Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

FOR610Digital Forensics and Incident Response
  • 6 Days (Instructor-Led)
  • 36 Hours (Self-Paced)
Course authored by:
Lenny ZeltserAnuj Soni
Lenny Zeltser & Anuj Soni
Register NowCourse Preview
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
Course authored by:
Lenny ZeltserAnuj Soni
Lenny Zeltser & Anuj Soni
Register NowCourse Preview
  • GIAC Reverse Engineering Malware (GREM)

    Learn about certification

  • 36 CPEs

    Apply your credits to renew your certifications

  • In-Person, Virtual or Self-Paced

    Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

  • Advanced Skill Level

    Course material is geared for cyber security professionals with hands-on experience

  • 48 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

Jump to:

Explore malware analysis tools and techniques in depth and acquire the practical skills to examine malicious programs that target and infect Windows systems.

Featured Quote

This course has helped me to improve my knowledge of malware techniqueI’ve taken 9 SANS courses in 3 years, and FOR610 is one of the best courses SANS offers. Even if malware reversing isn’t a part of one’s regular duties, it’s still a worthwhile class just for exposure and enjoyment.
Chris A.U.S. Military

Course Overview

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques equips students with hands-on skills to analyze malware targeting Windows systems. Through labs and Capture-the-Flag challenges, students use advanced tools to uncover malware capabilities, analyze obfuscation techniques, and address common threats. This malware analysis course is ideal for those seeking to enhance threat intelligence, incident response, and enterprise defenses.

Thousands of professionals who analyze malware have gotten their start by taking FOR610: Reverse-Engineering Malware. This practical course is the onramp into this fun and challenging aspect of cybersecurity. It will teach you to dissect malicious software targeting Windows systems by combining expert instruction and immersive hands-on labs.

The training moves beyond automated tools, showing you how to use disassemblers, debuggers, and monitoring utilities to interpret behavioral patterns, extract indicators of compromise, and gain key insights into malware operations. In addition to focusing on compiled Windows executables, the course covers the analysis of malicious document files and scripts. It also prepares you to counter anti-analysis techniques, such as sandbox evasion and fileless malware.

With engaging labs and capture-the-flag challenges, FOR610 lets you expand your skills by tackling real-world incident response and forensics investigations that involve malicious software.

In summary, FOR610 malware analysis training will teach you how to: 

  • Build an isolated, controlled lab environment to safely analyze the code and behavior of malicious programs
  • Use network and system-monitoring tools to investigate malware interactions with files, the registry, networks, and processes in Windows environments
  • Analyze obfuscated JavaScript and PowerShell scripts often used in attack chains
  • Intercept network traffic and patch code to control malware behavior during analysis
  • Employ disassemblers and debuggers to examine the internal workings of malicious executables
  • Bypass packers and anti-analysis mechanisms designed to hinder and misdirect analysts
  • Identify common assembly-level patterns like code injection, C2 interactions, and anti-analysis measures
  • Assess threats from malicious documents, such as PDF and Microsoft Office files
  • Extract Indicators of Compromise (IOCs) from malware to enhance threat intelligence and incident response efforts
  • Reverse-engineer .NET malware designed to evade detection through obfuscation and reflective code loading

Author Statement

"I'm amazed how much information a skilled analyst can derive from the malicious files that find their way onto infected systems. Knowing how to reverse-engineer malware allows you to determine the severity of the intrusion, the context of the attack, the intent of the adversary, the containment steps, and numerous other details that help the organization handle the incident. The FOR610 course is the on-ramp for professionals who wish to acquire such malware analysis, building upon the expertise they already have, to learn how to examine malicious software using a variety of practical techniques."

- Lenny Zeltser

"To combat adversaries effectively, you must understand the tools they are using against you. This course teaches the critical skills necessary to systematically reverse engineer code and understand its functionality, dependencies, and limitations. Attackers often go to great lengths to produce unique, robust malware to achieve their objectives. Organizations must have an equally skilled malware analysis capability to dissect that code and learn from it to mitigate future attacks."

- Anuj Soni

What You’ll Learn

  • Set up a secure lab to analyze malware behavior
  • Use monitoring tools to observe interactions with Windows systems
  • Analyze obfuscated scripts and executables
  • Control malware through network interception and code patching
  • Investigate internals using disassemblers and debuggers
  • Identify assembly-level patterns like code injection and anti-analysis tactics
  • Extract IOCs and assess threats from malicious files

Business Takeaways

  • Enable teams to perform in-house malware analysis, reducing reliance on external resources
  • Expand analysis capabilities to provide greater value to internal or external stakeholders
  • Increase efficiency in delivering actionable insights and analysis results
  • Minimize incident scope and cost with faster response times to security threats

Meet Your Authors

  • Slide 1 of 2
    Lenny Zeltser
    Lenny Zeltser

    Lenny Zeltser

    Fellow

    Lenny Zeltser is a leader in developing resilient security programs. His invaluable tools, like REMnux, a widely used Linux distribution for malware analysis, have become industry standards in combating malicious software.

    Read more about Lenny Zeltser
  • Slide 2 of 2
    Anuj Soni
    Anuj Soni

    Anuj Soni

    Senior Instructor

    Anuj Soni, Principal Reverse Engineer at United Healthcare, has over 15 years of experience enhancing organizational security postures. His expertise has led to the identification, containment, and remediation of multiple threat actor groups.

    Read more about Anuj Soni
Slide 1 of 0

Course Syllabus

Explore the course syllabus below to view the full range of topics covered in FOR610™: Hacker Tools, Techniques, and Incident Handling™.

Section 1Malware Analysis Fundamentals

Section 1 introduces essential malware analysis techniques, covering static, behavioral, and code analysis to understand malware interactions and inner workings. Students will set up a flexible lab environment, using Windows and REMnux virtual machines, to conduct these analyses effectively and with instructor guidance.

Topics covered

  • Assembling a toolkit for effective malware analysis
  • Examining static properties of suspicious programs
  • Performing behavioral analysis of malicious Windows executables
  • Performing dynamic code analysis of malicious Windows executables
  • Exploring network interactions of malware in a lab for additional characteristics 

Labs

  • Setting up and using your lab for behavioral analysis
  • Intercepting and examining malicious network traffic
  • Decoding malicious artifacts using dynamic analysis
  • Debugging malware using x64dbg
  • Understanding command-and-control (C2)

Overview

Section 1 lays the groundwork for malware analysis by presenting the key tools and techniques useful for examining malicious programs. You will learn how to save time by exploring Windows malware in several phases. Static properties analysis examines metadata and other file attributes to perform triage and determine the next course of action. Behavioral analysis focuses on the program's interactions with its environment, such as the registry, file system, and network. Code analysis focuses on the specimen's inner workings and makes use of debugging tools such as x64bg. You will learn how to set up and use a flexible laboratory to perform such an analysis in a controlled manner, becoming familiar with the supplied Windows and Linux (REMnux) virtual machines. You will then learn how to begin examining malware in your lab - with guidance and explanations from the instructor to reinforce the concepts discussed throughout the day.

Section 2Reversing Malicious Code

Section two dives into assembly-level analysis of Windows executables, teaching key x86 and x64 concepts for malware analysis using tools like Ghidra. Students will learn to interpret disassembled code, follow control flow, and identify common malware characteristics, such as command and control, through hands-on exercises.

Topics covered

  • Understanding core x86 assembly concepts for malicious code analysis
  • Identifying key assembly constructs with a disassembler
  • Following program control flow to understand decision points
  • Recognizing common malware characteristics at the Windows API level
  • Extending assembly knowledge to include x64 code analysis 

Labs

  • Static analysis of malicious code using Ghidra
  • Analysis of common assembly-level patterns
  • Examining API interactions at the assembly level
  • 64-bit assembly code peculiarities

Overview

Section two focuses on statically examining malicious Windows executables at the assembly level. You will discover approaches for studying inner workings of a specimen by looking at it through a disassembler and, at times, with the help of a decompiler. You will use Ghidra for hands-on exercises in this section. The section begins with an informally overview of key code-reversing concepts and presents an experiment with aspects of primer on essential x86 Intel assembly concepts, such as malware analysis and are looking to instructions, function calls, variables, and jumps. You will formalize and expand your expertise, also learn how to examine common assembly constructs, in this area such as functions, loops, and conditional statements. The material will then build on this foundation and expand practitioners looking to expand understanding to incorporate 64-bit malware.

Throughout the discussion, you will learn to recognize common characteristics at a code level, including HTTP command and control, artifact extraction, and command execution.

Section 3Analyzing Malicious Documents and Scripts

Section 3 covers the analysis of malicious documents and scripts, teaching techniques for examining PDFs, VBA macros in Office files, RTF documents, and deobfuscating JavaScript. Students will learn to identify threats, extract indicators of compromise (IOCs), and understand shellcode capabilities within these file types.

Topics covered

  • Malicious PDF file analysis
  • The analysis of suspicious websites
  • VBA macros in Microsoft Office documents
  • Examining malicious RTF files
  • Understanding shellcode

Labs

  • Examining suspicious PDF documents
  • Investigating malicious websites
  • Analyzing VBA macros in Microsoft Office documents
  • Examining shellcode artifacts
  • Deobfuscating JavaScript and PowerShell

Overview

Section 3 explores malware samples and techniques that thrive in the Windows ecosystem but that are not traditional executable files. We'll cover the analysis of malicious documents—PDF, Microsoft Office, and RTF files. We will also learn ways of examining the threat posed by suspicious websites. This section will also share techniques for analyzing shellcode, handling JavaScript and PowerShell scripts, and examining .NET malware.

Full Topic Details

  • Malicious PDF file analysis
  • Malicious website analysis
  • VBA macros in Microsoft Office documents
  • Examining malicious RTF files
  • Understanding shellcode
  • Deobfuscating malicious JavaScript scripts
  • Analyzing PowerShell and .NET malware

Section 4In-Depth Malware Analysis

Section 4 delves into advanced techniques for malware analysis, focusing on unpacking, deobfuscating, and analyzing multi-technology malware, including .NET and "fileless" threats. Students will learn to identify packers, handle code injection methods, and examine obfuscated JavaScript, PowerShell, and shellcode.

Topics covered

  • Recognizing packed Windows malware
  • Getting started with unpacking
  • Using debuggers for dumping packed malware from memory
  • Analyzing multi-technology and "fileless" malware
  • Analyzing .NET malware

Labs

  • Getting started with unpacking
  • Dumping packed malware from memory
  • Debugging packed malware
  • Analyzing fileless malware
  • Unpacking and decoding .NET assemblies

Overview

Section 4 builds on the approaches to behavioral and code analysis introduced earlier in the course, exploring techniques for uncovering additional aspects of the functionality of malicious programs. The section begins discussing practical methods for deobfuscating JavaScript, which you might encounter in malicious documents, suspicious websites, and other forms of attacks. Next, you'll learn how to handle packed malware. You will explore ways to identify packers and strip away their protection with the help of a debugger and other utilities. You will also examine a malware sample that employs multiple technologies to conceal its true nature, including the use of registry, obfuscated JavaScript and PowerShell scripts, and shellcode. You will also learn how to analyze .NET malware that has been obfuscated or packed. Finally, you will learn how malware performs code injection to evade detection and interfere with how programs perceive their environment.

Full Topic Details

  • Recognizing packed Windows malware
  • Getting started with unpacking
  • Using debuggers for dumping packed malware from memory
  • Analyzing multi-technology and "fileless" malware
  • Examining .NET malware (in-depth)
  • Code injection techniques

Section 5Examining Self-Defending Malware

Section 5 covers anti-analysis techniques used by malware authors, teaching students to identify and bypass evasion tactics, unpack malware employing process hollowing, and handle code misdirection. This section integrates and expands previous techniques, with hands-on exercises to reinforce skills in analyzing resistant malware.

Topics covered

  • How malware detects debuggers and protects embedded data
  • Unpacking malicious software that employs process hollowing
  • Bypassing the attempts by malware to detect and evade analysis tools 
  • Handling code misdirection techniques, including SEH and TLS callbacks 
  • Unpacking malicious executables by anticipating the packer's actions 

Labs

  • Patching malware to bypass anti-analysis measures
  • Deobfuscating embedded strings
  • Examining sandbox evasion capabilities of malware
  • Unpacking a variety of malware samples

Overview

Section 5 takes a close look at the techniques that malware authors commonly use to protect malicious software from being analyzed. You will learn how to recognize and bypass anti-analysis measures designed to slow you down or misdirect you. In the process, you will gain more experience performing static and dynamic analysis of malware that is able to unpack or inject itself into other processes. You will also expand your understanding of how malware authors safeguard the data that they embed inside malicious executables. As with the other topics covered throughout the course, you will be able to experiment with such techniques during hands-on exercises. This section brings together and expands on many of the tools and techniques covered earlier in the course.

Section 6Malware Analysis Tournament

Section 6 consolidates malware analysis skills through a capture-the-flag tournament, offering practical challenges with real-world malware. This hands-on experience reinforces key techniques in static and dynamic analysis, unpacking, and examining self-defending malware.

Topics covered

  • Malware analysis fundamentals
  • Reversing malicious code using static and dynamic techniques
  • Analyzing malicious documents
  • In-depth malware analysis, including unpacking
  • Examining self-defending malware 

Overview

Section 6 allows you to internalize, practice, and expand the many aspects of malware analysis you learned in the earlier sections of the course. You will be presented with a variety of hands-on challenges involving real-world malware in the context of a fun tournament. You will be given access to a capture-the-flag (CTF) system that will present to you practical challenges, which you'll need to address by examining malware in your lab. The system will offer guidance when you need it, so you can cater this game experience to your own skillset and needs. The tournament will help you consolidate your knowledge and shore up skill areas where you might need additional practice.

Things You Need To Know

Important! Bring your own system configured according to these instructions.

To participate in FOR610, you must bring a properly configured system that meets all requirements. Back up your system before class or use a machine without critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

  • CPU: 64-bit Intel i5/i7 (8th generation or newer) or AMD equivalent, with a minimum 2.0+ GHz processor. (No Apple M devices.)
  • RAM: 16GB or more.
  • Storage: At least 200GB of free space.
  • Wireless Networking: 802.11 Wi-Fi is required as no wired internet access is available in the classroom.
  • Virtualization: Ensure your BIOS settings enable virtualization (e.g., Intel-VTx or AMD-V). Verify you can access BIOS if password protected.
  • Critical Note: Apple Silicon devices (M chips) cannot support necessary virtualization and are not compatible with this course.

Mandatory Host Configuration and Software Requirements

  • Host OS: Latest version of Windows 11 or newer. Linux hosts are not supported in class.
  • Local Administrator Access: This is required. Ensure you have admin rights or make arrangements for a different laptop if your company restricts access.
  • VMware:
    • Download and install the latest version of VMware Workstation Pro.
    • "Pro" versions are required. "Player" versions are insufficient.
    • Ensure VMware runs smoothly and can boot a virtual machine. This may require disabling Hyper-V on Windows hosts.
  • Compression Tools: Install 7-Zip.

Course Media and Setup Instructions

  • Download Course Media: Files range from 40GB to over 100GB. Start downloads as soon as the link is provided to ensure readiness by Day 1.
  • Setup Instructions: Follow the "Setup Instructions" document included with your course materials. This process may take 30 minutes or more.

If you have additional questions, please contact customer service.

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques is designed for cybersecurity professionals seeking to develop or enhance their malware analysis skills.

The malware analysis process taught in FOR610 helps incident responders and other security professionals assess the severity and repercussions of a situation that involves malicious software so that they can plan recovery steps. Forensics investigators also learn about the key characteristics of malware discovered during the examination, including how to establish Indicators of Compromise and obtain other threat intelligence details for analyzing, scoping, and containing the incident.

What threat does the malicious or suspicious program pose? What do its mechanics reveal about the adversary's goals and capabilities? How effective are the company's security controls against such infections? What security measures can strengthen the organization's infrastructure from future attacks of this nature? This course teaches the skills necessary to answer these and other questions critical to an organization's ability to handle malware threats and related incidents.

This course is ideal for:

  • Practitioners managing incidents involving malware who need to understand its behavior and impact.
  • Technologists with informal malware analysis experience looking to formalize and expand their expertise.
  • Forensic investigators and IT professionals aiming to strengthen their role in the incident response process.
  • Professionals in roles such as incident response, digital forensics, threat intelligence, or SOC operations who want to deepen their reverse engineering and dynamic analysis capabilities.

The GIAC Reverse Engineering Malware (GREM) certification is designed for technologists who protect the organization from malicious code. GREM-certified technologists possess the knowledge and skills to reverse-engineer malicious software (malware) that targets common platforms, such as Microsoft Windows and web browsers. These individuals know how to examine inner-workings of malware in the context of forensic investigations, incident response, and Windows system administration. Become more valuable to your employer and/or customers by highlighting your cutting-edge malware analysis skills through the GREM certification.

  • Malware Analysis Using Malware Code and Behavioral Analysis Fundamentals
  • Windows Assembly Code Concepts for Reverse Engineering and Common Windows Malware Characteristics in Assembly
  • In-Depth Analysis of Malicious Executables and Self-Defending Malware
  • Analysis of Malicious Document Files, .NET programs, and Protected Executables

More Certification Details

  • Electronic toolkit with essential malware analysis tools
  • Windows REM Workstation VM with analysis tools and a Windows license
  • REMnux Linux VM for malware analysis
  • Real-world malware samples for labs
  • MP3 recordings of course lectures
  • Illustrated electronic workbook with step-by-step lab instructions

To ensure a successful learning experience in the FOR610: Reverse-Engineering Malware course, attendees should meet the following prerequisites:

  • Laptop Requirements: Bring a system that meets the stated hardware and software requirements, with the necessary pre-class installations completed.
  • Operating System Proficiency: Be familiar with both Windows and Linux environments, including basic troubleshooting of connectivity and setup issues.
  • Virtualization Knowledge: Have experience using VMware, including importing and configuring virtual machines.
  • Basic Programming Concepts: Understand core programming principles like variables, loops, and functions to grasp relevant concepts quickly, though prior programming experience is not required.

FOR610: Reverse-Engineering Malware is a core component of the Threat Intelligence and Forensics Learning Path. This training complements the skills taught in FOR578: Cyber Threat Intelligence and FOR710: Reverse-Engineering Malware: Advanced Code Analysis, offering a well-rounded foundation in malware analysis and threat investigation.

Other complementary areas of training include endpoint-focused forensics, network-focused forensics, and media exploitation, enabling practitioners to broaden their expertise in digital forensics and incident response.

Reverse engineering malware involves analyzing malicious software to uncover its behavior, structure, and purpose.

Why it matters:

  • Threat Analysis: Understand how malware operates and its intended targets
  • Enhanced Defenses: Strengthen systems against similar attacks
  • Countermeasures: Develop detection tools and mitigation strategies
  • Attribution: Gain insights into the origins and motives of attacks
  • Training: Build critical incident response skills, as taught in FOR610

This process is essential for understanding evolving threats and bolstering cybersecurity defenses, aligning with SANS’s mission to provide actionable education in this critical field.

The FOR610 course delivers practical and marketable skills to propel your cybersecurity career forward.

  • In-Demand Expertise: Become a pivotal resource in malware analysis and incident response
  • Real-World Skills: Acquire techniques to immediately counteract malicious threats
  • Career Growth: Unlock opportunities for advanced roles in cybersecurity operations
  • Recognition: Showcase your technical mastery in a high-demand specialty

Relevant Job Roles

Threat Hunter Training, Salary, and Career Path

Digital Forensics and Incident Response

This expert applies new threat intelligence against existing evidence to identify attackers that have slipped through real-time detection mechanisms. The practice of threat hunting requires several skill sets, including threat intelligence, system and network forensics, and investigative development processes. This role transitions incident response from a purely reactive investigative process to a proactive one, uncovering adversaries or their footprints based on developing intelligence.

Explore learning path

Digital Forensics (DGFS)

Skills Framework for the Information Age

Retrieval and interpretation of data from devices and networks to support incident response, compliance investigations, and legal cases. Work focuses on evidence integrity, validated methods, and attacker attribution.

Explore learning path

Forensics Analyst (DCWF 211)

DoD 8140: Cyber Enablers

Investigates cybercrimes, analyzing digital media and logs to establish documentary or physical evidence in support of cyber intrusion cases.

Explore learning path

Malware Analyst

Digital Forensics and Incident Response

Malware analysts face attackers’ capabilities head-on, ensuring the fastest and most effective response to and containment of a cyber-attack. You look deep inside malicious software to understand the nature of the threat – how it got in, what flaw it exploited, and what it has done, is trying to do, or has the potential to achieve.

Explore learning path

Insider Threat Analysis

NICE: Protection and Defense

Responsible for identifying and assessing the capabilities and activities of cybersecurity insider threats; produces findings to help initialize and support law enforcement and counterintelligence activities and investigations.

Explore learning path

Digital Forensics (OPM 212)

NICE: Protection and Defense

Responsible for analyzing digital evidence from computer security incidents to derive useful information in support of system and network vulnerability mitigation.

Explore learning path

Cybercrime Investigator Training, Salary, and Career Path (OPM 221)

NICE: Investigation

Cybercrime Investigators navigate dark web forums, trace cybercriminal activity, and conduct covert investigations. They follow forensic and legal standards to gather evidence and respond to cybercrimes.

Explore learning path

Military Operations / Law Enforcement Agents

Digital Forensics and Incident Response

Execute digital forensic operations under demanding conditions, rapidly extracting critical intelligence from diverse devices. Leverage advanced threat hunting and malware analysis skills to neutralize sophisticated cyber adversaries.

Explore learning path

Course Schedule and Pricing

Have Questions?Contact Us

GIAC Certification Attempt

Add a GIAC certification attempt and receive two free practice tests. View pricing in the info icons below.

OnDemand Course Access

When purchasing a live instructor-led class, add an additional 4 months of online access after your course. View pricing in the info icons below.

Group and Private Pricing

Enroll your team as a group or arrange a private session for your organization. We’ll help you choose the format that fits your goals.

Contact Sales
Showing 10 of 11

Learn Alongside Leading Cybersecurity Professionals From Around The World

  • Slide 1 of 4
    I've taken 9 SANS courses in 3 years, and FOR610 is one of the best courses SANS offers. Even if malware reversing isn't a part of one's regular duties, it's still a wortwhile class just for exposure and enjoyment.
    Chris A.Military
  • Slide 2 of 4
    I learned a great amount of valuable information in FOR610, including what areas I need to master for my job. The CTF lab was a wake up call regarding how much I don't know, so thank you!
    Urban M.CNF Technologies
  • Slide 3 of 4
    I'd recommend FOR610 to anyone in cyber security who is looking to get deeper into malware analysis.
    Richard E.IBM
  • Slide 4 of 4
    This course has helped me to improve my knowledge of malware techniques, to understand how to better protect assets, and how to successfully complete the eradication steps.
    Eric B.Nestle
Slide 1 of 0

Benefits of Learning with SANS

Bryan Simon: Teacher Standing Next to Smartboard and Explaining Concept

Get feedback from the world’s best cybersecurity experts and instructors

OnDemand Mobile App

Choose how you want to learn - online, on demand, or at our live in-person training events

Close Up of Woman Holding a Pen and Documents

Get access to our range of industry-leading courses and resources