommended to have a high-level understanding of key programming concepts, such as variables, loops and functions; however, no programming experience is necessary.
Why Take This Course?
Why Choose Our Course?
The malware analysis process taught in this course helps incident responders assess the severity and repercussions of a situation that involves malicious software, so they can plan recovery steps. Forensics investigators also learn how to understand key characteristics of malware discovered during the examination, including how to establish indicators of compromise (IOCs) for scoping and containing the incident.
What threat does the malicious program pose? What do its mechanics reveal about the adversary's goals and capabilities? What security measures can strengthen the organization's infrastructure from future attacks of this nature? This course teaches the skills necessary to answer these and other questions critical to the organization's ability to handle malware threats and related incidents.
What You Will Receive
When attending this course, you will receive a USB key-based toolkit, packed with practical malware analysis tools. You will use them to perform exercises in class and when examining malicious software after the course. The tools have been preinstalled and configured for your convenience into two virtual machines, which you will receive on the course toolkit:
- Windows REM Workstation virtual machine, along with a Windows 8.1 license needed to activate the system and take advantage of the preinstalled tools.
- REMnux virtual machine, set up to run the lightweight Linux distribution used by many malware analysts world-wide.
You will also receive many real-world malware samples, which you will examine during the course when performing hands-on lab exercises.
Course Will Prepare You to:
- Build an isolated, controlled laboratory environment for analyzing code and behavior of malicious programs.
- Employ network and system-monitoring tools to examine how malware interacts with the file system, the registry, the network and other processes in a Windows environment.
- Control relevant aspects of the malicious program's behavior through network traffic interception and code patching to perform effective malware analysis.
- Use a disassembler and a debugger to examine inner-workings of malicious Windows executables.
- Bypass a variety of packers and other defensive mechanisms, designed by malware authors to misdirect, confuse and otherwise slow down the analyst.
- Recognize and understand common assembly-level patterns in malicious code, such as DLL injection and anti-analysis measures.
- Assess the threat associated with malicious documents, such as PDF and Microsoft Office files in the context of targeted attacks.
- Derive Indicators of Compromise (IOCs) from malicious executables to perform incident response triage.
- Utilize practical memory forensics techniques to examine capabilities of rootkits and other malicious program types.
Press & Reviews
"Highly valuable content, greatly increased my understanding of malware and techniques to reverse engineer." - Kenneth Miltenberger, US Coast Guard
"I thought I knew reversing. This class taught me so much more and provided easy understandings of complex reversing tasks." -David Werden, NGIS
"This is the most complete malware analysis course I have ever taken. An awesome variety of tools and techniques for the malware analyst." - Anonymous
"It is an excellent course for those who want a hands-on experience understanding an 'under the hood view' of malware and how it works." -Ryan Denniston, DoD
For additional feedback regarding the course, please see:
- A review of the FOR610: Reverse Engineering-Malware course by the Ethical Hacker Network
- A review of the FOR610: Reverse Engineering-Malware course by Chris Sanders
- Students' comments about the reverse-engineering malware course
Authors of the reverse-engineering malware course created the following cheat sheets to summarize some of the concepts and tools you will learn:
- Reverse-Engineering Malware Cheat Sheet
- Analyzing Malicious Documents Cheat Sheet
- REMnux Usage Tips for Malware Analysis on Linux
You can get a sense for malware analysis approaches explored in this course by looking at the following resources:
- Introduction to Malware Analysis webcast by Lenny Zeltser
- Malware Analysis Essentials using REMnux webcast by Lenny Zeltser
- Malware Analysis Tips interview with Jake Williams
- Thoughts on Malware, Digital Forensics and Data Breaches interview with Hal Pomeranz
- Malware Analyst Job Description by Lenny Zeltser
This course is a part of SANS' comprehensive Digital Forensics and Incident Response (DFIR) curriculum. Learn more about our DFIR courses and free resources.
Take your learning beyond the classroom. Explore our site network for additional resources related to this course's subject matter.