FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
- Contents | Additional Info
- Delivery Methods:
Live | Online
I learned a variety of tools and techniques for malware analysis in a relatively short time, I am a better forensic analyst and I can better protect my organization.
The best SANS course I've ever attended, and it was easy to say that, great structure of knowledge, great teaching skills, great function.
Learn to turn malware inside out! This popular course explores malware analysis tools and techniques in depth. FOR610 training has helped forensic investigators, incident responders, security engineers, and IT administrators acquire the practical skills to examine malicious programs that target and infect Windows systems.
Understanding the capabilities of malware is critical to an organization's ability to derive threat intelligence, respond to information security incidents, and fortify defenses. This course builds a strong foundation for reverse-engineering malicious software using a variety of system and network monitoring utilities, a disassembler, a debugger, and many other freely available tools.
The course begins by establishing the foundation for analyzing malware in a way that dramatically expands upon the findings of automated analysis tools. You will learn how to set up a flexible laboratory to examine the inner workings of malicious software, and how to use the lab to uncover characteristics of real-world malware samples. You will also learn how to redirect and intercept network traffic in the lab to explore the specimen's capabilities by interacting with the malicious program.
The course continues by discussing essential assembly language concepts relevant to reverse engineering. You will learn to examine malicious code with the help of a disassembler and a debugger in order to understand its key components and execution flow. In addition, you will learn to identify common malware characteristics by looking at suspicious Windows API patterns employed by malicious programs.
Next, you will dive into the world of malware that thrives in the web ecosystem, exploring methods for assessing suspicious websites and de-obfuscating malicious JavaScript to understand the nature of the attack. You will also learn how to analyze malicious Microsoft Office, RTF, and PDF files. Such documents act as a common infection vector as a part of mainstream and targeted attacks. You will also learn how to examine "file-less" malware and malicious PowerShell scripts.
Malware is often obfuscated to hinder analysis efforts, so the course will equip you with the skills to unpack executable files. You will learn how to dump such programs from memory with the help of a debugger and additional specialized tools, and how to rebuild the files' structure to bypass the packer's protection. You will also learn how to examine malware that exhibits rootkit functionality to conceal its presence on the system, employing code analysis and memory forensics approaches to examining these characteristics.
FOR610 malware analysis training also teaches how to handle malicious software that attempts to safeguard itself from analysis. You will learn how to recognize and bypass common self-defensive measures, including code injection, sandbox evasion, flow misdirection, and other measures.
The course culminates with a series of Capture-the-Flag challenges designed to reinforce the techniques learned in class and provide additional opportunities to learn practical, hands-on malware analysis skills in a fun setting.
Hands-on workshop exercises are a critical aspect of this course. They enable you to apply malware analysis techniques by examining malicious software in a controlled and systemic manner. When performing the exercises, you will study the supplied specimens' behavioral patterns and examine key portions of their code. To support these activities, you will receive pre-built Windows and Linux virtual machines that include tools for examining and interacting with malware.
In summary, FOR610 malware analysis training will teach you how to:
- Build an isolated, controlled laboratory environment for analyzing the code and behavior of malicious programs
- Employ network and system-monitoring tools to examine how malware interacts with the file system, registry, network, and other processes in a Windows environment
- Uncover and analyze malicious JavaScript and other components of web pages, which are often used by exploit kits for drive-by attacks
- Control relevant aspects of the malicious program's behavior through network traffic interception and code patching to perform effective malware analysis
- Use a disassembler and a debugger to examine the inner workings of malicious Windows executables
- Bypass a variety of packers and other defensive mechanisms designed by malware authors to misdirect, confuse, and otherwise slow down the analyst
- Recognize and understand common assembly-level patterns in malicious code, such as code L injection, API hooking, and anti-analysis measures
- Assess the threat associated with malicious documents, such as PDF and Microsoft Office files
- Derive Indicators of Compromise (IOCs) from malicious executables to strengthen incident response and threat intelligence efforts.
Notice:
For multi-course live training events, there will be a set up time from 8:30-9:00 am on the first day only to make sure that computers are configured correctly to make the most of class time. All students are strongly encouraged to attend.
Course Syllabus
FOR610.1: Malware Analysis Fundamentals
Overview
Section 1 lays the groundwork for malware analysis by presenting the key tools and techniques useful for examining malicious programs. You will learn how to save time by exploring Windows malware in several phases. Static properties analysis examines meta data and other file attributes to perform triage and determine the next course of action. Behavioral analysis focuses on the program's interactions with its environment, such as the registry, file system, and network. Code analysis focuses on the specimen's inner workings and makes use of debugging tools such as x64bg. You will learn how to set up and utilize a flexible laboratory to perform such an analysis in a controlled manner, becoming familiar with the supplied Windows and Linux (REMnux) virtual machines. You will then learn how to use the key analysis tools by examining a malware sample in your lab-with guidance and explanations from the instructor-to reinforce the concepts discussed throughout the day.
The tools introduced in this section include pestr, peframe, PeStudio, Process Hacker, Process Monitor, Regshot, ProcDOT, x64dbg, API Monitor, and INetSim.
CPE/CMU Credits: 6
Topics
- Assembling a toolkit for effective malware analysis
- Examining static properties of suspicious programs
- Performing behavioral analysis of malicious Windows executables
- Performing static and dynamic code analysis of malicious Windows executables
- Interacting with malware in a lab to derive additional behavioral characteristics
FOR610.2: Reversing Malicious Code
Overview
Section 2 focuses on examining malicious Windows executables at the assembly level. You will discover approaches for studying the innards of a specimen by looking at it through a disassembler. The section begins with an overview of key code-reversing concepts and presents a primer on essential x86 Intel assembly concepts, such as instructions, function calls, variables and jumps. You will also learn how to examine common assembly constructs such as functions, loops, and conditional statements. The material will then build on this foundation and expand your understanding to incorporate 64-bit malware, given its growing popularity. Throughout the discussion, you will learn to recognize common characteristics at a code level, including HTTP command and control, keylogging, and command execution.
This section discusses the concepts outlined above while also walking students through the key capabilities of IDA Pro for performing static code analysis.
CPE/CMU Credits: 6
Topics
- Understanding core x86 assembly concepts to perform malicious code analysis
- Identifying key assembly logic structures with a disassembler
- Following program control flow to understand decision points during execution
- Recognizing common malware characteristics at the Windows API level (registry manipulation, keylogging, HTTP communications, droppers)
- Extending assembly knowledge to include x64 code analysis
FOR610.3: Malicious Web and Document Files
Overview
Section 3 focuses on examining malicious web pages and documents, which adversaries can use to directly perform malicious actions on the infected system and launch attacks that lead to the installation of malicious executable files. The section begins by discussing how to examine suspicious websites that might host client-side exploits. Next, you will learn how to de-obfuscate malicious scripts with the help of script debuggers and interpreters, examine Microsoft Office macros, and assess the threats associated with PDF and RTF files using several techniques.
The tools introduced in this section include Fiddler, SpiderMonkey, box-js, base64dump.py, pdf-parser.py, peepdf.py, scdbg, olevba.py, oledump.py, rtfdump.py, and jmp2it.
CPE/CMU Credits: 6
Topics
- Interacting with malicious websites to assess the nature of their threats
- De-obfuscating malicious JavaScript using debuggers and interpreters
- Analyzing suspicious PDF files
- Examining malicious Microsoft Office documents, including files with macros
- Analyzing malicious RTF document files
FOR610.4: In-Depth Malware Analysis
Overview
Section 4 builds on the approaches to behavioral and code analysis introduced earlier in the course, exploring techniques for uncovering additional aspects of the functionality of malicious programs. The section begins by discussing how to handle packed malware. We will examine ways to identify packers and strip away their protection with the help of a debugger and other utilities. We will also walk through the analysis of malware that employs multiple technologies to conceal its true nature, including the use of registry, obfuscated JavaScript and PowerShell scripts, and shellcode. Finally, we will learn how malware implements Usermode rootkit functionality to perform code injection and API hooking, examining this functionality from both code and memory forensics perspectives.
The tools introduced in this section include Detect It Easy, Exeinfo Pe, Bytehist, CFF Explorer, Scylla, OllyDumpEx, ands Volatility.
CPE/CMU Credits: 6
Topics
- Recognizing packed malware
- Getting started with unpacking
- Using debuggers for dumping packed malware from memory
- Analyzing multi-technology and file-less malware
- Code injection and API hooking
- Using memory forensics for malware analysis
FOR610.5: Examining Self-Defending Malware
Overview
Section 5 takes a close look at the techniques malware authors commonly employ to protect malicious software from being examined. You will learn how to recognize and bypass anti-analysis measures designed to slow you down or misdirect you. In the process, you will gain more experience performing static and dynamic analysis of malware that is able to unpack or inject itself into other processes. You will also expand your understanding of how malware authors safeguard the data that they embed inside malicious executables. As with the other topics covered throughout the course, you will be able to experiment with such techniques during hands-on exercises.
This section brings together many of the tools covered earlier in the course, including IDA Pro and x64dbg/x32dbg. It also introduces FLOSS, bbcrack.py, ScyllaHide, and pe_unmapper, among others.
CPE/CMU Credits: 6
Topics
- How malware detects debuggers and protects embedded data
- Unpacking malicious software that employs process hollowing
- Bypassing the attempts by malware to detect and evade the analysis toolkit
- Handling code misdirection techniques, including SEH and TLS Callbacks
- Unpacking malicious executable by anticipating the packer's actions
FOR610.6: Malware Analysis Tournament
Overview
Section 6 assigns students to the role of a malware analyst working as a member of an incident response or forensics team. Students are presented with a variety of hands-on challenges involving real-world malware in the context of a fun tournament. These challenges further a student's ability to respond to typical malware analysis tasks in an instructor-led lab environment and offer additional learning opportunities. Moreover, the challenges are designed to reinforce skills covered in the first five sections of the course, making use of the popular SANS NetWars educational platform. By applying the techniques learned earlier in the course, students consolidate their knowledge and shore up skill areas where they feel they need additional practice. Students who score the highest in the malware analysis challenge will be awarded the coveted SANS Lethal Forensicator coin.
CPE/CMU Credits: 6
Topics
- Behavioral malware analysis
- Dynamic malware analysis (using a debugger)
- Static malware analysis (using a disassembler)
- JavaScript de-obfuscation
- PDF document analysis
- Office document analysis
- Memory analysis
Additional Information
Testimonial
Here are just a few of the comments shared with us by FOR610 attendees:
- "Highly valuable content, greatly increased my understanding of malware and techniques to reverse engineer." - Kenneth Miltenberger, U.S. Coast Guard
- "I thought I knew reversing. This class taught me so much more and provided easy understandings of complex reversing tasks." - David Werden, NGIS
- "It is an excellent course for those who want hands-on experience understanding an under-the-hood view of malware and how it works." - Ryan Denniston, Department of Defense
- "High valuable content that has immediately boosted my skills. The day 6 CTF was awesome." - Rafe Pilling, Dell Secureworks
- "Blown away again. FOR610 is intense, challenging, relevant, and will take you to the next level!" - Matthew B., BlueCross BlueShield of Louisiana
- "The best SANS course I've ever attended, and it was easy to say that; great structure of knowledge, great teaching skills, great function." - Karel Nykles, CESNET, z.s.p.o.
- "Like all SANS courses, it exposes you to everything you need to know in the subject. It lays a foundation for you to keep learning and building the skills taught in class. Nothing could make you an expert in a topic in a week, but this class can take you from zero to a good working knowledge, so you can teach yourself to be an expert." - Dave Lassalle
- "I learned a variety of tools and techniques for malware analysis in a relatively short time, I am a better forensic analyst and I can better protect my organization." - David Bernal, ALSTOM
Laptop Required
Important! Bring your own system configured according to these instructions!
A properly configured laptop is required to participate in this course. Prior to the start of class, you must install virtualization software and meet minimum hardware requirements as described below. If you do not carefully read and follow these instructions, you will leave the class unsatisfied because you will not be able to participate in hands on-exercises that are essential to this course.
The following are minimal requirements for your laptop:
- Intel-compatible 64-bit dual-core CPU i5 or higher (a faster processor is recommended)
- 8 GB RAM (more memory is recommended)
- 60 GB of available disk space (more space is recommended)
- USB port 2.0 or higher (USB port 3.0 is recommended)
- Wi-Fi connectivity capabilities
- Virtualization support enabled in the BIOS; this is sometimes called Intel Virtualization Technology (also known as Intel VT) or AMD-V
Note that your laptop needs to have Wi-Fi capabilities. You also need the ability to have local administrative rights on the system you will be using during class.
In addition, you need to be able to extract large compressed files. The extraction utilities built into the operating system might struggle with this. For this reason, please download and install the free 7-Zip tool if using Windows or Linux as your base OS. For Mac OS, consider using The Unarchiver free utility.
The Need for VMware Virtualization
Please download and install VMware Workstation Pro14 or higher or VMware Fusion Pro10 or higher prior to class. Both are commercial tools. If you do not own a licensed copy of VMware Workstation Pro or Fusion Pro, you can obtain a free 30-day trial copy from VMware. Please do this before class and confirm that your trial won't expire until the course ends. Note that the free non-Pro versions of these products (e.g., VMware Workstation Player) are not sufficient for this course because they do not support snapshot functionality, which we will need to use. Also, VirtualBox is not appropriate because of compatibility and troubleshooting problems you might encounter during class.
You will be asked to take multiple snapshots of virtual machines during the course. Experience has shown that students with limited free disk space are more likely to experience snapshot and other VMware performance problems. Please test your ability to run a virtual machine, create a snapshot, and restore a snapshot in a timely manner (creating a snapshot should take less than 90 seconds).
VMware Workstation Pro on Windows 10 is not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class, if they're enabled on your system, by following instructions from VMware
If in doubt, start up some virtual machine using your Windows Workstation Pro to confirm that your VMware software is functioning properly.
Using Your System for Malware Analysis
Hands-on exercises will involve operating with malicious code. Although VMware will provide you with reasonable isolation, we do not recommend using your day-to-day production system as your laboratory machine. We expect you to exercise due caution when handling malicious code.
Final Checklist
Review the following checklist to make sure that your laptop is prepared for the course:
- Your laptop meets hardware requirements outlined here, including Wi-Fi capabilities, sufficient resources, and a 64-bit processor with virtualization enabled.
- VMware Workstation Pro14 or higher or VMware Fusion Pro10 or higher is installed and operational with a valid license.
- The VMware license will not expire before the class (if using a trial copy).
If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.
Who Should Attend
FOR610 acts as a practical on-ramp into the world of malware analysis. It is useful both for individuals looking to enter this exciting field, as well as for those who seek to formalize and expand their skills in this area. Attendees who have found this course especially useful often have responsibilities in the areas of incident response, forensic investigation, information security, threat intelligence, and threat hunting. Course participants have included:
- Individuals who have dealt with incidents involving malware and wanted to learn how to understand key aspects of malicious programs.
- Technologists who have informally experimented with aspects of malware analysis prior to the course and were looking to formalize and expand their expertise in this area.
- Forensic investigators and security practitioners looking to expand their skillsets and learn how to play a pivotal role in the incident response process.
The course begins by covering malware analysis at an introductory level, then quickly progresses to discussing tools and techniques of intermediate complexity. Neither programming experience nor knowledge of assembly is required to benefit from the course. However, you should have a general idea about core programming concepts such as variables, loops, and functions, so you can quickly grasp the relevant concepts in this area. The course spends some time discussing essential aspects of the assembly language, allowing malware analysts to navigate through malicious executables using a disassembler and a debugger.
Prerequisites
FOR610 attendees should:
- Have a computer system that matches the stated laptop requirements; some software needs to be installed before students come to class.
- Be familiar with using Windows and Linux operating environments and be able to troubleshoot general OS connectivity and setup issues.
- Be familiar with VMware and be able to import and configure virtual machines.
- Have a general idea about core programming concepts such as variables, loops, and functions in order to quickly grasp the relevant concepts in this area; however, no programming experience is necessary.
Why Take This Course?
Why Choose Our Course?
The malware analysis process taught in FOR610 helps incident responders and other security professionals assess the severity and repercussions of a situation that involves malicious software so that they can plan recovery steps. Forensics investigators also learn about the key characteristics of malware discovered during the examination, including how to establish Indicators of Compromise and obtain other threat intelligence details for analyzing, scoping, and containing the incident.
What threat does the malicious or suspicious program pose? What do its mechanics reveal about the adversary's goals and capabilities? How effective are the company's security controls against such infections? What security measures can strengthen the organization's infrastructure from future attacks of this nature? This course teaches the skills necessary to answer these and other questions critical to an organization's ability to handle malware threats and related incidents.
What You Will Receive
When attending FOR610, you will receive a USB key-based toolkit packed with helpful malware analysis tools. You will use them to perform exercises in class, and you can also use them later to interrogate suspicious files when you return to your job. The tools have been preinstalled and configured for your convenience into two virtual machines that you will receive in the course toolkit:
- A Windows REM Workstation virtual machine with preinstalled analysis tools, along with the corresponding Microsoft Windows license.
- A REMnux virtual machine set up to run the lightweight Linux distribution used by many malware analysts world-wide.
The toolkit also includes many real-world malware samples that you will examine during the course when performing hands-on lab exercises, as well as MP3 audio files of the complete course lectures.
You will also receive printed training materials with detailed explanations and illustrations of the concepts, tools, and techniques covered in the course. The materials include a workbook that provides detailed, step-by-step instructions for all the hands-on lab exercises performed in the course to facilitate the learning experience.
Press & Reviews
"Reverse Engineering Malware teaches a systematic approach to analyzing malicious code utilizing the latest and greatest tools and techniques. It's not earth-shattering news that the prevalence of malicious code will continue to increase for the foreseeable future. The knowledge and skills this course provides will enable those responsible for responding to and preventing incidents to better understand and respond to emerging malware threats." - Justin Kallhoff, Infogressive (Read More)
"The SANS Institute is currently the leader in the commercial IR and computer forensic training market. They have a large number of quality courses." - Incident Response & Computer Forensics, Third Edition, by Jason Luttgens, Matthew Pepe, and Kevin Mandia
"When I saw Lenny Zeltser was teaching the SANS FOR610 course on reverse-engineering malware in Prague this year, I dashed to my boss's office to beg him for approval to attend. The topic is not only very relevant to our work here at i-Force/Cyberforce but was going to be taught by one of the topic's spiritual leaders, so to speak. I haven't come across another analyst that doesn't use REMnux, the Linux distribution created and maintained by Mr. Zeltser.... So I jumped at the chance to be present. It's like having the opportunity of being trained in using the Force by Yoda himself..." - Jan Verhulst, Cyberforce (Read More)
"I'm thrilled I got the chance to take the course. I walked away with a lot of new skills and am able to provide a lot of value to my organization as a result. I now feel completely comfortable performing code analysis of malicious binaries." - Chris Sanders, Security Analyst, PhD (Read More)
Statements From Our Authors
"I'm amazed how much information a skilled analyst can derive from the malicious files that find their way onto infected systems. Knowing how to reverse-engineer malware allows you to determine the severity of the intrusion, the context of the attack, the intent of the adversary, the containment steps, and numerous other details that help the organization handle the incident. The FOR610 course is the on-ramp for professionals who wish to acquire such malware analysis, building upon the expertise they already have, to learn how to examine malicious software using a variety of practical techniques."
- Lenny Zeltser
"To combat adversaries effectively, you must understand the tools they are using against you. This course teaches the critical skills necessary to systematically reverse engineer code and understand its functionality, dependencies, and limitations. Attackers often go to great lengths to produce unique, robust malware to achieve their objectives. Organizations must have an equally skilled malware analysis capability to dissect that code and learn from it to mitigate future attacks."
- Anuj Soni
"Back when I got involved in incident response, it was enough to say "here is the infected system, rebuild it" - it would be rebuilt and we would fly the mission accomplished banner. Those days are long gone. Today, organizations must understand the capabilities of the malware that has infected their systems in order to perform proper impact and risk assessments. Additionally, attackers are modifying their malware with increasing frequency to bypass antivirus and other endpoint controls. Only through reverse engineering can defenders isolate the most appropriate IOCs to stop identify malware variants as they are released into the wild. This course provides defenders with the skills required to analyze the malware found in today's enterprise environments."
- Jake Williams
Additional Resources
Authors of this course created the following cheat sheets to summarize some of the concepts and tools useful for malware analysis:
- Reverse-Engineering Malware Cheat Sheet
- Analyzing Malicious Documents Cheat Sheet
- REMnux Usage Tips for Malware Analysis on Linux
You can also get a sense for malware analysis approaches explored in this course by looking at the following resources:
- Introduction to Malware Analysis webcast by Lenny Zeltser
- Closing the Door on Webshells webcast by Anuj Soni
- Malware Analysis Essentials using REMnux webcast by Lenny Zeltser
- Need for Speed: Malware Edition video by Anuj Soni
- Malware Analysis Tips interview with Jake Williams
- Thoughts on Malware, Digital Forensics and Data Breaches interview with Hal Pomeranz
- SANS Forensics Blog Articles on Malware Analysis by SANS faculty and contributors
This course is a part of SANS' comprehensive Digital Forensics and Incident Response (DFIR) curriculum. Learn more about our DFIR courses and free resources. Take your learning beyond the classroom. Explore our DFIR site network for additional resources related to the subject matter of this course.
Take your learning beyond the classroom. Explore our site network for additional resources related to this course's subject matter.
