The most trusted source for computer security training, certification and research.

select a course
Orlando, FL - March 6 - 15, 2010
Global Information Assurance Certification

Instructors have excellent hands on real life experience.
-Terry Kuxhaus, State of South Dakota

SECURITY 610

Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Monday, March 8, 2010 - Thursday, March 11, 2010
Lenny Zeltser, SAVVIS
6 CPE Credits Per Day

Promo Trailer for the REM Course on YouTube

Expand your capacity to fight malicious code by learning how to analyze bots, worms, and trojans. This popular four-day course discusses practical approaches to examining Windows malware using a variety of monitoring utilities, a disassembler, a debugger, and other tools useful for reverse-engineering malicious software. You don't have to be a full-time malware searcher to benefit from this course-as organizations increasingly rely on their staff to act as first responders during a security incident, malware analysis skills become increasingly important.

By covering both behavioral and code analysis approaches, this unique course provides a rounded approach to reverse-engineering. As a result, the course makes malware analysis accessible even to individuals with a limited exposure to programming concepts. The materials do not assume that the students are familiar with reverse-engineering; however, the difficulty level of concepts and techniques increases quickly as the course progresses.

In the first half of the course, you will learn how to set up an inexpensive and flexible laboratory for understanding inner-workings of malware, and demonstrate the process by exploring capabilities of real-world specimens. You will learn to examine the program's behavioral patterns and assembly code, and study techniques for bypassing common code obfuscation mechanisms. The course also explores how to analyze browser-based malware.

In the second half of the course, you will review key assembly language concepts. You will learn to examine malicious code to understand its flow by identifying key logic structures, looking at examples of bots, rootkits, key loggers, and so on. You will understand how to work with PE headers and handle DLL interactions. You will also develop skills for analyzing self-defending malware through advanced unpacking techniques and bypassing code-protection mechanisms. Finally, you will discover how to bypass obfuscation techniques employed by browser-based malicious scripts.

Hands-on workshop exercises are an essential aspect of this course, and allow you to apply reverse-engineering techniques by examining malicious code in a carefully-controlled environment. When performing the analysis, you will study the supplied specimen's behavioral patterns, and examine key portions of its assembly code.

  • Prerequisites
    • Students should have a computer system that matches the stated laptop requirements: some software needs to be installed before you come to class.
    • Students should be familiar with using Windows and Linux operating environments and be able to troubleshoot general connectivity and setup issues.
  • Who Should Attend
    • You will benefit from this course if your job ever requires you to understand key aspects of malicious programs.
    • Individuals who found this course particularly useful often had responsibilities in the areas of incident handling, forensic analysis, Windows security, and system administration.
    • Attendees of this course often focus on supporting their organizations' internal security needs. The class also frequently includes engineers from security product and service companies who are looking to deepen their malware analysis expertise.
  • You Will Learn to Analyze Malware Using Tools Such As
    • System Monitor, Process Explorer, Regshot
    • BinText, LordPE, FireBug, VMware
    • IDA Pro, OllyDbg, OllyDump, OllyScript
    • Rhino, Malzilla, SpiderMonkey
    • Microsoft Script Editor, Microsoft Script Debugger
    • Snort, NetCat, Honeyd, fakeDNS
  • Topics Covered by the Course Include
    • Configuring the laboratory environment
    • Assembling the analysis toolkit
    • Performing behavioral and code analysis
    • Bypassing authentication mechanisms
    • Reverse-engineering protected executables
    • Intercepting network connections
    • Patching compiled executables
    • Examining key aspects of shellcode
    • Malware analysis shortcuts
    • Core code reversing concepts
    • Assembly language primer
    • Identifying assembly logic structures
    • Reversing seen in common malware categories
    • Working with PE headers
    • Handling DLL interactions and API hooking
    • Packer identification
    • Manual and automated unpacking
    • Bypassing anti-analysis mechanisms
    • Analyzing browser malware

Topical information that can immediately be applied and shared in the workplace.
-Blair Campbell, Bank of Nova Scotia